It seems that every single banking & financial website that I have used logs me out after a certain period of time.

Are there a legal requirements or technical reasons for financial sites to do this? Or is this just their form of "security" to prevent others from accessing your account should you forget to logoff or secure your computer or device?

This is very poor user experience in my opinion. Google does not log me out after such a short period of time, and I feel that my Google account with 2-Step Verification and a legion of extremely intelligent engineers is far more secure than my banking accounts.

It seems I should be able to choose whether these sites log me out automatically, or if I may stay logged in for a reasonable period of time (30 - 90 days being common for other sites).


I believe the selected answer is the most complete answer to the question, but none of the reasons seem to be good reasons for banks to end your session.

There are a couple of levels of risk associated with an attacker gaining access to your banking website session:

  1. viewing your private (financial) information
  2. modifying your account (this includes stealing money, locking you out, etc.)

This same situation exists on any website account, but for financial websites, and for most people, #2 is far more severe than for other types of sites.

I think a better solution than logging users out would be to:

  1. default the session timeout to a short duration
  2. allow the user to change the session timeout for his/her account
  3. require re-authentication for actions that modify the account or move money around
  • 2
    If you choose to stay logged in for 90 days, and your life savings get stolen, are you going to accept the fault and be okay with not getting any of that money back? Or are you going to - regardless of the fact it was your misinformed choice that caused the issue - expect your bank to resolve the issue, give your money back, and take the huge PR hit involved with an account being compromised? – Anthony Grist Apr 3 '14 at 14:47
  • 2
    As I mentioned above, any changes that modify your account - such as moving money out of it - should (re)require your authentication. – mkopala Apr 3 '14 at 20:35
  • It would be nice if the user could adjust settings based on their threshold for risk. I'm seriously considering changing banks due to mine claiming a time out after just a few seconds. Calls to the financial institution in question are useless as they invariably claim I'm not using an up to date browser. However it doesn't seem to matter if I'm using the latest Google Chrome Version 50.0.2661.86 as of writing or the latest Firefox 45.0.2. I have no intention of staying logged in for 90 days or even 90 minutes. My account at the credit union doesn't suffer from this problem. – Elder Geek Apr 26 '16 at 16:59

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account.

This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it to purchase items, transfer funds out of the country, etc. (Yes, they could break in, install keyloggers, and potentially do the same attack.)

Power gmail users will check their email accounts hundreds of times a day; having to re-log in every time would be overly burdensome. Your bank account you only need to log in rarely; maybe for 10 minutes once a week or month.

The potential repercussions of a stolen bank account is typically more severe to the average user than the repercussions of having your email account stolen.

Not to say that losing your email account can't have severe repercussions as well (especially if you can use your email to reset passwords, use as part of 2-factor authentication, use for social engineering, etc.)


If your bank issues credit cards, it must maintain PCI-DSS compliance.

PCI-DSS requirement 8.1.8 states:

8.1.8 If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.


Session expiry is incorporated into applications to safeguard the user from session hijacking or cookie thefts.

Not all users are tech savvy and might not understand what session hijacking or cookie thefts are.So forcing the users to login every few minutes of inactivity is for safeguarding the users information.

Banking applications use cookies and sessions to maintain the user state and security. Inactivating the cookies after few mintues of idle time makes it impossible for the hacker who stole the cookie to login too.

  • This doesn't address the question of why banks & financial websites specifically do this. – mkopala Apr 3 '14 at 20:40
  • 6
    @mkopala Nobody is going to come to Google asking them to give them back thousands of dollars. – Casey Sep 9 '14 at 19:02

As well as the above answers, it's also to prevent people hopping onto your computer if you're away from your machine.

For example, if Bob signs into his online banking in his workplace, then decides to grab a coffee without locking his workstation first; then anyone could walk past and jump straight into his bank account.

With the X minute expiration/log out, this problem is greatly reduced if Bob gets distracted with other tasks.

  • 2
    If Bob is that lax about the security on his system perhaps an object lesson would be helpful. – Elder Geek Apr 26 '16 at 17:01

Most banking IT stacks are outdated and are houses of cards waiting to fall. Something as easy as implementing a configurable session timeout and to ask to reauthenticate on sensitive actions is easy on a sane stack, but it's a tremendous endeavour on 30 year old mainframes with a strong COBOL smell.

Another point to consider is that given the current absence of competition (all banks are bad in terms of UX), there is no business incentive for them to justify "wasting" developer time on this.


The real answer is that websites run on shared devices like internet cafes. Mobile banking apps run on personal devices, typically dont log you out, and secure very sensitive areas with additional pins or biometrics.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.