A lost phone, a forgotten password or a code that never arrives can feel worrying when you need to check an ISA or Premium Bonds account. Most access problems have a safe, straightforward fix when you use verified channels and keep details private.
Open the official route before signing in
Use the provider’s official app or type its known web address into your browser before signing in.
Find the right account provider
Premium Bonds are run by National Savings and Investments (NS&I); ISAs are normally managed by the bank, building society or investment firm where you opened them. Check a statement, welcome email or bank payment name, because GOV.UK explains ISA rules but does not normally hold account logins.
Pick a safe device
Use your own updated phone, tablet or home computer with a screen lock. Never save passwords or enable trusted-device access on a work, public, shared or borrowed device.
| Where you sign in | Use it when | Trusted-device setting |
|---|
| Official provider app | It is installed on your personal, locked phone | Suitable if only you unlock the phone |
| Mobile browser | You type the provider address yourself | Avoid on a borrowed phone |
| Home computer | Your own account is password-protected and kept updated | Suitable only for your private browser profile |
| Public or shared computer | Only as a last resort | Never enable it |
Check the exact sign-in problem first
Stop after one or two failed attempts and identify what failed before trying again.
Reset a forgotten password once
Choose “Forgotten password” only on the official app or website and follow the prompts in order. Do not keep guessing old passwords, as many providers lock accounts after 3 to 5 failed attempts.
Wait safely for a missing code
Check your signal and registered phone number, then restart the phone once if needed. Never share a one-time passcode: genuine support workers will not ask for it during an inbound call.
If a verification code is missing, wait between 5 and 10 minutes before requesting one more. Requesting several codes can leave you unsure which is current, and entering old codes can trigger a security lock.
Rule out a browser fault
If the page freezes or loops, try one other current browser or the official app. Type a newly reset password manually once, as saved details may be outdated.
For a quick online sign-in check, match the symptom to the safest next step. A rejected password usually means that saved details are outdated, so use the official password reset route rather than guessing. A missing verification code may mean poor signal, an old registered number or a blocked message service; wait for one current code before trying again. If the page loops, use the official provider app or another updated browser.
An account security lock needs time or verified support, while changed contact details or a lost phone may require recovery checks. This approach supports secure online banking, ISA account access and Premium Bonds account access without weakening phishing scam prevention.
Recover access after changing or losing a phone
Use the provider’s official recovery route if your old number no longer receives codes.
Use an alternative verification route
Use the official app or website to select recovery and follow any email or alternative verification prompts. If that fails, call support using contact details from the verified website, app or a genuine statement; providers may verify your identity but will not request your full password or live code.
Deal with a temporary account lock
Wait for the period shown on screen, then use the official reset process once. A failed identity check often requires verified support rather than repeated online attempts.
Safe account recovery path
1. Open official app or type address
2. Stop after failed attempts
3. Select recovery
4. Contact verified support if needed
Spot fake sign-in pages before entering details
Check the web address before entering any customer number, password or code.
Check the address and the message
A logo or padlock does not prove a site is genuine. Treat unusual spelling, extra words or unexpected message links as warnings, and use the National Cyber Security Centre guidance to report suspicious messages.
Keep savings details private
Use only a route you opened yourself and keep customer numbers, passwords, security answers and codes separate. A caller who knows your name or postcode is not necessarily genuine.
If recovery fails after one careful attempt, contact the provider through its official app or website.
FAQs
How do I access my online account safely?
Open the official app or type the verified website address yourself. Complete two-factor authentication and avoid unexpected-message links.
Why has my verification code not arrived?
Weak signal, an old number, blocked short-code texts or an authenticator problem may delay it. Wait 5 to 10 minutes, then request one fresh code.
Can NS&I customer support ask for my code?
No. End the call and use contact details on the official NS&I website or app.
What should I do after losing my phone?
Use the official recovery route on a secure new device. If you cannot update the number online, call verified support and expect identity checks.
How many password attempts should I make?
Stop after one or two uncertain attempts. Between 3 and 5 failures can cause a temporary lock.
Can I trust a device on a shared computer?
No. Do not save passwords or enable trusted-device access on shared, public or borrowed devices.
Is a missing code proof that my ISA is at risk?
No. It usually has a delivery or contact-detail cause, but contact the provider through a verified route if anything looks wrong.
Does GOV.UK hold my ISA login details?
No. GOV.UK explains ISA rules, while your provider holds the login; NS&I manages Premium Bonds through its own services.
Keep one verified route for future access
Keep the official app updated and review your registered phone number and email when either changes.
Use a unique password for each savings provider and protect the linked email account with two-factor authentication. Your email inbox can receive password resets, so it is part of your account security.
⚠️ If you see an unfamiliar withdrawal, a change to your contact details or a sign-in alert you did not request, contact the provider immediately through independently verified details.
Further reading
If you want to learn more about this topic, these sources may interest you:
