I'm redesigning an application and I'm researching the use of email vs username login options. Our application works with financial institutions and because of this have been told that usernames are required for additional security measures. I cannot find additional information to support this claim and have been reviewing similar questions to see if there is any information proving or disproving this approach.

Upon looking at several banking site I have realized that this seems to be the norm among financial institutions. Paypal seems to be the exception for it is easier to verify identity for money transfers or organizations when using email.

Why do most financial institutions use usernames instead of emails for login?

Are there standards that dictate this is more secure or is it a trust factor for usability?

enter image description hereenter image description hereenter image description here enter image description here

enter image description here

I've reviewed the following posts that all point toward using emails or email and usernames for login options but do not address if a username provides an additional layer of security.

  • 5
    I imagine it might be so that if a user has their password leaked by another source (website leak, phishing, etc) then the attackers cannot link it directly to the same u
    – Fractional
    Commented Aug 5, 2014 at 14:55
  • 1
    ..then the attackers do not have a valid username/password combo.
    – Fractional
    Commented Aug 5, 2014 at 15:01
  • 7
    This isn't really a UX issue; the experts at Security StackExchange might be a good place to ask. Commented Aug 5, 2014 at 16:32
  • 3
    @Andy 's response makes total sense, but do check this thread out where they've discussed(including @Andy) why use [Email instead of Username][1]. For the lack of reputation, I'm posting it as an answer. [1]:security.stackexchange.com/questions/33269/…
    – Zeus
    Commented Aug 5, 2014 at 22:40
  • 2
    I hate all the sites that want emails as usernames. You know, maybe peoples emails change or so...
    – PlasmaHH
    Commented Aug 6, 2014 at 9:51

7 Answers 7


There are a number of reasons:

  1. It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords).
  2. As @AlexFritz indicated it makes it harder to try hacked username and password combinations from other sites on the banking site.
  3. It makes it harder to iterate through many accounts trying a few common passwords on each
  4. It increases the amount of information an attacker needs to know (essentially the user id is a bit of information you are expected to write down or otherwise record but that still extends the effective length of the password).
  5. Email addresses can and do get re-used. You don't want someone who happens to get re-allocated a used email address to be able to carry out reset password requests etc.

This all needs balancing against a user being able to remember their username. On many sites there is a send me my username function linked to an email address.

  • If I know somebody's email address, I can make a good guess at their username, so point 4 isn't a significant issue, nor points 1, 2 and 3 which are really parts of point 4. Commented Aug 6, 2014 at 11:28
  • 7
    My bank sets my user ID. Those points very much depend in the user ID strategy.
    – Andy Boura
    Commented Aug 6, 2014 at 11:31
  • 3
    Even in scenarios where I can pick my own user ID, it never has anything in common with my e-mail address. Commented Aug 6, 2014 at 12:58
  • 3
    @Gilles: although you may choose an username close to your email, this will not be the case for every user. Also, giving the possibility for additional security can be good. If the user does not use it, the fault is (at least partly) on the user and the financial institution can just say that it was an user fault. Also it can allow the bank to prevent using the email as user id or perform additional checks or even generate the user id for the user as someone mentioned.
    – BlueTrin
    Commented Aug 6, 2014 at 14:28

I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via postal mail.

Since you don't need an email to use the account, it does not make sense to use email as username.

  • Yup. My log in information here is card/account number, plus a security code (get encrypted code from site, decrypt with PIN + card + small tool) that is single-use. No risk at weak user-generated account/pw. (though it creates a higher risk for a centralized attack, I suppose) Commented Aug 6, 2015 at 9:42

There are a lot of good things up here, but it misses one key point: you can't use an email address for a password reset, because it's not secure enough, and you don't use an email sign up. Those are the two key reasons why almost every online service has an email address associated. Without them, there's no reason not to use a username instead.

  • Sorry I wasn't clear. Assume there is a user address associated with the account. I'm specifically looking for reasons why you would use email or a username to log into an account on a system.
    – Chromarush
    Commented Aug 5, 2014 at 23:29
  • A username is preferable to a email address for many reasons; because it represents the person themself, rather than a way to send them a message because there's never a case in which it needs to be changed, which is preferable for technical reasons. There are other advantages too to the username; my point was that there are no advantages for the email left, and so a username makes sense. You asked "Why do most financial institutions use usernames instead of emails for login?", and I think this answers that question.
    – ctbeiser
    Commented Aug 5, 2014 at 23:55
  • 1
    I misread your answer. Thank you for the clarification.
    – Chromarush
    Commented Aug 6, 2014 at 19:33

My experience from local government, where money was involved, is that user-names provide another level of security beyond an email address.

It was the generally held opinion that someone could relate an email address to an individual but a user-name could be unique to that site.

It's a fairly arbitrary measure, but it's a measure.

  • Indeed, and people share email addresses. There is usually a need to positively identify the customer.
    – mckenzm
    Commented Jun 13, 2015 at 18:13

Email is less secure than online banking (I hope) so maybe the thinking is that since people tend to use the same passwords for everything, using email instead of username for bank login would create a vulnerability in the case of email passwords leaking, the thief could go around and try that email password combination a bunch of places, and probably successfully get into at least some of them. With a username, the thief will have to do more work to get all the information they need to get into the account. So it is not exactly an airtight security measure, but it is a little safer than letting customers use their email address.


As a developer creating an application for capital markets, I do not want to verify email addresses as valid by checking against any third party email providers even if they are good ones. I dont even allow anyone to sign up on their own. An admin signs them up, gives them a username. The login page itself is also an https. This is just because all banks, financial institutions have a very big list of security questionaire which they throw at you and by the time you are done answering Yes to all those, you have admin created usernames, https with SSL provided by a big trusted provider, password reset by admin, auditing every user action, chinese walls and so on and on and on....


For security reason, the financial institution are rarely accepted new technology or new methods since they won't take any risk by using unproven or uncommon things. Many e-banking site are running before the era login with email so popular today. The username/password methods are common in that era. They simply won't take any unnecessary risk. If username works and common why use email?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.