Three sign-in reference tracks
Consumer sign-in, business dual-control, and the recovery path sit in three sections below. Each section targets a different starting condition — pick the one that matches where you are right now.
Sign-In Readout
- The sign-in page accepts consumer and business credentials on the same entry screen — account type is detected from the username prefix.
- Two-step verification activates on unrecognised devices and after a password reset; existing trusted devices skip the extra prompt.
- Session timeouts are 15 minutes idle (consumer) and 10 minutes idle (business); any in-portal click resets the timer.
- Mobile sign-in supports biometric unlock after the first password-based Exchange Bank login — enable it inside the app under Security & Devices.
Consumer sign-in
Consumer Exchange Bank login — step by step
The consumer sign-in page lives at the member-portal URL and accepts one set of credentials for checking, savings, and credit-card accounts held in an individual name.
Opening the Exchange Bank login starts with typing the portal address directly into the browser address bar — not clicking a search result, not following an email link you were not expecting. Once the page loads, confirm the padlock icon appears beside the URL before touching the username field. That padlock confirms TLS is active and the page has not been intercepted. The sign-in screen will never ask for Social Security digits, date of birth, or full card numbers — those appear only inside secure account-detail screens after a successful sign-in.
At the sign-in screen, enter the username you chose at account opening. Usernames are case-insensitive, so capitalisation does not matter. Type the current password in the second field — passwords are case-sensitive. Click the primary sign-in button. On a device the portal already recognises, you land on the account dashboard within a few seconds. On a new device, the portal pauses and sends a one-time code to the phone number or email address the member registered at the branch.
After a successful Exchange Bank login, the dashboard shows checking balances, recent transactions, and quick links to bill pay, transfer, and statements. The session stays active for 15 minutes of idle time; any click inside the portal extends it. When the session ends, a short banner notifies you before the sign-in screen reappears.
Business sign-in
Business Exchange Bank login — dual-control sessions
Business credentials use a company-prefix username format and enforce dual-control approvals for wire transfers and large ACH batches — separate from the consumer sign-in flow.
A business sign-in differs from a consumer sign-in in three concrete ways. First, the username format includes a four-character company code as a prefix, assigned when the business account was opened. Second, session timeouts shorten to 10 minutes of idle time because business sessions typically carry higher transaction authority. Third, any outgoing wire or ACH batch above the single-transaction limit requires a secondary approver to complete a separate confirmation — the initiator cannot approve their own payment.
Setting up dual-control requires the business account administrator to designate at least one secondary approver inside the portal's administrative console. That approver receives an email notification each time a payment enters the pending-approval queue. The approver then completes their own sign-in, reviews the payment details, and either confirms or rejects the transaction. Both actions are logged with a timestamp and the approving user's identity.
Businesses with multiple signatories can assign up to five approver roles per account. Each approver holds an independent credential — shared credentials are prohibited under the business-account agreement and create an audit gap. If an approver leaves the organisation, the administrator revokes that credential through the user-management panel without closing the account.
Reset and two-step
Exchange Bank login reset and two-step verification
The password reset flow sends a time-limited token to the member's registered contact; two-step verification codes arrive separately and expire after five minutes.
Two-step verification on the Exchange Bank login
Two-step verification activates whenever the portal detects an unrecognised device, browser, or network. The portal sends a six-digit code to the phone number on file via SMS, or to the registered email address if SMS is unavailable. Enter the code within five minutes — after that, the flow cancels the code and you must request a fresh one. After completing a successful two-step Exchange Bank login, the device can be marked trusted for 30 days, which suppresses the code prompt on that specific browser until the trust period expires or the member clears browser data.
Session timeout behaviour
The portal enforces idle timeouts rather than absolute session limits. Consumer sessions time out after 15 minutes with no portal activity; the counter resets on any click, scroll, or form submission. A two-minute warning banner appears before the sign-in screen reloads. Business sessions follow the same pattern with a 10-minute idle window. Members who need to step away mid-session should use the explicit sign-out button rather than relying on the timeout, because sign-out immediately clears session tokens rather than leaving them active until the idle clock fires.
Mobile sign-in and biometric authentication
The mobile banking app supports the same sign-in credentials as the desktop portal. After the first successful password-based sign-in inside the app, the member is offered biometric authentication — fingerprint or face recognition depending on the device. Biometric sign-in does not bypass two-step verification on a newly enrolled device; the code prompt still fires once, and biometric unlock becomes available from the second session forward. If biometric data is cleared from the device, the app falls back to password authentication until biometrics are re-enrolled.
Step-by-step sign-in table
Use this table to confirm each stage of the Exchange Bank login flow. The "What to confirm" column tells you what a successful step looks like before moving to the next one.
| Step | What to do | What to confirm |
|---|---|---|
| 1 | Type the member-portal URL directly into the browser address bar. | Padlock icon appears; URL matches the known member-portal address. |
| 2 | Enter your username in the first field on the Exchange Bank login screen. | Field accepts the username without an error banner. |
| 3 | Type your current password in the password field. | Password characters are masked; caps-lock warning appears if active. |
| 4 | Click the primary sign-in button. | Page advances — either to the account dashboard or to the two-step prompt. |
| 5 (if prompted) | Enter the six-digit two-step code sent to your registered contact. | Code accepted; device-trust option appears if you want to skip the prompt next time. |
| 6 | Verify the account dashboard loads after sign-in completes. | Correct account name and balance figures appear; no error banners visible. |
| 7 (end of session) | Click the explicit sign-out link in the portal header. | Confirmation screen appears; session tokens are cleared immediately. |