Why Does My Bank App Hate VPNs? The Transfer Worked When I Stopped Changing Servers

The bank app rejected my transfer with eleven minutes left before the courier’s collection window closed.

I was standing behind an exhibition hall in Birmingham, trying to pay an emergency £3,800 freight invoice. Our display equipment had been loaded onto the wrong vehicle, and the courier would release it only after receiving the full amount.

The transfer details were correct. Face ID worked. The bank sent a verification code and accepted it.

Then the app displayed:

We can’t complete this request right now.

I blamed the conference Wi-Fi.

I closed the app, rejoined the network and tried again. The same message appeared before the confirmation screen.

That was when I noticed my VPN was connected to Manchester. I switched to London, reopened the bank and started over.

The login worked.

The transfer did not.

By the third attempt, I had appeared to move between several British cities without leaving the loading bay.

The bank app did not hate encryption. It hated the story my connection was telling.

The VPN was protecting the wrong part of the problem

The major provider I was using had years of public history, mature apps and a server list large enough to make almost any connection problem look solvable.

That was why I trusted it.

It was also why I kept changing servers.

Each location gave me a fresh connection inside the VPN app. To the bank, however, every switch meant a new IP address, another login and a different version of where I appeared to be.

Banks use the device, network and IP address as part of their fraud checks. Financial regulators describe blocking access from devices, networks or IP addresses associated with suspicious activity. Banks’ privacy notices also confirm that they collect IP and device information for identity verification and fraud prevention.

A shared VPN address complicates that process. Thousands of unrelated customers may pass through the same exit address. Some may have already generated failed logins, automated requests or fraud alerts.

The bank did not need to dislike VPN users.

It only needed to distrust the address they were sharing.

More people are reaching the same conflict

VPNs are no longer tools used only by remote workers and security specialists.

After UK age-assurance requirements came into force in July 2025, daily VPN use rose sharply. Many people who installed one for privacy or access now leave it connected while shopping, travelling and opening financial apps.

Eventually, an ordinary VPN session reaches a bank.

That is where the apparent contradiction begins.

A VPN protects traffic on public Wi-Fi and hides the device’s original IP address. At the same time, the bank may reject the shared address where that protected traffic returns to the internet.

Both things were happening in Birmingham.

The tunnel was protecting me from the venue network. The exit address was making the banking session look less trustworthy.

I had treated VPN connected as proof that the bank should accept the session.

It proved only that I had reached the VPN server.

The server list became a reset button

I tried another location.

The banking app asked me to verify the device again. I entered the code, approved the Face ID prompt and returned to the transfer.

This time the beneficiary page loaded, but the final button remained grey.

I switched servers again.

The app logged me out.

That changed my judgment. The provider’s large network was not giving me more chances to succeed. It was encouraging me to keep changing the evidence the bank was trying to evaluate.

Travellers describe the same frustration in public discussions: the VPN reports a successful connection, but the banking service still refuses to open or complete the transaction.

The lesson was brief but useful.

Connected and accepted were two different results.

The bank wanted a recognizable customer completing one continuous action. I was presenting the same phone through a sequence of shared addresses and restarting the session every time one failed.

The larger server list had become a reset button.

Turning the VPN off exposed the second problem

With seven minutes remaining, I disconnected the VPN.

The bank opened immediately.

For a moment, that seemed to settle the question. The app did not object to my phone, account or beneficiary. It objected to the routes I had been using.

Then the conference Wi-Fi weakened.

The loading bay sat behind several concrete walls, far from the main hall. The beneficiary page loaded, but the confirmation request timed out.

I switched to mobile data.

The phone found 5G near the loading doors, lost it when I stepped back inside and returned to the venue Wi-Fi. The bank sent another verification code, then abandoned the session during the network change.

The courier called.

“I need confirmation in five minutes,” he said.

Turning off the VPN had removed the rejected exit address. It had also left the banking session at the mercy of an unstable public connection.

That was the point where the problem changed.

I no longer needed the greatest number of server choices. I needed one route the bank would accept and the phone could keep.

The smaller app gave me one decision

I had OnlydogVPN installed as a backup from earlier testing.

The service has a shorter public history and fewer independent reviews than the largest providers. In the loading bay, however, its simpler design removed the decision that had been making the problem worse.

I selected the preset for unstable public Wi-Fi.

There was no country list inviting another guess and no conventional email-and-password registration delaying the connection.

Then I opened the bank.

Face ID completed.

The beneficiary appeared.

The bank asked for one verification code, accepted it and displayed the transfer summary.

I checked the account number once more and pressed Confirm.

At that moment, the conference Wi-Fi vanished.

The phone moved onto 5G.

The payment screen paused, but it did not return to the login page. A few seconds later, the status changed to Transfer complete.

I sent the receipt to the courier.

He released the equipment with two minutes remaining.

The bank had accepted one route, one device and one uninterrupted session.

That was enough.

The result came before the explanation

Only after the equipment was moving did I look at why the connection had survived.

The smaller app uses an HTTP/3-based transport over QUIC, designed to keep a session alive when a phone moves between Wi-Fi and mobile data.

That explained why the payment screen paused instead of collapsing.

The design of the app mattered just as much. It had stopped me cycling through locations. I chose the situation once, connected and left the route alone.

I could not observe the bank’s internal risk rules, so I could not know why it accepted that exit address and rejected the earlier ones. The visible difference was clear: the accepted route stayed stable, while every server change on the first VPN created another banking session.

The bank did not need a cleverer disguise.

It needed consistency.

What the banking app was rejecting

A bank does not see only a password and transfer amount.

It also sees the surrounding session.

A crowded VPN exit address may already carry a poor reputation. A sudden IP change can resemble an account takeover. A sequence of logins from different locations can look like automated access. A network change during a transfer can interrupt the checks connecting the customer, device and payment.

None of that means VPN protection is the problem.

The problem is a connection that keeps changing while the bank is trying to decide whether the customer should be trusted.

That is why rapidly switching servers often makes the situation worse.

Every new server introduces another IP address, another location estimate and another session. The user thinks they are testing alternatives. The bank sees someone repeatedly arriving through a different door.

That was exactly what I had done.

The app had not rejected the invoice or the beneficiary. It had rejected the unstable chain of sessions surrounding them.

Why more server choices did not help

The major provider’s breadth was real.

Its server list would have been useful if I needed a particular country, wanted to avoid a congested route or had time to test several connections before opening the bank.

I needed none of those things.

I was already in the correct country. The bank recognized the device. The beneficiary was legitimate. The urgent task was to preserve one approved session long enough to complete the transfer.

Under that standard, more choices created more opportunities to restart.

The smaller service approached the problem differently. It asked what kind of network I was using, established a route and kept it through the switch from venue Wi-Fi to 5G.

The difference appeared in the outcome.

One setup produced repeated logins, verification codes and failed transfers.

The other produced a receipt.

The comparison that mattered

Banks do not hate every VPN connection.

They reject sessions that look risky.

A crowded exit address, a sudden location change or a banking session that jumps between several IPs can create that risk even when the customer is genuine.

The established provider gave me a large map and encouraged me to keep searching for a server the bank might prefer.

OnlydogVPN gave me one stable route through the network I actually had. The bank opened, the transfer survived the loss of Wi-Fi and the courier received payment before leaving.

Behind that exhibition hall, the useful VPN was not the one that let me appear in the most places.

It was the one that let the same customer finish the same transfer without disappearing halfway through it.