Online Banking Login Attempt Logs

This dataset provides comprehensive, timestamped logs of online banking login attempts, including user identifiers, authentication methods, device and location data, and the outcome of each attempt. It is designed for security monitoring, anomaly detection, and compliance auditing in financial technology environments, enabling deep analysis of user behavior and potential threats.

  • last updated 21 Jul 2025
  • by GoMask
The brief that made it

Real-time security monitoring and incident response

Sample rows

preview · 8 of 200 rows · all 16 columns
log_idstringlogin_channelstringsuccessbooleanfailure_reasonstringuser_idstringusernamestringlogin_timestampdatetimeip_addressstringdevice_idstringgeo_countrystringgeo_regionstringgeo_citystringmfa_usedbooleanmfa_methodstringaccount_lockedbooleanuser_agentstring
LOG00001webtrueblankU10001jdoe2024-01-04T08:00:00Z192.168.1.101DEV201USCaliforniaSan Josetrueauthenticator_appfalseMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/121.0.0.0
LOG00002webfalseinvalid_passwordU10002chloe.l2024-01-05T09:15:00Z203.0.113.12DEV202USNew YorkBrooklynfalseblankfalseMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15
LOG00003apifalseinvalid_usernameU10003x-guest2023-12-31T00:00:00Z127.0.0.1blankblankblankblankfalseblankfalsecurl/7.68.0
LOG00004webtrueblankU10004lucasb2024-02-02T13:25:00Z181.213.42.11DEV203BRSão PauloCampinasfalseblankfalseMozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0
LOG00005mobile_appfalseaccount_lockedU10005tchou2024-02-05T07:00:00Z2001:0db8:85a3:0000:0000:8a2e:0370:7334DEV204FRÎle-de-FranceParistruesmstrueMozilla/5.0 (Linux; Android 11; SM-G991B) Chrome/90.0.0.0 Mobile
LOG00006webtrueblankU10001jdoe2024-02-07T16:00:00Z198.51.100.87DEV201USCaliforniaSan JosetruebiometricfalseMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/121.0.0.0
LOG00007mobile_appfalsemulti_factor_failedU10006koukik2024-02-10T05:30:00Z203.0.113.33DEV205JPTokyoShinjukutrueauthenticator_appfalseMozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148
LOG00008mobile_appfalsesession_timeoutU10007mike_882024-03-02T12:00:00Z203.0.113.45DEV206GBEnglandLondonfalseblankfalseMozilla/5.0 (Linux; Android 13; Pixel 6) Chrome/114.0.0.0 Mobile

What the 200 rows show

from the 200-row sample
  • 52%success = true
  • 5mfa methods
  • 22geo countries
login_channel200 rows by value
060120115web57%51mobile_a…26%23api12%11other6%
failure_reason97 rows with a value · 103 left blank
  1. invalid_password21
  2. other18
  3. account_locked16
  4. invalid_username12
  5. multi_factor_failed12
  6. session_timeout9
  7. account_disabled9
16 columns by typefrom the column list below
  • string 12
  • datetime 1
  • boolean 3

Columns

16 columns in three groups
blueprint · 16 columns
columntypedescriptionexample
Text 12 columns
log_idstringUnique identifier for each login attempt log entryuniqueLOG00001
user_idstringUnique identifier for the user attempting to log inU10001
usernamestringUsername provided during the login attemptjdoe
failure_reasonstringReason for login failure if unsuccessful (e.g., invalid_password, account_locked, etc.)7 values · optionalinvalid_password
ip_addressstringIP address from which the login attempt was made (IPv4 or IPv6)192.168.1.101
user_agentstringBrowser or device user agent string used during the login attemptcurl/7.68.0
device_idstringUnique identifier for the device used in the login attempt, if availableoptionalDEV201
geo_countrystringCountry determined from the IP address at the time of loginoptionalUS
geo_regionstringRegion or state determined from the IP address at the time of loginoptionalCalifornia
geo_citystringCity determined from the IP address at the time of loginoptionalSan Jose
mfa_methodstringType of multi-factor authentication used (e.g., sms, email, authenticator_app, biometric)6 values · optionalauthenticator_app
login_channelstringChannel used for login (e.g., web, mobile_app, api)web · mobile_app · api · otherweb
Dates and times 1 column
login_timestampdatetimeDate and time when the login attempt occurred (UTC)2024-01-04T08:00:00Z
True or false 3 columns
successbooleanIndicates whether the login attempt was successfultrue
mfa_usedbooleanIndicates whether multi-factor authentication was used during the login attempttrue
account_lockedbooleanIndicates if the account was locked as a result of this login attemptfalse

Use it for

  • success52%103 of 200 rowsrows by login channel115web51mobi…23api11other

    A finance dashboard

    The success rate, success by login_channel and a breakdown of failure_reason. Excel, Power BI or Tableau.

  • Why do 103 of 200 rows have success = true?

    A class exercise

    Hand out the rows and one question. Everyone works from the same 200 rows.

  • A software demo

    Believable logs with user_id, username and login_timestamp to fill a screen in front of a buyer.

Not quite right?

Make it yours.

Same 16 columns, your size and your rules. See 20 rows before you pay.

Preview 20 rows free

1,000 rows: $1.99 · 10,000: $12.99One-time. No subscription. All prices

This dataset200 rows16 columns
Yours1,000 rows16 columnsip_address: UK only

blueprint · online-banking-login-attempt-logs

Behind this dataset

Same schema. As many rows as you need.

These 200 rows came out of a blueprint — 16 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with
  • User ID anonymized per attempt.
  • Timestamp, channel, and outcome recorded.
  • Failed attempts and lockouts flagged.
  • Device and IP logged.
Rows
Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports
CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence
yours to use, including commercially
API slug
online-banking-login-attempt-logs

What should your data show?

Preview 20 rows free
No signup. No card.