Security
A password to sign in. A passcode for money.
The password gets you into the site. The passcode authorizes money. They are stored separately, and neither one is shown to a banker. Alerts, a freeze, and a locked card are the tools you use when something looks wrong. This page describes those controls. It is not a promise that fraud cannot occur.
Passcode
Digits only, set after you enroll. Transfers, wires, and other sensitive actions ask for it again. The length comes from the security settings. An administrator can replace a passcode. They cannot read the current one, because it is stored hashed.
Security question
A question and an answer, also stored hashed, used when you recover a passcode. The answer is not displayed on your profile and it is not something to put in a contact form or a support ticket.
Alerts
Sign-in, a large debit, a new device. You choose what is mailed. The published default channel is email, and an alert amount cannot be set above $100,000. An alert is a notice. It does not, by itself, reverse a transaction that has already posted.