N&P, which suffered heavy criticism in the wake of the Keydata scandal earlier this year and paid out £57m in compensation, was given just 35% for online banking security by Which?
Halifax and Santander were also highlighted as having particularly unsecure banking portals, scoring just 38% and 44% respectively.
Nationwide, Natwest/RBS and Barclays all scored well on the security test, scoring 69%, 63% and 62%.
The 12 banks sampled were tested on their logout security, ability to browse to another site, the ease with which users can change passwords, and how secure the process is to set up a new payee.
Which? also tested the security credentials of each bank when users attempt to change their address, replay the login process, use tokens (such as card readers) for login and make use of Rapport software.
