The core protections that come built in

Your savings account has three layers of protection that start the moment you open it: FDIC insurance covers deposits up to $250,000 per account owner per bank, bank security systems monitor for fraudulent transactions, and federal law limits your liability for unauthorized transfers. None of these require you to do anything — they are automatic. But they only work if you know what they cover and what they do not.

FDIC insurance protects you if the bank fails. It does not protect you if someone steals your money while the bank is still operating. Bank security systems catch some fraud, but not all — especially if you gave someone your password or PIN. Federal law caps your liability at $50 for unauthorized debit card charges if you report them within two business days, but that cap only applies to certain types of fraud. The rest depends on what you do.

Key Takeaways

  • FDIC insurance covers up to $250,000 per account owner per bank if the bank fails, but does not protect against theft or fraud while the bank is operating.
  • Your liability for unauthorized debit card charges is capped at $50 if you report them within two business days of discovering the fraud.
  • A strong password, two-factor authentication, and regular account monitoring catch most fraud before it becomes a large loss.
  • If you hold more than $250,000, you can split deposits across multiple banks or use joint accounts to stay fully insured.
  • Phishing emails and public Wi-Fi are the two most common ways fraudsters gain access to savings accounts.

Setting up passwords and two-factor authentication

A strong password is the first line of defense. Use at least 12 characters mixing uppercase, lowercase, numbers, and symbols — something like BlueMoon$42Jazz rather than Password123. Do not use your name, birthdate, or anything someone could guess from your social media. Do not reuse the same password across multiple banks or other websites. If one site gets hacked, a reused password gives a fraudster access to all your accounts.

Two-factor authentication (often called 2FA) requires a second proof of identity beyond your password — usually a code sent to your phone or generated by an authenticator app. Most banks offer this as an option in account settings. Turn it on. It adds a few seconds to login but stops most account takeovers even if someone has your password. Use an authenticator app like Google Authenticator or Authy rather than text messages when your bank offers both — text messages can be intercepted, but app-based codes cannot.

Monitoring your account for unauthorized activity

Check your account at least weekly, ideally more often. Log in directly to your bank's website or app — do not click links in emails, even if they look official. Look for transactions you do not recognize, changes to your contact information, or new accounts linked to your profile. Most fraudsters move money quickly, so catching unauthorized transfers within days rather than weeks makes a huge difference in recovery.

Set up account alerts if your bank offers them. You can usually configure notifications for transactions over a certain amount, transfers out of the account, login attempts from new devices, or changes to your password or contact details. These alerts arrive by text or email and let you spot fraud in real time. If you see something suspicious, contact your bank immediately by phone using the number on your bank card or statement — not a number from an email or search result.

What to do if you spot fraud

Call your bank as soon as you notice an unauthorized transaction. Have your account number and a description of the fraudulent transaction ready. Your bank will ask you to confirm that you did not make the transfer and will likely freeze your account while they investigate. Do not move money out of the account or close it — that can complicate the investigation.

Follow up with a written dispute. Most banks require you to submit a formal dispute in writing within a certain timeframe — often 30 to 60 days from when you first reported it. Your bank will send you a form or let you submit the dispute through your online account. Keep copies of everything: the dispute form, emails, transaction records, and notes about when you called. The bank has up to 10 business days to acknowledge your dispute and up to 45 days to investigate and resolve it, though many resolve faster.

Protecting yourself from phishing and social engineering

Phishing emails pretend to be from your bank and ask you to "verify your account" or "confirm your information" by clicking a link. They look convincing but the link goes to a fake website that captures your login details. Your bank will never ask for your password, PIN, or full account number by email. If an email asks for this information, it is phishing — delete it and report it to your bank.

Social engineering is when someone calls pretending to be from your bank and asks you to confirm details or transfer money. Legitimate bank employees will not call you asking for your password or PIN. If someone calls claiming to be from your bank, hang up, wait five minutes, and call your bank directly using the number on your card. This confirms you are actually talking to your bank, not a fraudster.

Keeping your devices and internet connection secure

Do not access your savings account on public Wi-Fi — coffee shops, airports, and libraries. Public networks are easy for fraudsters to monitor. Use your phone's cellular data or a home Wi-Fi network protected by a strong password instead. If you must use public Wi-Fi, use a VPN (virtual private network) app, which encrypts your connection and hides your activity.

Keep your phone and computer updated. Banks and security companies release updates that patch vulnerabilities fraudsters exploit. Turn on automatic updates in your device settings. Use antivirus software on your computer and keep it current. Do not download files or apps from untrusted sources — stick to your device's official app store. If your phone or computer is lost or stolen, contact your bank immediately and ask them to freeze your account until you can change your password from a secure device.

Insuring deposits over $250,000

If you have more than $250,000 in savings, FDIC insurance covers only the first $250,000 at each bank. The rest is uninsured if the bank fails. You have several options to protect the full amount. Open accounts at different banks — each bank's FDIC coverage is separate, so $250,000 at Bank A and $250,000 at Bank B are both fully insured. Open a joint account with another person — joint accounts are insured separately, so a joint account with your spouse is covered up to $250,000 in addition to your individual account at the same bank.

Some banks offer sweep accounts or money market accounts that automatically move funds between accounts to stay within FDIC limits. Ask your bank whether this option is available. Keep records of which accounts you hold at which banks and the balance in each one. If a bank fails, the FDIC uses these records to determine your coverage. You can check your coverage using the FDIC's online calculator at fdic.gov.

Frequently Asked Questions

What happens if my bank fails?

The FDIC steps in and pays depositors up to $250,000 per account owner per bank. You do not lose money — the FDIC transfers your insured balance to another bank or sends you a check. This process usually takes a few days. Amounts over $250,000 are not covered by FDIC insurance.

Can I get my money back if someone hacks my account and transfers it out?

Yes, but the timeline depends on how quickly you report it. If you report unauthorized debit card charges within two business days, your liability is capped at $50. If you report after two business days but within 60 days, your liability can be up to $500. After 60 days, you may not recover anything. Report fraud immediately.

Is my savings account protected if I use online banking?

Yes. FDIC insurance and fraud protections apply whether you bank online or in person. Online banking is generally secure if you use a strong password, two-factor authentication, and avoid phishing emails. The main risk is user error — giving out your password or clicking a fraudulent link.

Do I need to pay for fraud protection or monitoring services?

No. FDIC insurance and basic fraud protections are free and automatic. Some banks offer paid monitoring services that watch your credit report or alert you to suspicious activity, but these are optional. Your bank's free alerts and regular account monitoring are usually sufficient.

What should I do if I lose my debit card?

Call your bank immediately and ask them to cancel the card. Most banks can do this over the phone and will send a replacement card within a few business days. Your liability for fraudulent charges made after you report the card lost is zero — the bank covers it. Do not wait to report a lost card.