The core protections that come built in
Your savings account has three layers of protection that work whether you do anything or not. The first is FDIC insurance, which covers up to $250,000 per depositor per bank if the bank fails. The second is the bank's own fraud liability rules — most banks limit your loss to $50 if you report unauthorized transactions within 60 days of your statement. The third is the legal requirement that banks use reasonable security measures, which means encryption, secure servers, and staff training.
These protections exist because federal law requires them. They are not optional features you turn on. But they only work if you do your part: watch your account, report problems fast, and use the security tools your bank provides.
Key Takeaways
- FDIC insurance protects up to $250,000 per account at each bank, but only if the bank itself fails — not if someone steals from you.
- Your liability for unauthorized transactions is capped at $50 if you report within 60 days, but $500 if you wait longer, and unlimited if you never report.
- Enabling two-factor authentication on your online account stops most theft because thieves cannot log in without your phone or authenticator app.
- Checking your account weekly and setting up transaction alerts catches fraud early, when your bank can still reverse the charges.
- Using a strong, unique password and never sharing your PIN or online login details prevents the most common entry point for account takeover.
What FDIC insurance actually covers and does not cover
FDIC insurance protects your money if the bank goes under and cannot pay depositors back. It does not protect you if someone steals from your account. The coverage limit is $250,000 per depositor per bank — meaning if you have $300,000 at one bank, only $250,000 is insured. If you have $150,000 at Bank A and $150,000 at Bank B, both are fully covered because they are separate banks.
Joint accounts are treated differently. If you and another person own a joint savings account, each of you gets $250,000 of coverage, so the account itself can hold up to $500,000 and be fully insured. Retirement accounts (IRAs, SEP-IRAs) get their own $250,000 limit separate from your regular savings account at the same bank.
If you have more than $250,000 to keep safe, spread it across multiple banks. You can open accounts at different institutions online in a few minutes, and each one will have its own FDIC protection. This is a common strategy for people with large savings — it costs nothing and takes minimal effort.
How to stop unauthorized access to your account
The fastest way to prevent theft is two-factor authentication (often called 2FA or two-step verification). This means that even if someone has your password, they cannot log in without a second piece of information — usually a code sent to your phone or generated by an authenticator app. Most banks offer this for free and can turn it on in your online settings.
Your password itself matters more than most people think. Use at least 12 characters, mix uppercase and lowercase letters with numbers and symbols, and never reuse the same password across multiple sites. If you use the same password for your bank and for a shopping site, and the shopping site gets hacked, thieves can try that password on your bank account. A password manager (like Bitwarden, 1Password, or Dashlane) stores strong passwords securely so you only have to remember one master password.
Never share your PIN, password, or online login details with anyone — not your spouse, not your accountant, not someone claiming to be from the bank. Real banks never ask for your password by email, phone, or text. If someone contacts you claiming to be from your bank and asking for account details, hang up and call the bank's official number from your statement or their website.
Phishing emails and texts are designed to look like they come from your bank but actually lead to fake login pages that steal your credentials. Do not click links in emails or texts claiming to be from your bank. Instead, go directly to the bank's website by typing the address into your browser, or call the number on your debit card.
Setting up alerts and monitoring your account weekly
Most banks let you set up transaction alerts for free. You can choose to be notified by email or text when your balance drops below a certain amount, when a withdrawal over a certain size happens, or when any transaction occurs. These alerts catch fraud quickly — often within minutes of the theft.
Check your account at least once a week, even if you have alerts turned on. Look at the transaction list and make sure every charge is one you recognize. If you see something unfamiliar, contact your bank immediately. The faster you report, the better your protection: if you report within 60 days, your liability is capped at $50; if you wait 60 to 120 days, it can be up to $500; if you wait longer than 120 days, you may lose the money entirely.
Keep your statements (or screenshots of your online transactions) for at least three months. If a fraudulent charge appears, you will need proof of what you reported and when. Most banks keep digital records, but having your own copies protects you if there is a dispute.
What to do if you spot unauthorized transactions
Contact your bank immediately by phone using the number on your debit card or statement — not a number from an email or text. Tell them which transactions are not yours and ask them to freeze your account temporarily while they investigate. Most banks will reverse fraudulent charges within one to three business days while they look into it.
Ask your bank to issue you a new debit card with a new number. The old card is compromised and should not be used again. The new card usually arrives within five to ten business days, though many banks can issue a temporary card number you can use online right away.
If the fraud involved your online login (meaning someone logged into your account without your permission), change your password immediately from a different device — ideally a computer or phone that was not used to access the account before. If you used the same password anywhere else, change it on those sites too.
Report the fraud to the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help if the thief tries to open accounts in your name. You can also place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) by contacting any one of them — they will notify the others.
Protecting yourself from account takeover and identity theft
Account takeover happens when someone gains access to your online banking login and drains your account. The most common entry point is a password that was leaked in a data breach at another company. You can check whether your email address has appeared in a known breach by visiting Have I Been Pwned (haveibeenpwned.com), a free tool that searches public breach databases.
If your email has been in a breach, change your password on that site immediately and on any other site where you used the same password. Then change your bank password even if your bank was not the one breached — because thieves often try passwords from one breach on other sites.
Identity theft (where someone uses your personal information to open new accounts in your name) is different from account takeover but often happens together. You can place a credit freeze with each of the three credit bureaus for free. A freeze prevents anyone from opening new accounts in your name without your permission. It does not affect your existing accounts or your ability to use credit — it just stops new accounts from being created. You can lift the freeze temporarily when you actually want to open a new account, then put it back in place.
Keeping your devices and internet connection secure
Use a strong Wi-Fi password on your home network and change it from the default that came with your router. If your Wi-Fi is weak or old, consider upgrading — a modern router with WPA3 encryption is harder to break into than older models.
Never access your bank account on public Wi-Fi (at a coffee shop, airport, or library) without a VPN. Public Wi-Fi is unencrypted, which means someone on the same network can see your login details. A VPN (virtual private network) encrypts your connection so your activity is hidden. Many VPN services cost $5 to $15 per month, though some banks and credit card companies offer free VPN access to their customers.
Keep your phone and computer updated with the latest security patches. These updates fix vulnerabilities that thieves exploit. Turn on automatic updates in your device settings so you do not have to remember to do it manually.
Be cautious about what you download and install. Malware (malicious software) can steal your login details or monitor your keystrokes. Only download apps from official sources — the Apple App Store for iPhones, Google Play for Android phones, and the official websites of software companies for computers.
Frequently Asked Questions
What happens if my bank account is hacked and emptied?
Contact your bank immediately by phone. They will freeze the account, reverse the fraudulent transactions (usually within one to three business days), and issue you a new debit card. Your liability is capped at $50 if you report within 60 days. FDIC insurance does not cover theft, but the bank's fraud liability rules do.
Does FDIC insurance protect me if someone steals my debit card?
No. FDIC insurance only covers bank failure. Theft is covered by your bank's fraud liability policy, which caps your loss at $50 if you report within 60 days. Report the theft to your bank as soon as you notice it.
Can I get my money back if I fall for a phishing email and give out my password?
Yes, if you report it quickly. Contact your bank immediately and tell them your account was compromised. They will reverse fraudulent charges and issue a new card. Your liability is capped at $50 if you report within 60 days. The faster you act, the better your protection.
Is it safe to use my phone's fingerprint or face recognition to log into my bank app?
Yes. Biometric authentication (fingerprint or face recognition) is actually more secure than a password because it cannot be guessed or stolen remotely. Use it if your bank offers it.
Should I keep large amounts of cash at home instead of in a bank account?
No. Cash at home has no insurance or protection if it is lost, stolen, or destroyed in a fire. A bank account with FDIC insurance protects up to $250,000 per bank. If you have more than that, spread it across multiple banks — each account gets its own $250,000 of coverage.