Online banking is safer than it was ten years ago, but the real risk is usually you, not the bank
Banks use encryption, multi-factor authentication, and fraud monitoring to protect your account. The technology works. What breaks it is a password you reuse across five websites, a text message you respond to from someone pretending to be your bank, or malware on your phone that watches you type. The bank's job is to build the vault. Your job is to not leave the door open.
The largest banks—Chase, Bank of America, Wells Fargo, and others—invest heavily in security because a breach costs them millions in liability, regulatory fines, and reputation damage. Smaller banks and credit unions often use the same security standards because they buy their technology from the same vendors. The difference between banks is usually not whether they are secure, but whether they tell you when something goes wrong and how fast they fix it.
Key Takeaways
- Banks encrypt your data in transit and at rest, and most use multi-factor authentication to verify your identity before letting you in.
- Your password, your phone, and your judgment are the weakest links—reusing passwords, ignoring suspicious emails, and clicking unknown links cause most account breaches.
- If someone steals money from your account, federal law limits your liability to $50 if you report it within two business days, and $500 if you report it within 60 days.
- Phishing emails that look like your bank are common; banks never ask for passwords or PINs by email or text, and you should always call the number on your bank card to verify.
- Public Wi-Fi is risky for banking because anyone on the network can intercept unencrypted traffic, so use your phone's data connection or a VPN instead.
What banks do to protect your money
When you log into your bank's website or app, the connection is encrypted using TLS (Transport Layer Security), the same technology that protects your email and shopping. This means the data traveling between your device and the bank's server is scrambled and unreadable to anyone listening on the network. The bank also encrypts your data while it sits in their database, so even if someone breaks into their servers, the information is not immediately useful.
Most banks now require multi-factor authentication, which means you need something you know (your password) and something you have (your phone, a security key, or a one-time code generator). This stops a thief who has stolen your password from logging in without also stealing your phone. Some banks send you a code by text or app each time you log in from a new device. Others use push notifications that ask you to approve or deny the login attempt on your phone.
Banks also run fraud detection systems that watch for unusual activity—a purchase in another country an hour after a purchase at home, a wire transfer to a new recipient, a login from an unfamiliar location. When the system spots something odd, it either blocks the transaction or asks you to verify it. This is why your card sometimes gets declined when you travel, and why you might get a call from your bank asking if you made a certain purchase.
How your password and phone are the real vulnerability
A strong password that you use only for your bank is the first line of defense. If you reuse the same password across your bank, your email, your social media, and a dozen other sites, then a breach at any one of those sites gives a thief the key to all of them. Password managers like Bitwarden, 1Password, or Dashlane generate and store unique passwords so you do not have to remember them.
Your phone is the second line of defense, and it is only as secure as you keep it. If your phone has malware, a thief can intercept the one-time codes your bank sends, read your text messages, or watch you type your password. Malware usually arrives through apps you download from outside the official app store, or through links in text messages and emails. Stick to the official Apple App Store or Google Play Store, and do not click links in unsolicited messages.
Phishing is the most common attack. A thief sends you an email or text that looks like it came from your bank, asking you to "verify your account" or "confirm your identity" by clicking a link and entering your password. The link takes you to a fake website that looks identical to your real bank's site. You enter your credentials, and the thief now has them. Banks never ask for your password, PIN, or full account number by email or text. If you get a message claiming to be from your bank, hang up and call the number on the back of your card to verify.
What happens if someone steals from your account
Federal law protects you under the Electronic Funds Transfer Act. If you report unauthorized transactions within two business days, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. If you wait longer than 60 days, you could lose everything that was taken, though most banks will still cover you if you can show you were not negligent.
Report fraud immediately by calling your bank's fraud line (the number is on your card or statement). Do not email or use the bank's website to report it, because you need a record of the call and confirmation of the report. Ask the bank to freeze your account, cancel your debit card, and issue a new one. Ask them to send you a written confirmation of the fraud report and the date you reported it.
If the theft involved a wire transfer or a check, the process is slower because money that has left your account is harder to recover. Wire transfers are nearly impossible to reverse once they clear. Checks can be stopped if you report them before they clear, but if they have already cleared, you may have to pursue the thief through small claims court or work with law enforcement.
Why public Wi-Fi is risky and what to do instead
Public Wi-Fi at a coffee shop, airport, or library is unencrypted by default. Anyone on the same network can use free tools to intercept the traffic traveling between your device and the websites you visit. If you log into your bank over unencrypted Wi-Fi, a thief on the same network can see your login credentials and session cookies (the tokens that keep you logged in).
The safest option is to use your phone's cellular data connection instead of Wi-Fi. Your phone's data is encrypted by your carrier, and it is not shared with other devices on a public network. If you must use public Wi-Fi, use a VPN (virtual private network) like Mullvad, ProtonVPN, or Windscribe to encrypt all your traffic before it leaves your device. A VPN creates a tunnel between your device and a server you trust, so the Wi-Fi network cannot see what you are doing.
Do not bank on public Wi-Fi without a VPN, and do not assume that Wi-Fi with a password is safe—the password only keeps strangers off the network, not from seeing your traffic once they are on it.
Differences between banks in how they handle breaches
All banks are required by law to notify you if your personal information is compromised in a breach. The notification must come within 30 days of discovery. What varies is how quickly the bank discovers the breach, how transparent they are about what was taken, and whether they offer free credit monitoring or identity theft protection.
Large banks like Chase and Bank of America usually offer free credit monitoring for one to three years after a breach. Smaller banks and credit unions may offer less, or may require you to pay for monitoring yourself. Check your bank's website or call their customer service line to ask what they offer if a breach occurs. Some banks also offer identity theft insurance that covers legal fees and lost wages if your identity is stolen.
If your bank has a breach, you have the right to place a fraud alert on your credit report for free. Contact Equifax, Experian, or TransUnion (any one of them will notify the others), and ask for a fraud alert. This tells creditors to verify your identity before opening new accounts in your name. You can also place a credit freeze, which is stronger but requires you to unfreeze your credit each time you want to open a new account.
What to do right now to secure your account
Change your banking password to something unique that you do not use anywhere else. If you cannot remember it, use a password manager. Enable multi-factor authentication in your bank's settings—most banks offer this in the security or account settings menu. Choose the option that sends codes to your phone or app rather than email, because email is easier to compromise.
Set up account alerts so your bank texts or emails you when certain transactions occur—a large purchase, a wire transfer, a login from a new device. These alerts give you a chance to catch fraud quickly. Review your account and statements at least once a week, and report anything you do not recognize immediately.
If your bank offers it, use a security key—a small physical device like a YubiKey that you plug into your computer or tap to your phone to prove your identity. Security keys are harder to steal than codes sent by text, and they cannot be intercepted by malware on your phone.
Frequently Asked Questions
Is it safe to bank on my phone?
Yes, if you use the official app from your bank and keep your phone updated with the latest security patches. Apps are sandboxed, which means malware on your phone cannot easily access the app's data. Use your phone's data connection rather than Wi-Fi, and do not jailbreak or root your phone, because that removes the security protections the operating system provides.
What if I see a login from a place I do not recognize?
Call your bank immediately and report it. Do not wait to see if anything is stolen. Ask the bank to change your password, cancel your cards, and review recent transactions. If the login was from a different country or a location you have never been, assume your credentials were compromised and treat it as a potential breach.
Can my bank see my passwords?
No. Banks store passwords using one-way encryption called hashing, which means even the bank's employees cannot read your password. When you log in, the bank hashes what you typed and compares it to the stored hash. If they match, you are in. If someone at the bank claims they need your password to help you, hang up and call the official number on your card.
Is it safer to keep my money in cash?
Cash in a bank account is insured by the FDIC up to $250,000 per account holder per bank. Cash in your home is not insured against theft, fire, or loss. Online banking is safer than keeping large amounts of cash at home, and the FDIC insurance protects you if the bank fails.
What should I do if I think my phone has malware?
Change your banking password from a different device (a computer you trust), then call your bank and report that your phone may be compromised. Ask the bank to review recent transactions and watch for fraud. Back up your important data, then wipe your phone and restore it from a backup made before you think the malware arrived. If you cannot do this yourself, take your phone to the manufacturer's support center or a trusted repair shop.