Marcus accounts are covered by FDIC insurance up to $250,000 per depositor, and the platform uses encryption and multi-factor authentication to protect your login
Marcus is owned by Goldman Sachs, a bank regulated by the Federal Reserve and the Office of the Comptroller of the Currency. Your deposits are insured by the Federal Deposit Insurance Corporation (FDIC) for up to $250,000 per account holder, per bank, per ownership category. This means if Marcus fails, the FDIC will reimburse you for the full balance up to that limit.
The platform itself uses 256-bit encryption (the same standard used by banks and government agencies) to protect data in transit. Marcus requires a password and offers optional two-factor authentication via text message or an authenticator app. You control whether to enable it, but turning it on adds a second layer of security to your login.
Like any online bank, Marcus has no physical branches. You manage your account entirely through their website or mobile app. This means there is no teller to hand cash to, but it also means there is no in-person identity theft risk at a branch location.
Key Takeaways
- Your Marcus savings deposits are FDIC-insured up to $250,000, which protects your money if the bank fails.
- Marcus uses 256-bit encryption for data protection and offers optional two-factor authentication to secure your login.
- Marcus is regulated by the Federal Reserve and the Office of the Comptroller of the Currency, the same regulators that oversee traditional banks.
- You should enable two-factor authentication and use a unique, strong password to reduce the risk of unauthorized access to your account.
How FDIC insurance protects your money
The FDIC is a federal agency that insures deposits at member banks. When you open a savings account at Marcus, your deposits are automatically covered. The coverage limit is $250,000 per depositor, per bank, per ownership category. This means if you have $200,000 in a Marcus savings account in your name alone, all of it is protected. If you have a joint account with someone else, that account gets its own $250,000 of coverage.
FDIC insurance does not protect you from your own mistakes—like sending money to a scammer or giving someone your password. It protects you only if the bank itself fails and cannot return your money. In the history of FDIC insurance (since 1933), no depositor has lost a single dollar of FDIC-insured funds.
If you have more than $250,000 to deposit, you can open multiple accounts in different ownership categories (for example, one in your name alone and one as a joint account with a spouse) to increase your total coverage. The FDIC website has a calculator that shows you exactly how much of your money is covered under different account structures.
What encryption and authentication actually do
Encryption scrambles your data so that only you and Marcus can read it. When you log in or transfer money, the information travels through the internet in encrypted form. Even if someone intercepts the data, they cannot read it without the encryption key. Marcus uses 256-bit encryption, which is strong enough that it would take longer to crack than the age of the universe using current technology.
Two-factor authentication (also called 2FA) adds a second step to logging in. After you enter your password, Marcus sends a code to your phone via text message or an authenticator app. You enter that code before you can access your account. This means someone who steals your password still cannot log in without also having your phone. You turn 2FA on in your account settings; it is not automatic, so you have to choose to use it.
Neither encryption nor 2FA protects you if you voluntarily give someone your password or if you click a link in a fake email and enter your login details on a fraudulent website. Those are social engineering attacks, and they work because the attacker has your real credentials. The best defense is to never share your password, to check the URL before entering login details, and to be skeptical of unexpected emails asking you to verify your account.
Fraud and unauthorized transactions: what happens if someone accesses your account
If you notice unauthorized transactions in your Marcus account, contact Marcus immediately. Under federal law (Regulation E), you have a limited time to report fraud. If you report it within two business days of discovering the unauthorized transaction, your liability is capped at $50. If you report it within 60 calendar days, your liability is capped at $500. After 60 days, you may lose all protection.
Marcus will investigate the transaction and determine whether it was truly unauthorized. If they find it was, they will reverse the charge and return the money to your account. The investigation typically takes 10 business days, though Marcus may extend it to 45 days if needed. During the investigation, Marcus may freeze the disputed amount, so you cannot spend it, but it remains in your account.
If someone gains access to your account but does not make unauthorized transactions, there is no fraud to report. However, you should change your password immediately and enable two-factor authentication if you have not already. If you suspect someone has your password, change it even if no fraudulent activity has occurred yet.
How Marcus compares to other online banks on security
Most online banks use the same security tools: encryption, password protection, and optional two-factor authentication. The differences are small. Some banks offer biometric login (fingerprint or face recognition) on their mobile app; Marcus does not. Some banks offer hardware security keys as an alternative to text-message 2FA; Marcus offers only text message or authenticator apps. These differences matter only if you have a strong preference for one method over another.
The bigger difference is in regulation and insurance. All online banks that accept deposits must be FDIC-insured and regulated by federal banking authorities. Marcus is regulated by the Federal Reserve and the Office of the Comptroller of the Currency. This is the same regulatory framework that applies to traditional brick-and-mortar banks. There is no special risk to using an online bank versus a physical bank for deposit safety.
The main security risk with any bank—online or physical—is user error: weak passwords, reused passwords, falling for phishing emails, or sharing your login details. These risks exist regardless of which bank you choose. The best protection is to use a unique, strong password for your Marcus account and to enable two-factor authentication.
What to do if you lose access to your account
If you forget your password, you can reset it through the Marcus website or app. Marcus will send a link to your email address. Click the link and create a new password. This process takes a few minutes and does not require you to call anyone.
If you lose access to your email address or the phone number associated with your account, the process is more complicated. You will need to contact Marcus directly. Have your Social Security number and other identifying information ready. Marcus may ask you to verify your identity by answering security questions or providing documentation. This process can take several business days.
If you suspect someone else has access to your account and has changed your password or email address, contact Marcus immediately. Explain that your account may be compromised. Marcus can lock your account while they investigate and help you regain access. The sooner you report it, the faster they can act.
Steps to secure your Marcus account
Start with a strong, unique password. Use at least 12 characters and mix uppercase letters, lowercase letters, numbers, and symbols. Do not use words from the dictionary or personal information like your birthday or address. Do not reuse the same password on other websites. If you have trouble remembering passwords, use a password manager like Bitwarden, 1Password, or Dashlane to store them securely.
Enable two-factor authentication in your account settings. Choose whether you want codes sent via text message or generated by an authenticator app. An authenticator app (like Google Authenticator or Microsoft Authenticator) is slightly more secure than text message because it does not rely on your phone carrier, but either option is better than no 2FA at all.
Check your account regularly for unfamiliar transactions. Marcus sends you an email receipt for every transfer you make, so you will know if someone else is moving your money. If you see something you did not do, report it immediately. Do not wait to see if it resolves itself.
Frequently Asked Questions
What happens to my money if Marcus goes out of business?
The FDIC will reimburse you for up to $250,000 of your deposits. This process typically takes a few weeks. You do not need to do anything; the FDIC handles it automatically. In practice, the FDIC has never failed to reimburse depositors in full (up to the insurance limit) since the program began in 1933.
Can Marcus see my password?
No. Marcus stores only an encrypted version of your password, not the password itself. Even Marcus employees cannot see your password. If you forget it, you reset it yourself through the website; Marcus cannot retrieve the old one for you.
Is my money safe if I use public WiFi to access my Marcus account?
Encryption protects your data even on public WiFi, so your login details and transactions are scrambled in transit. However, public WiFi is riskier because someone on the same network could potentially intercept unencrypted data from other apps or websites. It is safer to use your phone's cellular data or a private WiFi network when accessing financial accounts.
What if I share my account with a family member and they make unauthorized transactions?
If the account is in both your names, both of you have full access and authority to move money. Transactions by an authorized account holder are not considered fraud, even if you did not approve them. To prevent this, keep your login details private and do not share your password with anyone, including family members.
Does Marcus report my account activity to the IRS?
Yes. Marcus reports interest earned on your savings account to the IRS on a Form 1099-INT. You will receive a copy in January of the following year. This is standard for all banks and is not a security issue; it is a tax reporting requirement.