Your money in a checking account is protected by federal insurance and bank security rules, but only up to certain limits and only if the bank itself fails
The Federal Deposit Insurance Corporation (FDIC) insures checking accounts at member banks up to $250,000 per depositor, per bank. This means if your bank closes or fails, the FDIC will return your money up to that limit. This protection is automatic — you do not need to sign up for it or pay a fee.
However, FDIC insurance does not protect you from theft, fraud, or unauthorized transactions. Those are covered by different rules. Banks are required by federal law to investigate unauthorized charges and refund them under the Electronic Funds Transfer Act, but you have to report them within a specific timeframe or you lose protection.
The real safety of your checking account depends on three separate things: whether the bank itself is sound, whether the bank's security systems work, and whether you protect your own login credentials and card information.
Key Takeaways
- The FDIC insures up to $250,000 per person per bank if the bank fails, but this does not cover fraud or theft.
- You must report unauthorized transactions within 60 days of receiving your statement, or the bank may not refund them.
- Banks must use encryption and security measures to protect your account, but you are responsible for keeping your password and PIN private.
- If you have more than $250,000 at one bank, open accounts at different banks or use a money market account to spread the risk.
- Debit card fraud and online account takeovers are the most common threats, and both require you to act quickly once you notice them.
FDIC insurance covers bank failure, not fraud
FDIC insurance protects your money if the bank itself goes under. When a bank fails, the FDIC steps in, takes over the bank's assets, and pays depositors from the insurance fund. You will receive your money back up to $250,000 within a few business days, usually through a wire transfer or a new account at another bank.
This protection does not apply to fraud, theft, or mistakes made by the bank in processing your transactions. If someone steals your debit card number and makes unauthorized purchases, that is a separate issue handled under the Electronic Funds Transfer Act, not FDIC insurance. Similarly, if the bank makes an error and transfers money from your account by mistake, you have to dispute it through the bank's error resolution process, not through FDIC insurance.
FDIC insurance also has limits. If you have $300,000 at one bank, only $250,000 is insured. The other $100,000 is not protected if the bank fails. You can increase your coverage by opening accounts at different banks — each bank's FDIC insurance is separate — or by using certain account structures like joint accounts or retirement accounts, which have their own $250,000 limits.
How to report fraud and what the bank must do
If you see an unauthorized charge on your checking account, call your bank immediately. Do not wait for a statement. The sooner you report it, the better your protection. Under federal law, your liability depends on how quickly you report the fraud.
If you report the unauthorized transaction within two business days of discovering it, your liability is capped at $50. If you wait more than two business days but report it within 60 days of receiving your statement, your liability can be up to $500. If you wait longer than 60 days, the bank does not have to refund you at all, though many banks will as a courtesy.
Once you report the fraud, the bank must investigate within 10 business days and tell you the results. If the bank finds the transaction was unauthorized, it must refund your money. If the bank believes the transaction was authorized, it must explain why and give you the chance to dispute that finding in writing. Keep records of every call you make and every email you send — get the name of the person you spoke to and the date and time.
Debit card fraud is the most common threat
Debit card fraud happens when someone uses your card number to make purchases without your permission. This can happen if your card is physically stolen, if your card number is stolen online, or if a store or website you use is hacked and your information is leaked.
The good news is that debit card fraud is covered by the Electronic Funds Transfer Act, and if you report it quickly, your liability is low. The bad news is that your money is gone from your account immediately, and you have to wait for the bank to investigate before you get it back. This can take up to 10 business days, which is longer than a credit card dispute.
To reduce the risk of debit card fraud, use your debit card only at ATMs and in-person at stores you trust. For online shopping, use a credit card instead — credit card fraud is easier to dispute and does not drain your checking account while the investigation happens. If your bank offers it, turn on transaction alerts so you get a text or email every time your card is used. Some banks also let you set spending limits or temporarily freeze your card through their app.
Online account takeover and password security
An online account takeover happens when someone gains access to your online banking login and changes your password, transfers money out, or adds a new payee to send money to. This is different from debit card fraud because the attacker is inside your account, not just using your card number.
Account takeovers usually start with a phishing email or text message that tricks you into giving up your password, or with a data breach at another company where you used the same password. Once the attacker has your password, they can lock you out of your own account and move your money before you notice.
To protect yourself, use a unique password for your bank account — do not reuse the password from other websites. Use a password manager like Bitwarden or 1Password to generate and store a long, random password. Turn on two-factor authentication if your bank offers it. Two-factor authentication means you have to enter a code from your phone or email every time you log in from a new device, which makes it much harder for an attacker to get in even if they have your password.
If you suspect your account has been taken over, call your bank immediately from the phone number on your bank statement or card — do not use a number from an email or text, because that could be fake. Tell the bank to freeze your account and change your password. Ask the bank to review recent transactions and dispute any that were not yours.
What banks must do to protect your account
Banks are required by federal law to use reasonable security measures to protect customer information. This includes encryption of data in transit and at rest, secure login systems, and monitoring for suspicious activity. Banks must also have a data breach notification plan and must tell you within 60 days if your personal information has been compromised.
However, "reasonable security" is not the same as perfect security. Banks are not liable for every breach or hack. If a bank fails to use industry-standard security practices and that failure leads to fraud, you may have a claim against the bank, but this is rare and usually requires a lawsuit.
The most common bank security failures are weak password requirements, lack of two-factor authentication, and slow response to fraud reports. If your bank does not offer two-factor authentication or does not let you set a strong password, consider switching to a bank that does. Your security is only as good as the weakest link, and if your bank is not taking security seriously, your money is at higher risk.
Checking accounts at credit unions and online banks
Credit unions are not FDIC-insured — they are insured by the National Credit Union Administration (NCUA), which offers the same $250,000 per person per institution protection. The coverage is equivalent to FDIC insurance, so your money is equally safe at a credit union as at a bank.
Online banks are FDIC-insured just like brick-and-mortar banks. The FDIC insurance applies to the bank itself, not to the platform you use to access it. Some online banks are owned by larger banks and are FDIC-insured through the parent company. Check the bank's website or call to confirm it is FDIC-insured before you open an account.
Online banks often have better security features than traditional banks because they invest more in technology. Many online banks offer two-factor authentication by default, have no monthly fees, and monitor accounts more actively for fraud. However, online banks have no physical branches, so if you need to deposit cash or speak to someone in person, you will have to use an ATM or mail a check.
What to do if your bank fails
If your bank fails, the FDIC will contact you by mail within a few days. The FDIC will either transfer your account to another bank or send you a check for your insured balance. This process usually takes less than a week, though it can take longer if the bank's records are damaged or incomplete.
If your balance exceeds $250,000, the FDIC will only insure up to that limit. The uninsured portion may be recovered later if the FDIC sells the bank's assets, but there is no may provide. This is why it is important to keep balances under $250,000 at any single bank if you want full protection.
Bank failures are rare in the United States. The FDIC maintains a list of failed banks on its website, and you can search by state or year to see how many banks have failed recently. As of 2024, bank failures are uncommon, and most banks that fail are small regional banks, not large national banks.
Frequently Asked Questions
What if I have a joint checking account with someone else?
Each person on the account is insured separately up to $250,000 by the FDIC. So if you and your spouse have a joint account with $400,000, the FDIC will insure up to $250,000 for you and up to $250,000 for your spouse, covering the full amount. If you add a third person to the account, that person also gets their own $250,000 of coverage.
Do I need to pay for FDIC insurance?
No. FDIC insurance is automatic and free. You do not need to sign up or pay a fee. Every checking account at an FDIC-insured bank is covered up to $250,000 automatically.
Can the bank refuse to refund me if I report fraud after 60 days?
Yes. Under the Electronic Funds Transfer Act, if you report unauthorized transactions more than 60 days after receiving your statement, the bank is not required to refund you. Some banks will refund you anyway as a courtesy, but they are not legally obligated to. Always report fraud as soon as you notice it.
Is my money safer in a savings account or a checking account?
FDIC insurance covers both equally up to $250,000. The difference is that savings accounts usually earn interest and have limits on how many withdrawals you can make per month, while checking accounts are designed for frequent transactions. Safety is the same; the choice depends on how you plan to use the account.
What should I do if I think my password has been compromised?
Log into your bank account immediately and change your password to something long and random that you have never used before. Turn on two-factor authentication if it is not already on. Call your bank to report the suspected compromise and ask them to review recent transactions for fraud. Consider placing a fraud alert with the credit bureaus if you are concerned about identity theft.