A covered account is a bank or payment account that a financial institution monitors for fraud and unusual activity

A covered account is any account you hold at a bank, credit union, or payment service where money moves in and out. The term comes from the Safeguards Rule, a regulation that requires financial institutions to watch these accounts for signs of fraud or identity theft. Banks don't call them "covered accounts" in your statements or online portal—that's regulatory language. But the rule means your bank has a legal duty to spot when someone else is using your account and to tell you about it.

The rule applies to most accounts where you can receive deposits, make withdrawals, or transfer money: checking accounts, savings accounts, money market accounts, prepaid cards, and some payment apps. It does not apply to investment accounts like brokerage accounts or retirement accounts, which have their own fraud rules. The bank's job is to set up systems that catch fraud early, before your money is gone.

Key Takeaways

  • A covered account is any bank or payment account where the financial institution must monitor for fraud and unauthorized activity under federal law.
  • Checking, savings, money market, and prepaid card accounts are covered; investment and retirement accounts are not.
  • Banks must have a written fraud detection program in place and must tell you about suspicious activity within a reasonable time.
  • You are responsible for reporting unauthorized transactions within 60 days of receiving your statement to keep your fraud liability limited.

Which accounts count as covered accounts

Most everyday accounts are covered. This includes traditional checking and savings accounts at banks and credit unions, money market accounts, and prepaid debit cards issued by financial institutions. Payment apps like Venmo, PayPal, and Square Cash that hold your money in an account also fall under the rule if they are registered as money transmitters or financial institutions.

Accounts that are not covered include brokerage accounts where you buy stocks or bonds, 401(k) retirement accounts, IRAs, and health savings accounts. These accounts have separate fraud protections under different rules. If you are unsure whether a specific account is covered, call the institution and ask whether they monitor it under the Safeguards Rule.

What banks must do to protect covered accounts

Your bank is required to have a written fraud detection program in place. This program must include ways to spot fraud, rules for who can access your account, and a process for notifying you when something looks wrong. The bank does not have to prevent all fraud—only to use reasonable methods to detect it and respond quickly.

Most banks use automated systems that flag transactions outside your normal pattern: a charge from a foreign country when you usually shop locally, a withdrawal of your entire balance in one transaction, or repeated failed login attempts. When the system flags something, the bank may freeze the transaction, call you to confirm, or send you an alert. The bank must tell you about unauthorized activity within a reasonable time—usually within one to three business days, though the law does not set a hard deadline.

Your responsibility to report unauthorized activity

You have a legal window to report fraud: 60 days from the date your bank sends you a statement that shows an unauthorized transaction. If you report within that window, your liability is capped at $50 per unauthorized transaction under federal law (the Electronic Funds Transfer Act). If you wait longer than 60 days, you may lose all protection and be liable for the full amount stolen.

Report fraud by calling your bank's fraud line, not the main customer service number. Most banks have a dedicated fraud department that works faster. Have your account number and the specific transactions ready. Ask the bank to send you a written confirmation of your report. Keep that confirmation and any follow-up emails—you may need them if the bank disputes your claim later.

What happens after you report fraud on a covered account

Once you report unauthorized activity, the bank must investigate within 10 business days (or 20 days if the account is new). During the investigation, the bank may freeze your account or block certain transactions. You can still make deposits and receive direct deposits, but you may not be able to withdraw money until the investigation closes.

If the bank finds the transaction was unauthorized, it must credit your account within one business day of that finding. If the bank finds the transaction was authorized (meaning you made it or someone you allowed to use your account made it), the bank can hold you liable. You have the right to dispute the bank's finding in writing within 10 days of receiving their decision.

How covered account protections differ from credit card fraud

Covered accounts and credit cards have different fraud rules. Credit cards cap your liability at $50 under the Fair Credit Billing Act, and many issuers waive that entirely. Covered accounts cap your liability at $50 only if you report within 60 days; after that, you may owe the full amount. Credit card fraud is reported to credit bureaus and can affect your credit score; covered account fraud usually does not.

Credit card companies must investigate disputes within 30 days and resolve them within two billing cycles. Banks investigating covered account fraud have up to 20 days to investigate and one business day to credit your account once they find fraud. Both have similar timelines, but the liability rules are stricter for covered accounts if you miss the 60-day reporting window.

Steps to protect your covered accounts from fraud

Set up account alerts through your bank's app or website. Most banks let you choose alerts for large transactions, out-of-state charges, or login attempts from new devices. These alerts reach you by text or email within minutes of the activity. Check your account at least weekly—do not wait for your monthly statement to spot fraud.

Use a strong, unique password for each account and enable two-factor authentication if your bank offers it. Two-factor authentication requires a second step (usually a code sent to your phone) before anyone can log in or move money. Do not share your account number, PIN, or login credentials with anyone, even if they claim to be from your bank. Your bank will never ask for this information by email or phone.

Frequently Asked Questions

What is the difference between a covered account and a regular bank account?

All regular bank accounts are covered accounts. The term "covered" simply means the bank is required by law to monitor it for fraud and have a written fraud detection program. There is no separate type of account—it is just the regulatory name for accounts that fall under the Safeguards Rule.

If someone uses my covered account without permission, how much can I lose?

If you report the fraud within 60 days of receiving your statement, your liability is capped at $50 per unauthorized transaction. If you report after 60 days, you may be liable for the full amount stolen. Some banks waive the $50 fee entirely, so call your bank's fraud line to ask.

Can my bank close my account if I report fraud?

A bank can close your account, but not as punishment for reporting fraud. Banks close accounts for many reasons: repeated overdrafts, suspicious activity patterns, or violation of account terms. If your bank closes your account after you report fraud, ask in writing why they closed it. If it was retaliation for the fraud report, you may have a complaint to file with your state banking regulator.

Do prepaid cards have the same fraud protections as checking accounts?

Prepaid cards issued by banks or credit unions are covered accounts and have the same 60-day reporting window and $50 liability cap. However, some prepaid cards issued by retailers or payment apps may not be covered. Check your card's terms or call the issuer to confirm whether it is a covered account under the Safeguards Rule.

What should I do if my bank does not investigate my fraud claim?

If your bank does not respond within 20 business days or denies your claim without explanation, file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB). Include your written fraud report, the bank's response, and any evidence of unauthorized activity. The regulator can force the bank to investigate further.