Citi Bank is insured by the FDIC and meets federal security standards, but safety depends on what you mean
Citibank (the consumer banking division of Citigroup) is a federally chartered bank regulated by the Office of the Comptroller of the Currency. Your deposits are protected by FDIC insurance up to $250,000 per account category per bank. This means if Citibank fails, the FDIC will reimburse you for covered deposits. The bank also uses encryption, multi-factor authentication, and fraud monitoring on digital accounts.
That said, "safe" means different things. Your money is safe from bank failure. Your account is reasonably protected from hackers if you use strong passwords and don't share login details. But you are not safe from your own mistakes—sending money to the wrong person, falling for a scam, or authorizing a fraudulent transfer. You are also not protected if someone gains access to your account through social engineering (calling the bank pretending to be you) or if you reuse passwords across multiple websites and one of them gets breached.
Citibank has faced data breaches in the past. In 2021, hackers accessed customer information including names, contact details, and account numbers—though the bank said no Social Security numbers or financial data were stolen. In 2020, a Citibank employee error exposed customer data. These incidents were resolved, but they show that no bank is immune to security incidents.
Key Takeaways
- Your Citibank deposits are insured by the FDIC up to $250,000 per account type, protecting you if the bank fails.
- Citibank uses encryption and fraud monitoring, but you must protect your own login credentials and never share them with anyone, including bank employees.
- FDIC insurance does not cover money you send to scammers or unauthorized transfers you authorize yourself, even by accident.
- If your Citibank account is compromised, report it immediately—the bank's fraud liability depends on how quickly you act.
How FDIC insurance protects your Citibank deposits
The FDIC insures deposits at Citibank the same way it does at any other member bank. Each depositor is covered up to $250,000 per account category. This means if you have a checking account, a savings account, and a money market account at Citibank, each is insured separately up to $250,000. If you have a joint account with someone else, that account gets its own $250,000 coverage.
FDIC insurance is automatic—you do not need to sign up or pay a fee. It covers the balance in your account on the day the bank fails. It does not cover investment products like stocks, bonds, or mutual funds, even if you buy them through Citibank. It also does not cover safe deposit boxes or their contents.
If Citibank were to fail, the FDIC would either transfer your account to another bank or send you a check for your insured balance. This process typically takes a few days to a few weeks. The FDIC has never failed to pay out insured deposits in full.
What Citibank's security features actually protect
Citibank uses encryption to scramble data traveling between your device and their servers, so hackers cannot intercept your login credentials or account details in transit. The bank also requires multi-factor authentication (a code sent to your phone or generated by an app) when you log in from a new device or location. These measures protect against someone accessing your account remotely without your knowledge.
Citibank monitors accounts for unusual activity—large transfers, logins from foreign countries, or purchases in categories you do not normally use. If the system detects something suspicious, it may freeze the transaction or lock your account temporarily. This is a friction point, but it catches many fraudulent transfers before they complete.
However, these protections have limits. If you write down your password and leave it on your desk, encryption does not help. If you click a link in a phishing email and enter your login details, multi-factor authentication does not stop the attacker from logging in with the code they receive. If you call a number from a fake email and tell someone your account details, no security feature can prevent that.
What FDIC insurance does not cover
FDIC insurance protects your deposits from bank failure, not from fraud or your own actions. If you send $5,000 to someone who promises to double your money and disappears, the FDIC will not reimburse you. If you authorize a wire transfer to pay a fake tax bill, the FDIC will not reverse it. If a scammer tricks you into giving them remote access to your computer and transfers your money out, the FDIC will not cover it.
Citibank does offer fraud protection under federal law (Regulation E for electronic transfers and the Truth in Lending Act for credit cards), but these protections require you to report the fraud within specific timeframes. If you do not notice an unauthorized transfer for 60 days, your liability may be higher or the bank may not reverse it at all. If you authorized the transfer yourself—even if you were tricked into doing so—the bank may not be required to refund it.
Investment products held at Citibank are not FDIC insured. If you buy stocks, mutual funds, or bonds through Citibank, those are protected by SIPC insurance (Securities Investor Protection Corporation) up to $500,000 per account, but only against the brokerage firm's failure, not against market losses or fraud.
Steps to take if your Citibank account is compromised
If you notice an unauthorized transaction, log into your account immediately and change your password. Then call Citibank's fraud line at the number on the back of your card or on your statement—do not use a number from an email or search result, as scammers sometimes post fake numbers. Tell them which transaction is fraudulent and when you first noticed it.
Citibank will typically freeze your account and issue a new debit card or credit card. For unauthorized electronic transfers (ACH, wire, or debit card), the bank has 10 business days to investigate and must refund you if the transaction was not authorized. For credit card fraud, your liability is capped at $50 under federal law, and Citibank often waives this entirely.
For wire transfers and ACH transfers, speed matters. If you report the fraud within one business day of noticing it, your liability is limited to $50. If you wait more than two business days, you could be liable for up to $500. If you wait more than 60 days, you may lose the right to dispute the transaction entirely. Write down the date and time you called and the name of the representative you spoke to.
Common security mistakes that put your Citibank account at risk
Reusing passwords across multiple websites is the most common mistake. If you use the same password for Citibank and for a shopping site, and the shopping site gets breached, hackers will try that password on your bank account. Use a unique, strong password for Citibank—at least 12 characters, mixing uppercase, lowercase, numbers, and symbols. Consider using a password manager like Bitwarden or 1Password to generate and store unique passwords.
Clicking links in emails is another major risk. Phishing emails look like they come from Citibank but actually lead to fake login pages designed to steal your credentials. Citibank will never ask you to click a link and log in via email. If you receive an email claiming to be from Citibank, go directly to citibank.com in your browser instead of clicking any link.
Sharing your login details with anyone—even someone claiming to be from Citibank—is a may provide way to lose access to your account. Citibank employees will never ask for your password. If someone calls you claiming to be from the bank and asks for your password or PIN, hang up and call the number on your card.
Using public Wi-Fi to access your Citibank account is risky because someone on the same network can intercept unencrypted traffic. If you must use public Wi-Fi, use a VPN (virtual private network) like Mullvad or ProtonVPN to encrypt your connection first.
How Citibank's past security incidents affect your account today
Citibank has experienced data breaches, but these have not resulted in widespread unauthorized access to customer accounts. In the 2021 incident, hackers accessed customer information but the bank said no financial data or Social Security numbers were exposed. In the 2020 incident, an employee error exposed data, but again, no financial transactions were compromised.
These incidents led Citibank to increase security spending and hire additional security staff. The bank now publishes a security report annually and participates in industry information-sharing groups that alert banks to emerging threats. However, no bank can may provide that a breach will never happen again.
If you are concerned about a specific breach, check the Citibank website or contact the bank directly to see if your account was affected. If it was, the bank will typically offer free credit monitoring for a set period. This does not reverse a breach, but it alerts you if someone tries to open new accounts in your name.
Frequently Asked Questions
What happens to my money if Citibank goes out of business?
The FDIC will protect your deposits up to $250,000 per account category. The FDIC will either transfer your account to another bank or send you a check within a few days to a few weeks. Your money is safe—the FDIC has never failed to pay out insured deposits in full since it was created in 1933.
Is my Citibank credit card safer than my debit card?
Credit cards offer stronger fraud protection under federal law. Your liability for unauthorized credit card charges is capped at $50, and Citibank often waives this. Debit cards offer protection too, but your liability depends on how quickly you report the fraud—up to $50 if you report within one day, up to $500 if you wait longer. Use credit cards for everyday purchases when possible.
Can Citibank reverse a wire transfer I sent by mistake?
Citibank can attempt to recall a wire transfer, but success is not may provide. The receiving bank may have already released the funds or closed the account. Contact Citibank immediately if you sent money to the wrong person. The sooner you report it, the better your chances of recovery. Do not wait—wire fraud is difficult to reverse after a few hours.
Do I need to worry about Citibank selling my data?
Citibank shares customer data with affiliated companies and service providers, but only as needed to provide banking services and as permitted by law. You can opt out of some data sharing through your account settings, though this may limit certain services. Read Citibank's privacy policy for details on what data is shared and with whom.
What should I do if I get a call claiming to be from Citibank asking for my password?
Hang up immediately. Citibank will never call you and ask for your password, PIN, or full account number. If you are concerned the call was legitimate, hang up and call the number on the back of your card or on your statement. Do not use a number the caller provided.