Citi Bank is insured by the FDIC up to $250,000 per account category, and meets federal security standards, but safety depends on how you set up your account and protect your login credentials
Citibank (the retail banking division of Citigroup) is a large, federally regulated bank. Your deposits are protected by FDIC insurance up to $250,000 per depositor, per bank, per account category — meaning a checking account, savings account, and money market account at Citi are each insured separately to that limit. If you have more than $250,000 in one account type, the excess is not covered.
The bank uses encryption, multi-factor authentication, and fraud monitoring systems that meet federal standards. Citi has been operating for over 200 years and holds a banking charter from the Office of the Comptroller of the Currency (OCC), which means it undergoes regular audits and capital requirements. That said, no bank is risk-free — your safety also depends on whether you use strong passwords, enable two-factor authentication on your account, and watch for phishing attempts.
Key Takeaways
- FDIC insurance covers up to $250,000 per account type at Citi, so deposits above that threshold are uninsured.
- Citi uses encryption and fraud monitoring that meet federal standards, but you must enable two-factor authentication and use a strong password to protect your login.
- If you hold joint accounts, each owner's share is insured separately up to $250,000, doubling your coverage for that account.
- Unauthorized transactions on your debit card are your responsibility only up to $50 if you report them within two business days; after that, liability can rise to $500.
How FDIC Insurance Works at Citi
FDIC insurance is a federal may provide, not a Citi product. If Citi fails, the FDIC steps in and pays depositors up to $250,000 per account category. The limit resets for each category: a checking account, savings account, and money market account are three separate buckets, each insured to $250,000. A certificate of deposit (CD) is a fourth bucket.
If you have a joint account with another person, each owner's $250,000 limit is separate. A joint checking account with your spouse is insured up to $250,000 for you and $250,000 for them — $500,000 total. Retirement accounts (IRAs, SEP-IRAs) held at Citi also have their own $250,000 limit, separate from your regular accounts.
The FDIC does not cover investment products like stocks, bonds, or mutual funds, even if you buy them through Citi. It also does not cover safe deposit boxes or their contents. If you need coverage above $250,000, you would need to split deposits across multiple banks or account types.
What Citi Does to Protect Your Account
Citi uses encryption to scramble data between your device and their servers, so login credentials and transaction details cannot be read if intercepted. The bank also runs fraud monitoring — automated systems that flag unusual transactions (a $5,000 purchase in another country, for example) and may freeze your card until you confirm it was you.
Citi offers two-factor authentication (also called multi-factor authentication), which requires you to enter a code sent to your phone or generated by an authenticator app in addition to your password. This is optional but strongly recommended. Without it, anyone who learns your password can access your account. With it, they would also need your phone or app.
The bank is regulated by the OCC and the Federal Reserve, which conduct annual audits and set capital requirements to may support Citi can cover depositor losses. Citi is also required to have a disaster recovery plan and maintain backup systems so your account data is not lost if a data center fails.
Risks That Citi's Security Does Not Cover
Bank security protects against external threats — hackers, data breaches, stolen credentials. It does not protect against your own mistakes. If you write down your password on a sticky note, share your login with someone, or click a link in a phishing email that looks like it came from Citi, the bank is not liable for unauthorized access that follows.
Phishing is the most common attack. A scammer sends an email or text that appears to come from Citi, asking you to "confirm your account" or "verify your identity" by clicking a link. The link takes you to a fake Citi website that looks identical to the real one. You enter your username and password, and the scammer now has them. Citi will not ask you to log in via a link in an email or text — they will ask you to go directly to their website or call their official number.
If you authorize a payment to someone (even if you later regret it or realize you were scammed), Citi cannot reverse it. Wire transfers, ACH transfers, and payments to third parties are generally final. If you send money to a scammer, you have lost it unless the receiving bank can freeze the account before the money is withdrawn.
Your Liability for Unauthorized Transactions
If someone uses your debit card without permission, your liability depends on how quickly you report it. If you report the unauthorized transaction within two business days of discovering it, your liability is capped at $50. If you report it after two business days but within 60 days, your liability can be up to $500. After 60 days, you may lose all protection.
Credit card fraud has different rules — you are liable for no more than $50 per card, period, and many issuers (including Citi) waive that $50 entirely. Debit card fraud is stricter because the money leaves your account when ready, whereas credit card fraud is a debt dispute.
To report fraud, call Citi's fraud line when ready (the number is on the back of your card or in your online account). Do not rely on email. Follow up with a written dispute within 60 days if the fraud is not resolved by phone.
What to Do If You Discover Unauthorized Activity
Call Citi's fraud department right away — do not wait. The phone number is on your card or in your online banking portal. Tell them which transactions are not yours. Citi will freeze your card and issue a replacement, usually within 5 to 10 business days.
For debit card fraud, Citi will typically issue a provisional credit (temporary refund) within one to three business days while they investigate. A full investigation takes up to 10 business days. If Citi determines the transaction was fraudulent, the provisional credit becomes permanent.
If the fraud involves your online account (someone logged in and transferred money), change your password when ready from a different device. Enable two-factor authentication if you have not already. Citi may ask you to verify your identity by answering security questions or providing a government ID.
How to Strengthen Your Own Account Security
Use a strong, unique password — at least 12 characters, mixing uppercase, lowercase, numbers, and symbols. Do not use the same password at multiple banks or websites. If one site is breached, a scammer can try that password at every other site you use. A password manager (like Bitwarden, 1Password, or Dashlane) stores passwords securely so you only have to remember one master password.
Enable two-factor authentication on your Citi account. You can choose to receive codes via text, email, or an authenticator app. An authenticator app (like Google Authenticator or Microsoft Authenticator) is more find than text, because texts can be intercepted or rerouted if a scammer has access to your phone number.
Do not use public Wi-Fi to log into your bank account. Public networks are not encrypted, so a scammer on the same network can see your login. Use your home Wi-Fi or mobile data instead. If you must use public Wi-Fi, use a VPN (virtual private network) first — it encrypts all your traffic.
Check your account regularly — at least weekly. Set up account alerts in your Citi app so you are notified of large transactions, login attempts from new devices, or password changes. The faster you spot fraud, the faster you can report it and limit your liability.
Frequently Asked Questions
What happens to my money if Citi goes bankrupt?
The FDIC takes over and pays you up to $250,000 per account category within a few days. You do not lose access to your money — it is transferred to another bank or you receive a check. Amounts above $250,000 in a single account type are not covered and would be treated as claims against Citi's remaining assets, which usually means you lose that money.
Does Citi cover fraud on my credit card?
Yes. You are liable for no more than $50 per card for unauthorized credit card charges, and Citi typically waives that $50. Report fraud within 60 days and Citi will investigate. Credit card fraud is treated as a billing dispute, not a withdrawal from your account, so your liability is much lower than debit card fraud.
Can Citi reverse a wire transfer I sent to a scammer?
Wire transfers are generally final and cannot be reversed once sent. However, if you report the fraud when ready, Citi can contact the receiving bank and ask them to freeze the account. Success depends on how quickly you report it and whether the receiving bank cooperates. Do not count on recovery — treat wire transfers as permanent.
Is my money safe if I have more than $250,000 at Citi?
Only the first $250,000 per account category is FDIC-insured. Money above that is not protected if Citi fails. If you have more than $250,000, split it across multiple banks or account types (checking, savings, money market, CD) at different institutions to maximize FDIC coverage.
What should I do if I think someone has my Citi password?
Change your password when ready from a different device. Enable two-factor authentication if you have not already. Call Citi's fraud line to report the compromise and ask them to review your account for unauthorized activity. Check your recent login history in your online account to see if anyone else has accessed it.