Online savings accounts use the same federal deposit insurance as brick-and-mortar banks

Your money in an online savings account is insured by the Federal Deposit Insurance Corporation (FDIC) up to $250,000 per depositor, per bank, per account ownership category. This is the same protection that covers money in a physical bank branch. The FDIC may provide does not depend on whether you can walk into a building or access your account only through a website and phone.

The FDIC insurance applies automatically — you do not need to sign up for it or pay a fee. When you open an account at an FDIC-insured institution, the coverage begins when ready. You can check whether a specific bank is FDIC-insured by searching the FDIC's Bank Find tool on their website, which lists every covered institution.

The $250,000 limit resets for each separate account ownership category. If you have a savings account in your name alone and a joint savings account with your spouse at the same bank, each is insured separately up to $250,000. Retirement accounts (IRAs, SEP-IRAs) are also a separate category, as are trust accounts and accounts held in the name of a minor.

Key Takeaways

  • FDIC insurance covers up to $250,000 per depositor per bank, whether the account is online or in a physical branch.
  • Online banks use encryption and multi-factor authentication to prevent unauthorized access to your account, though no system is completely risk-free.
  • Your biggest risk with an online account is usually your own password or a phishing email, not a failure of the bank's security.
  • If an online bank fails, the FDIC takes over and moves your insured deposits to another bank or pays you directly within days.

How online banks encrypt and protect account access

Online banks transmit data using SSL encryption (the "https://" you see in the address bar), which scrambles information between your device and the bank's servers. This prevents someone on the same Wi-Fi network from intercepting your login credentials or account details. Most online banks also require multi-factor authentication — a second verification step such as a code sent to your phone or generated by an authenticator app — before you can log in or move money.

The bank's servers themselves sit behind firewalls and intrusion detection systems designed to block unauthorized access. Banks also monitor accounts for unusual activity — a large transfer to a new recipient, a login from an unfamiliar location — and will freeze the account or contact you if something looks wrong. These controls are standard across online banks and are regularly tested by third-party security auditors.

That said, encryption and monitoring do not make an account completely risk-free. A determined attacker with your password and access to your phone number can sometimes bypass multi-factor authentication. The real vulnerability in most cases is not the bank's technology but your own behavior: a weak password, reusing the same password across multiple sites, or clicking a link in a phishing email that looks like it came from your bank.

What happens if an online bank fails

If an online bank becomes insolvent, the FDIC steps in as the receiver. The FDIC does not bail out the bank — it protects you, the depositor. The agency takes control of the failed bank's assets and either arranges for another bank to assume your account or pays you directly from the FDIC insurance fund.

In most cases, the transfer happens quickly. The FDIC aims to make insured deposits available within one to three business days, though the process can take longer if the failure is complex. You will receive notice by mail and email telling you what happened and how to access your money. If your balance exceeds $250,000, the amount over the limit may be at risk, depending on how the account is titled.

Bank failures are rare. The FDIC has insured deposits since 1933, and the number of failures has declined sharply since the 2008 financial crisis. Between 2010 and 2023, fewer than 100 FDIC-insured banks failed in the entire United States. An online bank is statistically safer than keeping cash in your home.

Phishing and social engineering are the most common threats

A phishing email that looks like it came from your bank — complete with the bank's logo and a link to what appears to be the login page — is the most frequent way attackers gain access to online savings accounts. The fake page captures your username and password. Once they have those credentials, they can log in and transfer your money out, sometimes within minutes.

Social engineering is similar but involves a phone call or text message instead of email. An attacker calls claiming to be from the bank's fraud department and asks you to confirm your account number, password, or the code from your authenticator app. A real bank will never ask for your password or your full account number over the phone.

To protect yourself: never click a link in an email claiming to be from your bank. Instead, go directly to the bank's website by typing the address into your browser or calling the number on the back of your debit card. Do not share your password, PIN, or multi-factor authentication codes with anyone, including bank employees. If you receive a suspicious email or call, report it to your bank directly.

How to choose a safe online bank

Start by confirming the bank is FDIC-insured. Search the FDIC Bank Find tool and look for the bank's name and the state where it is chartered. If it does not appear in the search results, it is not FDIC-insured, and your deposits are not protected by federal insurance.

Check whether the bank requires multi-factor authentication for login and for sensitive actions like changing your password or adding a new transfer recipient. Read the bank's privacy policy to understand what data it collects and how it shares information with third parties. Look at customer reviews on independent sites (not the bank's own website) to see whether other users have reported security issues or problems accessing their money.

Consider the bank's size and history. Larger, established online banks have more resources for security and customer support than newer startups. That does not mean a smaller bank is unsafe — FDIC insurance protects you either way — but it does mean you may have fewer options if something goes wrong and you need to speak to a person quickly.

What FDIC insurance does and does not cover

FDIC insurance covers the balance in your account on the day the bank fails. It does not cover losses from fraud, theft, or your own mistakes. If someone steals your login credentials and transfers $5,000 out of your account, the FDIC does not reimburse you — that is a matter between you and the bank, and the bank's fraud policy.

Most banks offer Regulation E protection, which covers unauthorized electronic transfers (transfers you did not make) up to $50 if you report the fraud within two business days, or up to $500 if you report it within 60 days. After 60 days, you may have no protection. Check your bank's fraud policy before you open an account.

FDIC insurance also does not cover investments held at the bank, such as stocks, bonds, or mutual funds. If the bank fails, those assets are held separately and returned to you. Similarly, if you use the bank's brokerage service to buy securities, those are not FDIC-insured — they are protected under different rules (SIPC insurance, which covers up to $500,000 per customer).

Frequently Asked Questions

Can someone hack my online savings account if I use a strong password?

A strong password makes it much harder, but not impossible. An attacker might use phishing to trick you into revealing your password, or they might breach another website you use and try that same password on your bank account. Use a unique password for your bank account — one you do not use anywhere else — and enable multi-factor authentication. Those two steps eliminate most common attack methods.

Is my money safer in an online bank or a physical bank?

Both are equally safe in terms of FDIC insurance — your deposits are protected up to $250,000 either way. The difference is in how you access your money and how straightforward it is to reach customer service. An online bank may have lower fees and higher interest rates, but a physical bank offers in-person support if something goes wrong.

What should I do if I see a transaction I did not make?

Contact your bank when ready by phone using the number on the back of your debit card or statement — do not use a number from an email or text message. Report the unauthorized transaction and ask the bank to freeze your account. Most banks will reverse fraudulent transactions within one to three business days if you report them promptly. The sooner you report it, the better your protection under Regulation E.

Do online banks have to tell me if they get hacked?

Yes. Banks are required by law to notify you if there is a breach that compromises your personal information. The notification must come within a reasonable time, usually 30 to 60 days. If a bank experiences a data breach, it will also notify credit bureaus and may offer free credit monitoring. A breach does not mean your money is gone — it means your information may have been exposed and you should watch for fraudulent accounts opened in your name.

What happens to my money if the online bank goes out of business?

The FDIC takes over and either moves your account to another bank or pays you directly. You will receive notice by mail and email. Your insured deposits (up to $250,000) will be available within one to three business days in most cases. Any amount over $250,000 may be at risk depending on how the account is titled, so it is important to understand the FDIC's coverage limits before you deposit large sums.