Online banks are safe to use when the institution holding your deposits is a chartered, FDIC-insured bank; deposits then carry the same federal protection as at any brick-and-mortar bank, up to $250,000 per depositor, per bank, per ownership category. The trickier question behind “are online banks safe” is whether the app on your phone is actually a bank at all. A growing number of platforms market themselves as online banks but operate as technology companies that route your money to partner banks behind the scenes. That structural difference is where people have lost real money.
What FDIC Insurance Actually Guarantees
The Federal Deposit Insurance Corporation is an independent federal agency that insures deposits at banks and savings associations.1Office of the Law Revision Counsel. 12 USC 1811 – Federal Deposit Insurance Corporation If an insured bank fails, the FDIC either moves your accounts to a healthy bank or sends you a check for the insured amount. The guarantee is backed by the full faith and credit of the United States, so it doesn’t rest on the FDIC’s own fund balance.
Coverage runs to $250,000 per depositor, per FDIC-insured bank, for each account ownership category.2FDIC. Understanding Deposit Insurance Categories are where the real coverage lives. Your individual checking and savings combine into one category. A joint account with a spouse is a separate category. An IRA is another. Each category gets its own $250,000 at the same bank, so a household with individual accounts, a joint account, and retirement accounts can carry well over a million dollars in insured deposits at a single institution without doing anything unusual.
Coverage applies to deposit accounts: checking, savings, money market deposit accounts, and CDs. It does not extend to investment products purchased through a bank, even when they live inside the same app.
Not Every “Online Bank” Is a Bank
This is the safety issue that catches people off guard. When you open an account with a fintech app, neobank, or payment platform, you may not be depositing money into a bank at all. You’re giving money to a technology company that places customer funds at one or more FDIC-insured partner banks using pooled “for benefit of” accounts. The Consumer Financial Protection Bureau has warned that money stored in nonbank payment apps often lacks federal deposit insurance and, if the app’s business fails, can be lost or frozen in a lengthy bankruptcy.3Consumer Financial Protection Bureau. Consumer Advisory: Your Money Is at Greater Risk When You Hold It in a Payment App
The 2024 collapse of banking-as-a-service company Synapse showed how this plays out. Synapse managed customer funds across multiple FDIC-insured partner banks through pooled accounts, but its recordkeeping was so poor that when it went bankrupt, nobody could reconcile which customers owned which dollars. The estimated shortfall reached $95 million. The partner banks were solvent and FDIC-insured the entire time. That didn’t help, because the intermediary’s records were unusable.
FDIC “pass-through” insurance can protect you when a third party holds your deposits at an insured bank, but only if three conditions are met: the funds must actually be owned by you and not the app company, the bank’s records must identify the account as held on your behalf, and records at some level must show your identity and ownership interest.4FDIC. Pass-Through Deposit Insurance Coverage If any of those fails, the FDIC treats the entire pooled account as belonging to the app company, insured for a single $250,000 total that would be divided among potentially thousands of customers.
The FDIC has since tightened rules on who can advertise deposit insurance. Under amendments to 12 CFR Part 328, non-bank companies are prohibited from using FDIC logos, terms, or images in ways that suggest they are insured institutions, and they must disclose that deposit insurance only covers the failure of an insured bank, not the failure of the app itself.5Federal Register. FDIC Official Signs and Advertising Requirements, False Advertising, Misrepresentation of Insured Status
How to Confirm What You’re Using
Before you fund an account, look for language in the account agreement or website footer such as “banking services provided by [Bank Name], Member FDIC.” That named bank is the insured institution. The app is not. If no partner bank is clearly identified, treat that as a warning sign.
The FDIC’s BankFind tool lets you search by bank name or web address and returns headquarters, primary regulator, operating status, and FDIC certificate number for any insured institution.6FDIC. BankFind Suite – Find Insured Banks If the online bank itself doesn’t appear, look up its named partner bank instead. Some fintechs hold their own charters and are genuine FDIC-insured banks that happen to operate online; those are as safe as any other chartered institution. The risk sits with the platforms that use bank-like marketing while operating as unlicensed intermediaries.
If the platform is really an investment app, FINRA’s BrokerCheck is the right tool. A firm registered there is regulated as a broker-dealer, and its cash sweep or securities accounts carry SIPC protection rather than FDIC insurance.7FINRA. About BrokerCheck
Your Rights When Money Disappears From the Account
The Electronic Fund Transfer Act gives you specific rights when someone makes unauthorized transactions from a personal account.8Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose Regulation E puts the rules into operation and ties your maximum liability directly to how fast you report the problem.9eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Report within 2 business days: your loss is capped at $50, or the amount transferred before you notified the bank, whichever is less.10Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of your statement: liability rises to $500.10Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 60 days: you can be on the hook for the full amount of any transfers that occurred after that window, if the bank shows they wouldn’t have happened had you reported sooner.10Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Check statements regularly. The difference between a $50 loss and losing an entire account balance often comes down to a single phone call.
Once you report, the bank must investigate within 10 business days and tell you the results within three business days of finishing.11eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.11 It can extend the investigation to 45 days only if it provisionally credits your account for the disputed amount within those first 10 business days.12Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors The bank may hold back up to $50 if it reasonably believes an unauthorized transfer occurred, but the rest of the money must be available to you while the review continues. If the bank later concludes no error occurred, it can reverse the credit, but it has to notify you first and provide the documentation behind the decision.
One boundary matters here: these protections apply to accounts held by individuals for personal, family, or household purposes.13eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.2 Business accounts fall outside Regulation E. If a small business account at an online bank is drained, the liability caps, investigation deadlines, and provisional credit rule don’t apply, and recourse depends on the account agreement and the Uniform Commercial Code.
Scams You Approve Yourself
P2P features built into banking apps create a tricky category. If someone steals your login credentials and uses them to send money, Regulation E treats that as an unauthorized transfer and the liability caps and investigation timelines apply, even when the credentials were obtained through phishing.14Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The rules shift when you authorize the transfer yourself. If a scammer convinces you to send money to a fake vendor or in a romance scam and you personally tap send, that transfer generally does not qualify as unauthorized under the law. The bank has no obligation to reverse it. Banks cannot waive Regulation E protections through their terms of service, but the protections only kick in when the transfer was truly unauthorized.14Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
Login Risks Specific to Online Access
Multi-factor authentication is standard at online banks, and it works. But not every second factor is equally strong. Text-message codes are vulnerable to SIM swap attacks, where a fraudster convinces a wireless carrier to move your phone number to a new SIM card and then intercepts your verification codes.
The FCC adopted rules in late 2023 requiring wireless carriers to authenticate customers using secure methods before redirecting a phone number to a new device or carrier and to notify customers immediately when a SIM change or port request is submitted.15Federal Communications Commission. FCC Adopts Rules to Protect Consumers’ Cell Phone Accounts The rules help but don’t eliminate the risk. The FTC recommends using an authenticator app rather than text-message codes for banking logins when a bank offers the option, and setting a separate PIN or password on your cellular account.16Federal Trade Commission. SIM Swap Scams: How to Protect Yourself
Fingerprint and face recognition logins are convenient and generally harder to steal than passwords. Biometric data does carry one unusual risk: you can’t reset a compromised fingerprint the way you can change a password. The FTC has warned that large stores of biometric information are attractive targets for malicious actors and that some biometric technologies, such as facial recognition, have higher error rates for certain populations.17Federal Trade Commission. FTC Warns About Misuses of Biometric Information and Harm to Consumers Treat biometric login as one factor alongside others, not as your only defense.
Keeping Balances Over $250,000 Insured
If deposits at a single bank exceed $250,000, the excess is uninsured unless the accounts are structured across multiple ownership categories. Two approaches work well for online bank customers.
Adding payable-on-death beneficiaries converts a single-ownership account into a trust account for insurance purposes. Each unique beneficiary adds $250,000 of coverage, up to $1,250,000 per owner when five or more beneficiaries are named.18FDIC. Trust Accounts A married couple who each name the other plus three children on separate accounts at the same bank could carry up to $2.5 million in insured deposits at one institution.19FDIC. Your Insured Deposits
Some online banks participate in deposit sweep networks that automatically spread your money across multiple FDIC-insured banks in increments of $250,000 or less. You manage a single account at your primary institution while your deposits are distributed behind the scenes so that no single bank holds more than the insured limit. Some programs advertise coverage reaching into the millions.
Don’t Lose Track of an Account
One risk shows up more with online-only banking than with traditional accounts: forgetting the account exists. Without paper statements or branch visits, an account can sit untouched for years. Every state has an escheatment law requiring banks to turn dormant accounts over to the state as unclaimed property after a period of inactivity, typically two to five years depending on the state and the account type. Recovering the money then means filing a claim with the state’s unclaimed property office, proving ownership, and waiting months. A calendar reminder to log into every account periodically, even ones you rarely touch, prevents that outcome.