Is My Savings Account Safe From Hackers? Liability and FDIC Limits

Your personal savings account is safer from hackers than most account holders assume. Under federal law, if someone drains your account remotely through phishing, malware, or a data breach, and no debit card or PIN was physically lost or stolen, your personal liability is $0 as long as you report the unauthorized activity within 60 days of the bank sending the statement that shows it. Banks reinforce that legal protection with encryption, multi-factor authentication, and automated behavioral monitoring designed to stop intrusions before any money moves. The catch is timing: how quickly you notice and report fraud determines how much of that protection you actually get.

What You’re Actually Liable For If a Hacker Gets In

The Electronic Fund Transfer Act, implemented through the Consumer Financial Protection Bureau’s Regulation E (12 CFR Part 1005), governs unauthorized electronic transfers from consumer accounts. Your maximum liability turns on two things: whether a physical access device was lost or stolen, and how fast you notify your bank.¹

Remote Hacking With No Lost Card

If a hacker reaches your account through a data breach, phishing, malware, or any other remote method, and no physical card or PIN was lost or stolen, you owe nothing for the unauthorized transfers as long as you report within 60 days of the statement that shows them. The commonly cited $50 and $500 tiers do not apply to this scenario. They apply only when an access device was lost or stolen.¹

Miss the 60-day window and you become liable for unauthorized transfers that happen after those 60 days and before you finally report, but only if the bank can show it could have stopped those later transfers had you spoken up sooner. Transfers that occurred inside the 60-day window remain the bank’s responsibility.¹

Lost or Stolen Debit Card or PIN

If a physical access device was lost or stolen, a tiered system applies:

Report within 2 business days: liability capped at $50, or the amount taken before you reported, whichever is less.
Report after 2 business days but within 60 days of the statement: liability can climb to $500, and the bank must prove the additional transfers would not have occurred with earlier notice.
Report after 60 days: you can be on the hook for everything taken after the 60-day mark, including funds pulled from overdraft lines tied to the account.

These caps apply only if the bank has already provided the required disclosures and a means of identifying you as the account holder.¹

Zero-Liability Policies

Many banks and credit unions voluntarily waive even the $50 minimum through zero-liability policies. These are private commitments rather than legal requirements, and they generally apply only to personal accounts where the customer was not negligent. Your account agreement will spell out the terms.

What FDIC and NCUA Insurance Do Not Cover

Deposit insurance and fraud protection address different risks, and the difference matters if a hacker cleans out your account. The Federal Deposit Insurance Corporation reimburses depositors up to $250,000 per depositor, per insured bank, per ownership category if the bank itself fails.² For credit union members, the National Credit Union Share Insurance Fund provides the same $250,000 coverage per member, per insured credit union, per ownership category.³

Hacking does not trigger either program. Fraud losses go through the bank’s internal dispute process under Regulation E. Deposit insurance is your backstop against institutional collapse; Regulation E is your backstop against unauthorized transfers.

Business Savings Accounts Are Not Covered

Regulation E applies only to accounts established primarily for personal, family, or household purposes. Business accounts fall outside it entirely.⁴ Business account fraud is governed instead by Article 4A of the Uniform Commercial Code, under which a bank can enforce an unauthorized payment order against your business if it acted in good faith and followed a commercially reasonable security procedure you had agreed to. The bank does not have to prove the transaction was actually authorized, only that its security process was reasonable.⁵ If you keep significant balances in a business savings account, ask your bank what fraud protections apply and consider whether personal accounts fit part of your holdings.

How Banks Try to Stop Hackers Before Money Moves

Banks deploy overlapping security layers so that defeating one still leaves others intact.

Encryption

Stored account data is typically encrypted with the Advanced Encryption Standard using 256-bit keys, the same standard approved for sensitive federal government data.⁶ When data travels between your device and the bank, Transport Layer Security establishes an encrypted connection so intercepted traffic is unreadable without the key.

Multi-Factor Authentication

Multi-factor authentication requires something beyond your password to log in, usually a one-time code by text, an authenticator app, or a biometric scan. A stolen password alone is not enough to get through.

Not every MFA method is equal. Text-message codes can be intercepted through SIM-swapping, where a criminal convinces your carrier to move your number to their device. Hardware security keys and passkeys built on the FIDO2 standard resist phishing and remote attacks far better because authentication uses a cryptographic key pair rather than a code that can be intercepted or coaxed out of you.⁷ If your bank supports hardware keys or passkeys, that is the strongest option available.

Behavioral Monitoring

Banks run automated systems that watch login patterns and transactions. A login from an unfamiliar location, a new device, an unusual hour, or a transaction that does not fit your history can trigger an automatic block or a review. These systems run constantly and often flag activity before you would ever notice it.

What to Do the Moment You Spot Something Wrong

Call your bank as soon as you see any transaction you did not authorize. Under Regulation E, a verbal report starts the clock. The bank cannot require written confirmation before it begins investigating, though it may ask for follow-up in writing within 10 business days.⁸

Have this ready when you call:

Your name and account number.
The specific transactions in dispute, with dates and dollar amounts.
Why you believe they were unauthorized.
Any supporting evidence, such as phishing emails, suspicious login alerts, or proof you were elsewhere when the transfers occurred.

The bank may ask you to sign a fraud affidavit. Some request a police report, but federal law does not require one to open the investigation. The regulation says a notice of error needs only your name, account number, and a description of why you believe an error exists.⁸ If a bank refuses to investigate without a police report, cite that provision or escalate.

How Long the Bank Has to Investigate

Regulation E puts hard deadlines on the bank once you report.

The bank has 10 business days to investigate and decide whether an error occurred. If it confirms fraud in that window, it must correct the error within one business day and tell you within three business days.⁸

If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount, plus any lost interest, within 10 business days of your report. It must notify you of the provisional credit within two business days of applying it, and you have full use of those funds during the investigation.⁸ If the bank has a reasonable basis to believe fraud occurred, it may withhold up to $50 from the provisional credit.

The window stretches to 90 days for international transfers, point-of-sale debit card transactions, and transfers on accounts opened within the last 30 days. For those new accounts, the bank also gets 20 business days rather than 10 to issue the provisional credit.⁹

If the bank confirms fraud, the provisional credit becomes permanent and any related fees or interest are refunded. If the bank concludes no error occurred, it can pull the provisional credit back, but only after sending you a written explanation and notice that the credit will be removed.¹⁰

If the Bank Denies Your Claim

A denial is not the end. The written explanation must include a notice of your right to request the documents the bank relied on. Ask for them; the bank must provide copies promptly.¹⁰ Those records often show gaps you can use to push back.

If the bank holds its position after you present additional evidence, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards complaints to the bank and generally requires a response within 15 days. You can also complain to your state attorney general or, for smaller disputes, file in small claims court, where filing fees generally run from $15 to $300 depending on jurisdiction and amount.

Steps That Reduce Your Risk in the First Place

Federal law caps your losses, but preventing an intrusion spares you the cash-flow gap while a claim is investigated.

Turn on the strongest MFA your bank offers. A hardware security key, passkey, or authenticator app beats text-message codes.
Use a unique password for your bank. Reused passwords exposed in unrelated breaches get tested against bank logins automatically.
Review statements regularly. The 60-day clock starts when the bank sends the statement, not when you open it.
Turn on transaction alerts. Instant notifications shrink your response time from weeks to minutes.
Treat unsolicited contact as suspicious. Banks do not call, email, or text asking for your password, PIN, or one-time verification codes.
Lock your SIM. Ask your carrier to add a PIN or port-freeze so a SIM-swap attack cannot capture your text-message codes.

1
eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
2
Office of the Law Revision Counsel. 12 USC 1821 Insurance Funds
3
NCUA. Share Insurance Coverage
4
eCFR. 12 CFR Part 1005 Electronic Fund Transfers – Regulation E
5
Legal Information Institute (Cornell Law School). UCC Article 4A Funds Transfer
6
National Institute of Standards and Technology (NIST). Federal Information Processing Standards Publication 197 – Advanced Encryption Standard
7
FIDO Alliance. Passkeys Passwordless Authentication
8
eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
9
Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors
10
eCFR. 12 CFR 1005.11 Procedures for Resolving Errors