“Is Cash App safe” is usually answered with a shrug about strong passwords, and that misses the thing worth knowing. The app almost certainly will not lose your money to a hacker. The real question is who is holding the balance, under what legal arrangement, and what happens to it if that arrangement breaks.

That question has a documented answer, and it does not come from the app’s marketing. It comes from the FDIC, which publishes exactly what deposit insurance does and does not do for money sitting in a nonbank app, and from the partner bank that issues the card, which publishes a surprisingly blunt description of its own role.

Start with what a payment app legally is

A payment app is not a bank. It is a technology company that holds a ledger and works with banks behind the scenes. The FDIC calls this category nonbank companies, and its guidance on them is not ambiguous.

“It is important to be aware that nonbank companies themselves are never FDIC-insured,” the FDIC writes. “Even if they claim to work with FDIC-insured banks, funds you send to a nonbank company are not eligible for FDIC insurance until the company deposits them in an FDIC-insured bank and after other conditions are met.”

Read that sentence twice, because it contains two separate conditions and most coverage of this topic only mentions the first. The money must actually reach an insured bank. And other conditions must be met after it does.

What pass-through insurance requires

If a nonbank does place your funds at a bank, then in the unlikely event of that bank’s failure you may be eligible for what the FDIC calls pass-through deposit insurance coverage. The insurance flows through the app to you, treating you rather than the app as the depositor.

But the FDIC is clear that this requires work by the company: “after the nonbank places your funds on deposit at a bank, records must be kept to identify who owns the money and the specific amount that each person owns.” Ownership is typically determined by the applicable deposit account agreements and state law, and the FDIC adds that “there are other requirements as well,” advising you to read the disclosures and terms of service carefully to understand whether an account may be eligible.

The standard amount at stake is the usual one. The FDIC insures deposits up to $250,000 per depositor, per FDIC-insured bank, for each account ownership category. Deposits in the same ownership category at the same bank are added together, which is the detail that trips people up when they hold a balance at an app and a separate account at the same partner bank without realising it.

What Cash App’s card issuer says on its own site

Here is where tracing the chain gets interesting, because the partner bank publishes its own description of the relationship, and it is not a marketing document.

Sutton Bank, an FDIC-insured institution in Attica, Ohio listed under certificate 5962 in the FDIC’s BankFind directory, runs a page for Cash App users. Its opening line: “We do not issue, maintain, or provide support for Cash App accounts. Cash App is a service offered by Square.”

Further down, in capitals, the bank sets out the boundary of its responsibility. It states that it does not issue, maintain or service your Cash App account, which is offered by a separate company it is not affiliated with, and that if you access funds in your Cash App account by any means besides using your Cash Card, including peer-to-peer payment, “you agree that we will not be responsible for any and all manner of inaccuracy, delay, theft, or other loss of funds that may result.”

Then comes the line that answers the whole question mechanically. “Sutton Bank issues the Cash Card. Sutton Bank does not issue or support Square Cash App, which is a product of Square, Inc. If funds are available, your Cash Card account is loaded with funds from your Cash App when you use your card in making purchases or ATM withdrawals. At all other times, your Cash Card account has a zero ($0) balance.”

And the confirmation: “Your Cash App transaction history is NOT accessible through our Online Banking service, as your Cash App account is not held with Sutton Bank.”

Where the coverage starts and where it stops

Put the two documents side by side and the picture is coherent rather than alarming.

The card account at the issuing bank is not where your balance lives. It is a conduit that is funded at the moment you spend and sits at zero the rest of the time. Your app balance is held under whatever arrangement the app’s own disclosures describe, and the FDIC’s position is that it is not insured until it reaches an insured bank and the record-keeping and other conditions are satisfied.

The hard boundary is the one the FDIC states directly: “FDIC deposit insurance does not protect against the insolvency or bankruptcy of a nonbank company.” Its deposit insurance page says the same thing in general terms, that coverage does not extend to default or bankruptcy of any non-FDIC-insured institution. If the app company fails, consumers may be able to recover some or all of their funds through an insolvency or bankruptcy proceeding, often handled by a court, and the FDIC warns that such recovery may take some time.

That is the practical risk. Not theft. Delay, and a court process, on money you were counting on this month. The FDIC even spells out the implication: be particularly careful about where you place funds you rely on to meet regular day-to-day living expenses.

The risk insurance was never going to cover

Deposit insurance answers one question, bank failure, and people bring it to a completely different one. Most money lost through payment apps is not lost to a failed bank. It is lost to a payment the account holder authorised.

Nacha’s rundown of common scams maps onto app payments almost perfectly. Phishing messages that imitate your bank or a trusted company and push you toward a link. Imposter scams. Fake job offers. Romance scams, where Nacha’s advice is simply not to send money to someone you have never met in person. Money mule schemes, where someone asks you to move funds as a favour or as a job, and Nacha’s rule is to never agree to move money or packages for someone you do not know. Deepfaked voices and video of a boss or a family member asking for an urgent transfer.

None of that is an insurance question. A payment you authorised is a payment you made, and the FDIC’s own scam guidance is blunt about the consequence: if you send money to a scammer or fraudster, it may be difficult or impossible to recover.

How to check any app for yourself

The method generalises, which is more useful than any single verdict about one app.

Identify the bank. The FDIC’s advice is that if a nonbank claims to offer access to FDIC-insured products, you should identify the specific insured bank or banks where it says it will deposit your funds. Then confirm that bank using BankFind, the FDIC’s directory, which also records banks’ website URLs so a listed URL is a signal the site is genuinely run by a bank.

Read the conditions, not the headline. The phrase to hunt for in an app’s disclosures is what triggers eligibility, because pass-through coverage in these arrangements is routinely conditional on holding a particular product or using a particular feature. Meeting the condition is what moves your money into the insured bucket.

And if you are unsure, the FDIC staffs a line for exactly this. You can call 877-ASK-FDIC (877-275-3342), 8:00 am to 6:00 pm ET Monday through Friday, or 8:00 am to 1:00 pm ET Saturday, and ask whether you are dealing with an insured bank.

So where should the balance actually live?

Treat a payment app as a wallet, not a vault. A wallet holds what you are about to spend. What you are not about to spend belongs somewhere it is unambiguously insured and unambiguously earning, and the deposit insurance question there has a one-word answer rather than a paragraph of conditions.

That means a real deposit account: a high-yield savings account chosen on the rate, an online bank account you can move money out of in a day, a named account like SoFi’s if you want one specific comparison, or a money market account for a larger balance. If you would rather the institution answered to its members than to shareholders, a credit union carries equivalent federal protection through a different agency.

Then size the wallet deliberately. The amount that belongs in an app is the amount you are genuinely about to spend, which falls out of a written budget rather than out of habit, and any money earmarked for a known future cost belongs in a sinking fund instead of drifting in a balance that earns nothing. The rest of how money actually moves between accounts is worth understanding for the same reason.

So: is Cash App safe? Safe enough to spend from, on the evidence its own partner bank publishes. Not a place to store money, on the evidence the FDIC publishes. Those are two different questions, and only the second one has ever cost anyone their savings.