The most common threats to your checking account and how they work

Your checking account can be compromised in several ways, and the method matters because it changes what you need to do to stop it. Debit card fraud happens when someone uses your card number without permission—either online, over the phone, or by cloning your physical card. Account takeover is different: a person gains access to your actual account login and can transfer money out, change your password, or add themselves as an authorized user. Check fraud involves forged or stolen checks written in your name. ACH fraud uses your routing and account number to pull money directly from your account through the automated clearing house system.

Phishing emails and texts that look like they come from your bank are the most common entry point. They ask you to "verify" your account, click a link to "confirm" a transaction, or update your information. If you click and enter your login credentials on a fake website, the attacker now has access to your real account. Phone calls claiming to be from your bank or the IRS work the same way—they create urgency and ask you to confirm sensitive information.

Key Takeaways

  • Never click links in unsolicited emails or texts claiming to be from your bank; instead, call the number on your debit card or log in directly to your bank's website.
  • Enable multi-factor authentication on your checking account so that even if someone has your password, they cannot log in without a code sent to your phone or email.
  • Monitor your account weekly by logging in directly to your bank's website or app, not through links sent to you, and report any unfamiliar transactions within 60 days.
  • Your bank is responsible for most debit card fraud if you report it quickly, but you lose protection if you wait more than 60 days after your statement arrives.
  • A strong, unique password for your bank account—one you do not use anywhere else—stops most account takeovers before they start.

Set up multi-factor authentication on your bank account

Multi-factor authentication (MFA) requires a second proof of identity beyond your password. After you enter your password, your bank sends a code to your phone via text or email, or generates one in an authenticator app. You must enter that code to log in. Even if an attacker has your password, they cannot access your account without that second factor.

Most banks offer this as an option in your account settings under security or login preferences. Some call it "two-factor authentication" or "two-step verification." Turn it on immediately. If your bank offers a choice between text message codes and an authenticator app like Google Authenticator or Authy, the app is more secure because text messages can be intercepted, but text is far better than nothing.

Create a strong, unique password and store it safely

Your bank password should be at least 12 characters long and include uppercase letters, lowercase letters, numbers, and symbols. More importantly, it should be completely different from passwords you use anywhere else. If you reuse the same password across multiple websites and one of those websites gets hacked, attackers will try that password on your bank account.

Write your password down in a physical notebook kept in a safe place at home, or use a password manager like Bitwarden, 1Password, or Dashlane. These tools generate strong passwords and remember them for you so you do not have to. Do not store passwords in your phone's notes app, email, or browser autofill—those are easy targets if your phone or computer is compromised.

Recognize and avoid phishing attempts

Phishing messages create false urgency: "Your account has been locked," "Confirm your identity now," "Unusual activity detected." Real banks rarely ask you to click a link in an email or text to handle account issues. If you receive a message claiming to be from your bank, do not click any links. Instead, call the number on the back of your debit card or go directly to your bank's website by typing the address into your browser.

Check the sender's email address carefully. Scammers use addresses that look similar to legitimate ones—for example, "support@bankofamerica-verify.com" instead of an actual Bank of America domain. Hover over links (without clicking) to see where they actually go. If a text message asks you to click a link, it is almost certainly phishing; your bank will not contact you that way about account issues.

Never give your full account number, PIN, password, or Social Security number to anyone who contacts you first, even if they claim to be from your bank. Your bank already has this information and will never ask for it unsolicited.

Monitor your account regularly and report fraud quickly

Log into your checking account at least once a week through your bank's official website or app. Look for transactions you do not recognize. Check your pending transactions—these are charges that have been authorized but not yet posted to your account. If you see something unfamiliar, contact your bank immediately by calling the number on your debit card.

Your protection against debit card fraud depends on how fast you report it. If you report unauthorized charges within two business days of discovering them, your liability is capped at $50. If you report within 60 days of your statement arriving, your liability is capped at $500. After 60 days, you may not be protected at all. For account takeover (when someone logs into your account), report it as soon as you notice it; the faster you act, the better your chances of recovering the money.

Freeze your credit if your account is compromised

If your checking account is hacked or you discover fraud, place a credit freeze with all three credit bureaus: Equifax, Experian, and TransUnion. A credit freeze prevents anyone from opening new accounts in your name, even if they have your Social Security number and other personal information. You can place a freeze for free by visiting each bureau's website or calling them directly.

A freeze does not affect your existing accounts or your credit score. It simply stops new credit from being opened without your permission. You can temporarily lift the freeze if you need to open a new account yourself. This step is especially important if the fraud involved your Social Security number or if you suspect identity theft beyond just the checking account.

Use additional security features your bank offers

Many banks offer transaction alerts that notify you by text or email when money leaves your account. Set these up for any transfer over a certain amount—for example, $100 or $500, depending on your comfort level. Some banks also let you set spending limits on your debit card or temporarily lock it through their app if you lose it.

Ask your bank whether they offer a separate online banking password from your debit card PIN, and use different passwords for each. Some banks allow you to set up a list of trusted devices; if you log in from a new device, you must verify it first. These features add layers that make it harder for attackers to move quickly even if they have one piece of your information.

What to do if your debit card is lost or stolen

Call your bank immediately using the number on your statement or the back of another card—not a number from an email or text. Report the card lost or stolen and ask them to cancel it and issue a replacement. Most banks can do this in minutes. Your bank will send a new card to your address, usually within 5 to 10 business days.

While you wait for the new card, you can still access your money through ATMs using your PIN, through online banking, or by visiting a branch in person with your ID. Ask your bank if they can issue a temporary card number or expedite the replacement card for a fee. Do not assume that canceling the card stops all fraud—monitor your account for unauthorized charges that may have been authorized before you reported it.

Frequently Asked Questions

What should I do if I see a charge I do not recognize?

Call your bank immediately using the number on your debit card. Do not use a number from the email or text that alerted you. Tell them the charge is unauthorized and ask them to dispute it. They will typically reverse the charge within a few days while they investigate, and you should see the money back in your account within one to two weeks.

Can my bank hold me responsible for fraud if I did not share my password?

For debit card fraud (someone using your card number without permission), your liability is limited to $50 if you report it within two days, and $500 if you report within 60 days. For account takeover (someone logging into your account), your protection depends on how quickly you report it and whether you took reasonable steps to protect your password. Report any unauthorized access immediately.

Is it safe to use public Wi-Fi to check my bank account?

Public Wi-Fi is not secure, and attackers can intercept your login information. Avoid checking your bank account on public Wi-Fi networks. If you must, use a VPN (virtual private network) app like ProtonVPN or Mullvad to encrypt your connection. Better yet, wait until you are on a secure network at home or use your phone's cellular data instead.

What is the difference between a credit freeze and a fraud alert?

A fraud alert tells credit bureaus to contact you before opening new accounts in your name, but lenders can still open accounts if they cannot reach you. A credit freeze blocks new accounts entirely unless you lift it. A freeze is stronger protection and is free. Place a freeze if you suspect identity theft; use a fraud alert if you want a lighter touch.

How often should I check my bank statements?

Check your account at least once a week by logging into your bank's website or app directly. Look at both posted transactions and pending ones. Review your official monthly statement when it arrives. The sooner you spot fraud, the sooner you can report it and stay within the 60-day window for full protection.