Your bank is responsible for unauthorized charges, but you have to report them fast
If someone steals money from your checking account without your permission, your bank must return the funds under federal law — but only if you report the theft within a specific window. The speed of your report determines how much protection you get. Report within two business days and you lose at most $50. Wait longer and your liability can climb to $500 or more, depending on how long you wait and whether the thief drained the account completely.
The bank's job is to investigate and restore your money. Your job is to notice the theft, report it, and provide documentation. This section walks you through what happens at each stage and what you need to do to protect yourself.
Key Takeaways
- Report unauthorized charges to your bank within two business days to limit your loss to $50; waiting longer can raise your liability to $500 or the full amount stolen.
- Contact your bank by phone first, then follow up in writing with a signed statement describing what happened and when you discovered it.
- The bank has ten business days to investigate and either restore your money or explain why they will not.
- If the thief used a debit card, ATM card, or online banking, the timeline and your liability depend on when you report the loss or unauthorized use.
- Freezing your account and changing your passwords stops further theft while the investigation is underway.
How to report the theft to your bank
Call your bank's fraud line immediately — do not wait for the next business day. Most banks have a 24-hour number on the back of your debit card or on their website. Tell them which transactions are not yours, roughly how much money is missing, and when you first noticed the problem. The bank will put a fraud alert on your account and may freeze it to prevent more withdrawals.
After the phone call, send a written statement to your bank within the same day if possible. Write a letter or email that includes your account number, the date you discovered the theft, which transactions were unauthorized, the total amount missing, and your signature. Keep a copy for your records. Some banks have a fraud report form on their website — use that if it is available, because it creates an official record the bank can time-stamp.
Do not assume the phone call is enough. Banks are required to document your report in writing, and having your own written record protects you if there is a dispute later about when you reported the theft or what you said.
What the bank does during the investigation
Once you report the theft, the bank has ten business days to investigate. They will review the transactions you flagged, check whether they match your normal spending patterns, and look at security logs to see how the account was accessed. They may contact merchants where the money was spent, or contact other banks if the money was transferred out.
The bank will also ask you questions: Did you share your PIN or password with anyone? Did you lose your card or notice it missing? Did you use public WiFi when you logged in? Were there any suspicious emails or texts asking for your information? Answer honestly and completely — your answers help the bank determine whether the theft was your fault or theirs.
Within ten business days, the bank must either restore your money or send you a written explanation of why they will not. If they restore the money, it goes back into your account. If they deny your claim, you have the right to dispute it further, though this is rare when the theft is clearly not your doing.
Your liability depends on when you report the theft
Federal law sets your maximum loss based on how quickly you report:
| When You Report | Your Maximum Loss |
|---|---|
| Within 2 business days of discovering the theft | $50 |
| Between 2 and 60 calendar days after discovering the theft | $500 |
| After 60 calendar days from when the statement showing the theft was sent to you | All the money stolen (no limit) |
The clock starts when you discover the theft, not when it happened. If a thief stole from your account three weeks ago but you just noticed it today, you have two business days from today to report it and keep your loss at $50. This is why checking your account regularly — at least weekly — matters.
If your debit card was stolen or lost, the rules are slightly different. Report a lost or stolen card within two business days and you lose at most $50. Report it after two business days but before unauthorized charges appear, and you lose nothing. Report it after charges have already been made, the two-business-day rule applies to those charges.
Steps to take while the investigation is underway
Freeze your account to stop the thief from making more withdrawals. Your bank can do this immediately when you call. A frozen account means no one — not even you — can withdraw money until the freeze is lifted, but it also means the thief cannot drain what is left.
Change your online banking password and any PIN you use at ATMs. If the thief had access to your password, they may still have it. Use a password that is at least 12 characters long and includes numbers, uppercase letters, and symbols. Do not reuse a password you have used anywhere else.
Check your credit report for signs that the thief opened new accounts in your name. You can get a free report from each of the three major credit bureaus — Equifax, Experian, and TransUnion — at annualcreditreport.com. If you see accounts you did not open, contact the bureau and the creditor to report fraud.
If your Social Security number was compromised, consider placing a fraud alert or credit freeze with the credit bureaus. A fraud alert tells creditors to verify your identity before opening new accounts. A credit freeze blocks creditors from accessing your report entirely until you lift it.
What to do if the bank denies your claim
If the bank says the theft was your fault — for example, because you shared your password or used an unsecured device — you can dispute their decision. Send a letter to the bank's fraud department restating your case and explaining why you believe the charges were unauthorized. Include any evidence: emails showing you did not authorize the transaction, proof that you were in a different location when the charge occurred, or documentation that you reported the loss before the charges were made.
If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can order the bank to refund your money if they find the bank violated the law. Filing a complaint does not cost anything and does not require a lawyer.
You can also contact your state's banking regulator or attorney general's office. Each state has an agency that oversees banks licensed in that state, and they can investigate whether the bank followed the law.
How to prevent theft in the future
Check your account at least once a week, either through your bank's app or website. The faster you spot unauthorized charges, the faster you can report them and the more protection you have. Set up account alerts if your bank offers them — many banks will text or email you when a withdrawal over a certain amount occurs, or when your balance drops below a threshold.
Use a strong, unique password for your online banking account. Do not use the same password for your bank account that you use for email, social media, or other websites. If one of those sites is hacked, a thief can use your password to try your bank account.
Never share your PIN, password, or full card number with anyone — not even bank employees. Your bank will never ask for your password. If someone calls or emails claiming to be from your bank and asks for this information, hang up or delete the email and call your bank directly using the number on your card or statement.
Use your bank's app or website to log in, rather than clicking links in emails or texts. Phishing emails and texts look like they come from your bank but actually take you to a fake website designed to steal your login information. When in doubt, go directly to your bank's website or call the number on your card.
Frequently Asked Questions
How long does it take to get my money back?
The bank has ten business days to investigate and decide whether to restore your money. If they approve your claim, the money usually goes back into your account within one to three business days. If they deny it, you can dispute the decision, which can take several weeks.
What if the thief transferred my money to another bank?
The bank will trace the transfer and work with the receiving bank to recover the funds. This takes longer than a simple unauthorized charge — sometimes two to four weeks — but the money can usually be recovered if you report it quickly. The receiving bank is required to cooperate with the investigation.
Can I be held responsible if someone hacked my account?
No, if your account was hacked, the theft is not your fault and the bank must restore your money. You are only liable if you were negligent — for example, if you wrote your password on a sticky note or shared it with someone. Hacking is a security failure on the bank's side, not yours.
Do I need a police report to get my money back?
No, a police report is not required for the bank to investigate and restore your money. However, filing a police report creates an official record of the crime, which can help if you need to dispute the bank's decision later or if the thief is caught. You can file a report online or in person at your local police station.
What if my debit card was used but I did not lose it?
Someone may have copied your card number or used it without physically taking the card. Report the unauthorized charges the same way — call your bank's fraud line and send a written statement. The bank will cancel your card and send you a new one, usually within five to seven business days.