How to know your account has been compromised
A hacked bank account usually shows itself through transactions you did not make, login attempts from places you were not, or a sudden inability to log in at all. Check your account history for withdrawals, transfers, or purchases that are not yours. If your bank has sent you a fraud alert or frozen your account, that is a sign someone else accessed it.
You may also notice that your email or phone number has been changed in your account settings, or that you are receiving password reset emails you did not request. Some people discover the hack only when a bill payment fails because funds were already moved out, or when a collection agency calls about charges they never made.
The sooner you act after noticing something wrong, the better your chances of stopping further damage and recovering money. Most banks have time limits on how long you can report fraud — usually 30 to 60 days from when the statement showing the fraudulent transaction was sent to you.
Key Takeaways
- Call your bank immediately using the number on the back of your card or your statement, not a number from a search result, to report the hack and freeze your account.
- Your bank is responsible for refunding fraudulent transactions if you report them within 30 to 60 days of the statement date, though the timeline varies by bank and transaction type.
- File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record if you need to dispute charges or deal with identity theft later.
- Change your password and enable two-factor authentication on your bank account and any email addresses linked to it once your account is secure.
- Monitor your credit report and consider placing a fraud alert or credit freeze with the three major credit bureaus to prevent someone from opening new accounts in your name.
Stop the bleeding: what to do in the first hour
Call your bank immediately. Use the phone number on the back of your debit or credit card, or on your most recent statement — do not use a number from a search result, as scammers sometimes create fake bank phone lines. Tell them your account has been compromised and ask them to freeze it right away. This stops the hacker from making more transfers or withdrawals while you sort out what happened.
If you cannot reach your bank by phone, log into your account online (if you can still access it) and look for a fraud or security alert option. Most banks have a way to report suspicious activity through their website or app. If you cannot log in at all, that is actually a sign to call even faster — the hacker may have already changed your password.
Ask your bank to send you a new debit card and a new PIN. Do not use the old card or PIN again, even if your account is unfrozen. Your bank will usually mail a replacement card within 5 to 10 business days, though some offer expedited shipping for a fee.
What your bank will refund and when
Your bank is responsible for refunding fraudulent transactions on a debit card if you report them within 30 to 60 days of the statement date showing the fraudulent charge. The exact timeline depends on your bank and the type of transaction. Unauthorized transfers out of your account are treated the same way — the bank must refund them if you report promptly.
The refund process usually takes 10 business days, though some banks move faster. Your bank will investigate by looking at the transaction details, the IP address or device it came from, and whether you had authorized access to that account at the time. If the bank determines the transaction was truly fraudulent, they credit your account.
If you wait longer than 60 days to report, your bank may refuse to refund the transaction, depending on state law and the bank's own policy. This is why reporting immediately matters. Keep records of when you discovered the fraud, when you called the bank, and what the bank told you — you may need these details later if a dispute arises.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report about the hack. This is a free service run by the Federal Trade Commission. You will answer questions about what happened, which accounts were affected, and what fraudulent charges appeared. The FTC creates an official record that you can use if you need to dispute charges with your bank or credit card company later.
The report also generates a recovery plan with specific steps based on your situation. If the hacker opened new accounts in your name or made charges to credit cards you did not authorize, the FTC report becomes proof that you reported the fraud, which helps when you contact those companies to dispute the charges.
You do not need to file a police report to file with the FTC, though you can do both. The FTC report is usually enough for banks and credit card companies to take your dispute seriously.
Secure your account and linked email addresses
Once your bank account is frozen and you have reported the fraud, change your password. Make it at least 12 characters long and include uppercase letters, lowercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you used the same password on other accounts, change those too — hackers often try the same login credentials on multiple sites.
Enable two-factor authentication on your bank account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this as an option in account settings under "Security" or "Login."
Check the email address linked to your bank account. If the hacker changed it, change it back to an email you control. Then go to that email account and change its password too, and enable two-factor authentication there as well. A hacked email is often how hackers reset passwords on other accounts, so securing your email is critical.
Monitor your credit and consider a fraud alert or freeze
Request a free copy of your credit report from each of the three major credit bureaus — Equifax, Experian, and TransUnion. You can get one free report per year from each bureau at AnnualCreditReport.com. Look for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you find fraudulent accounts, contact the bureau and the creditor to dispute them.
Consider placing a fraud alert with each bureau. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. You only need to contact one bureau — they will notify the other two automatically.
If you want stronger protection, you can place a credit freeze with each bureau. A freeze prevents anyone, including you, from opening new accounts using your credit report until you lift the freeze. This takes more steps but offers more protection. Freezes are free in most states and last until you remove them.
What to do if the hacker opened new accounts
If the hacker used your information to open credit cards, loans, or other accounts in your name, contact each creditor directly. Explain that the account was opened fraudulently and provide your FTC report number. Ask the creditor to close the account and remove it from your credit report.
Send a written dispute to each creditor. Include a copy of your FTC report, a copy of your government-issued ID, and a letter explaining that you did not open the account. Send it certified mail with return receipt so you have proof the creditor received it. Keep copies of everything.
The creditor must investigate within 30 days and tell you the results. If they determine the account was fraudulent, they will close it and remove it from your credit report. If they do not respond or refuse to remove it, you can file a complaint with the Consumer Financial Protection Bureau.
Frequently Asked Questions
How long do I have to report fraud to my bank?
Most banks require you to report fraudulent transactions within 30 to 60 days of the statement date showing the charge. After that window closes, the bank may refuse to refund the transaction. Check your bank's specific policy in your account agreement or by calling customer service.
Will my bank refund money the hacker stole?
Yes, if you report the fraud within 30 to 60 days. Your bank is responsible for refunds on unauthorized debit card transactions and transfers. The refund usually takes 10 business days, though some banks are faster. If you wait longer than the deadline, the bank may not refund you.
What if the hacker used my bank account to pay someone else's bill or loan?
Report it to your bank as an unauthorized transfer. Your bank will investigate and refund the money if they confirm it was fraudulent. You may also need to contact the company that received the payment to explain the situation, though your bank's refund is your primary protection.
Do I need to close my bank account after a hack?
Not necessarily. If your bank freezes the account and issues you a new card and PIN, you can usually keep the account open. However, if you feel unsafe or the bank recommends it, you can close the account and open a new one. Ask your bank whether closing will affect any automatic bill payments or direct deposits you have set up.
Can I get my money back if I report the fraud after 60 days?
It depends on your bank and your state. Some banks refund fraud even after 60 days if you can show you had a good reason for the delay. Contact your bank and explain your situation — they may make an exception. If they refuse, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau.