What happens when someone hacks your bank account
A hacked bank account means someone has gained unauthorized access to your login credentials, account information, or the account itself—and is using it to move money, make purchases, or gather your financial data. The hacker may have obtained your password through phishing (fake emails or texts), malware on your device, a data breach at a company that stored your information, or by guessing a weak password. Once inside, they can drain your account, open new accounts in your name, or use your information to commit identity theft.
The speed matters. If you catch the hack within hours, your bank can often freeze the account and reverse unauthorized transactions. If weeks pass, recovery becomes harder because the money may be gone and the trail grows cold. Your bank account is also the gateway to other accounts—email, social media, investment accounts—so a compromised bank login can cascade into much larger damage.
Key Takeaways
- Contact your bank immediately by phone (use the number on your card, not a number from an email) if you notice unauthorized transactions or cannot log in.
- Your bank is required to reverse most fraudulent transactions if you report them within 60 days, though faster reporting increases your chances of full recovery.
- Change your password from a different device, enable two-factor authentication, and monitor your credit report for accounts opened in your name.
- File a report with the Federal Trade Commission at IdentityTheft.gov if the hack involved identity theft or multiple accounts, not just the bank account itself.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) prevents a hacker from opening new accounts in your name while you recover.
Signs your bank account has been hacked
The most obvious sign is a transaction you did not make. Check your account statement weekly—most banks let you view transactions online within 24 hours of posting. Look for small charges first; hackers sometimes test stolen credentials with a $1 or $5 purchase before attempting larger transfers. You may also notice login alerts from unfamiliar locations or devices, or discover you cannot log in because the password has been changed.
Less obvious signs include unexpected emails from your bank about account changes you did not request, a sudden drop in your balance with no clear cause, or calls from creditors about accounts you never opened. If your email account is also compromised, you may not see the bank's fraud alerts at all—the hacker can intercept them. This is why monitoring your actual account balance matters more than relying on email notifications alone.
What to do in the first 24 hours
Call your bank immediately using the phone number on the back of your debit or credit card—not a number from an email or text, which could be fake. Tell them you believe your account has been compromised. They will ask you to verify your identity (usually your Social Security number, date of birth, and recent transactions you recognize) and then freeze the account to stop further unauthorized activity.
Request that your bank cancel your current debit card and issue a new one. They can usually do this over the phone, and the new card arrives within 5 to 10 business days. Ask them to flag your account for fraud monitoring and to provide you with a written summary of all unauthorized transactions—you will need this for your dispute claim and for filing a report with the Federal Trade Commission.
Change your password from a different device (a phone or computer the hacker has not accessed). Use a password manager to generate a strong, unique password—at least 12 characters, mixing letters, numbers, and symbols. Do not reuse passwords across accounts. If you used the same password for your email, social media, or other financial accounts, change those too.
How banks handle fraudulent transactions
Federal law requires banks to reverse most fraudulent transactions if you report them within 60 days of the statement date. For debit cards, your liability is capped at $50 if you report within two business days, and $500 if you report within 60 days. After 60 days, you may not recover anything. Credit cards offer stronger protection—your liability is capped at $50 regardless of when you report, and many issuers waive even that.
The bank's fraud department will investigate by reviewing the transaction details, your account history, and whether the transaction matches your normal spending patterns. They may contact merchants to verify whether the charge was legitimate. This investigation typically takes 10 business days, though complex cases can take up to 45 days. During this time, the bank may provisionally credit your account while they investigate, meaning you get the money back temporarily but could lose it again if they determine the transaction was actually authorized.
Document everything. Keep copies of emails from your bank, the fraud report number they give you, and a timeline of when you discovered the hack and when you reported it. If the bank denies your dispute, you can escalate to your state's banking regulator or file a complaint with the Consumer Financial Protection Bureau.
Protecting yourself from future hacks
Enable two-factor authentication (also called 2FA) on your bank account. This requires a second form of verification—usually a code sent to your phone or generated by an authenticator app—when you log in from a new device. It is the single most effective defense against account takeover, because a hacker with only your password cannot get in without also controlling your phone or authenticator app.
Use a password manager like Bitwarden, 1Password, or Dashlane to store unique passwords for every account. Reusing passwords is how one data breach compromises multiple accounts. A password manager generates and remembers strong passwords so you do not have to.
Monitor your credit report for accounts opened in your name. You can check your report for free once per year at AnnualCreditReport.com. If you see accounts you did not open, contact the creditor and the credit bureau immediately. Consider placing a credit freeze with Equifax, Experian, and TransUnion—this prevents anyone, including you, from opening new accounts in your name without unfreezing first. A freeze is free and takes about 15 minutes per bureau.
Be skeptical of emails and texts claiming to be from your bank. Banks do not ask you to confirm passwords or account numbers via email. If you receive a suspicious message, do not click links or download attachments. Instead, call your bank directly using the number on your card.
What to do if your identity was stolen, not just your account
If the hacker opened new accounts in your name—credit cards, loans, utility accounts—you are dealing with identity theft, not just account compromise. File a report with the Federal Trade Commission at IdentityTheft.gov. The FTC will create an Identity Theft Report, which you can use to dispute fraudulent accounts with creditors and credit bureaus. This report carries legal weight that a police report alone does not.
Contact each creditor that has a fraudulent account in your name. Provide them with your FTC Identity Theft Report and ask them to close the account and remove it from your credit report. Keep records of every call and email. Send disputes in writing (certified mail with return receipt) so you have proof of when you reported it.
Place a fraud alert with the three credit bureaus. A fraud alert lasts one year and requires creditors to verify your identity before opening new accounts. You can place it for free by contacting one bureau; they are required to notify the other two. After one year, you can renew it or upgrade to a credit freeze, which is stronger but requires you to unfreeze temporarily when you want to open a legitimate new account.
Recovering money and your timeline
The speed of recovery depends on how quickly you reported the hack and how the money left your account. If the hacker transferred money to another bank account, your bank can sometimes recall the transfer within 24 hours if the receiving bank cooperates. If the money was spent at merchants, recovery is slower because the merchant must refund the charge to the card network, which then credits your account—this can take 5 to 10 business days.
If the hacker withdrew cash at an ATM, recovery is nearly impossible because there is no merchant to dispute with and no transaction record to reverse. This is why the first 24 hours matter: the sooner you freeze the account, the less time the hacker has to convert your money into cash.
Keep a timeline of events: when you first noticed the hack, when you called your bank, what the bank told you, when they froze the account, and when they issued a new card. If recovery stalls, this timeline helps you escalate to your state banking regulator or file a complaint with the Consumer Financial Protection Bureau.
Frequently Asked Questions
Can I get my money back if I wait a week to report the hack?
Yes, but your chances are lower. Federal law gives you 60 days to report, but banks investigate faster and recover money more easily when you report within 24 to 48 hours. If the hacker has already moved the money to another account or spent it, waiting longer makes recovery harder because the trail grows cold and the funds may be gone.
What if my bank says the transaction was authorized and refuses to refund it?
Request a written explanation of why they denied your dispute. If you disagree, file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau. You can also dispute the charge with your credit card company if you used a credit card instead of a debit card—credit cards offer stronger fraud protection.
Do I need to close my bank account after a hack?
Not necessarily. Your bank will issue a new debit card and can monitor the account for further fraud. However, if you feel unsafe or if the bank cannot explain how the hack happened, closing the account and opening a new one at a different bank is reasonable. Ask your bank to close the old account in writing so there is no record of it being open.
Will my bank account hack affect my credit score?
A bank account hack alone does not affect your credit score because banks do not report account takeovers to credit bureaus. However, if the hacker opened new credit accounts in your name, those accounts will appear on your credit report and damage your score. Dispute those accounts immediately and monitor your credit report monthly until they are removed.
What is the difference between a credit freeze and a fraud alert?
A fraud alert lasts one year and requires creditors to verify your identity before opening new accounts, but they can still open them. A credit freeze blocks new accounts entirely unless you unfreeze first. A freeze is stronger but requires you to unfreeze temporarily when you want to open a legitimate account. Both are free.