Your bank is liable for most unauthorized transfers, but you have to report it fast
If someone steals money from your bank account, your bank must return it to you—but only if you report the theft within a specific window. For debit card fraud, you have two business days to report it and lose nothing; after two business days, you can lose up to $50; after 60 days, you lose everything. For ACH transfers and wire transfers, you have 60 days to report the theft. For checks, you have 30 days. The clock starts the moment you notice the unauthorized transaction on your statement or receive your bank's notification.
The bank's obligation to refund you is federal law under Regulation E (for electronic transfers) and the Uniform Commercial Code (for checks). Your job is to report it immediately, in writing, and keep records of everything. The bank will investigate, and if they confirm the theft, they must credit your account within one to ten business days depending on the type of transfer.
Key Takeaways
- Report debit card fraud within two business days to avoid losing money; after 60 days, the bank owes you nothing.
- ACH and wire transfer theft must be reported within 60 days; checks must be reported within 30 days.
- Contact your bank by phone first, then follow up in writing with a signed statement describing what happened.
- Freeze your credit with the three major bureaus (Equifax, Experian, TransUnion) if you suspect identity theft, not just account theft.
- The bank will investigate and refund you within one to ten business days if they confirm the theft was unauthorized.
How to report the theft to your bank
Call your bank's fraud line immediately—do not wait for a statement to arrive. The phone number is on the back of your debit card or on your bank's website. Tell them which transactions are unauthorized and ask them to freeze your account or debit card right away. They will usually cancel your card on the spot and mail you a replacement.
After the phone call, send a written statement to your bank within the same day if possible. Address it to the fraud department and include your account number, the date you discovered the theft, the amount stolen, the date of each unauthorized transaction, and a brief description of how the theft occurred (if you know). Sign and date the letter. Keep a copy for yourself. Some banks let you file a written report through their online portal; if so, take a screenshot of the confirmation.
Your bank will send you a fraud affidavit or dispute form to sign. Complete it and return it within the deadline they give you—usually five to ten business days. This form is your formal statement that the transactions were not made by you and that you did not authorize anyone else to make them.
What the bank investigates and how long it takes
The bank will pull the transaction details: the IP address or device used, the location where the transaction occurred, whether a PIN or password was entered correctly, and whether the thief used your physical card or just your account number. They will also check whether you had reported your card lost or stolen before the fraud occurred. If you had not, the bank may ask why you did not notice sooner.
The investigation usually takes five to ten business days. During this time, the bank may provisionally credit your account while they investigate, meaning you get the money back temporarily but the bank can reverse it if they find evidence you authorized the transaction. Once the investigation closes, the bank will either confirm the fraud and make the credit permanent, or deny your claim and reverse the provisional credit.
If the bank denies your claim, they must send you a written explanation within three business days. This explanation will say why they believe the transaction was authorized—for example, that your PIN was used, or that you made the purchase from your home IP address. You can dispute their decision by responding in writing within 10 days, but the burden is on you to prove you did not authorize it.
Debit card fraud versus account takeover
Debit card fraud means someone used your card number (either a stolen physical card or a card number they obtained online) to make a purchase or withdrawal. The thief does not have access to your account itself. You report the fraudulent transactions, the bank cancels your card, and you get a new one. Your other account features—online banking, automatic payments, linked accounts—remain unchanged.
Account takeover is more serious. The thief has your username, password, and possibly your security questions answered. They can change your password, add themselves as an authorized user, set up new transfers, or change your contact information so you do not receive alerts. If this has happened, you need to change your password immediately (from a different device or computer), contact your bank's account security team, and ask them to review all recent changes to your account.
Account takeover often involves identity theft. If the thief opened new accounts in your name or applied for credit, you will need to place a fraud alert or credit freeze with the three credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts. A credit freeze blocks lenders from seeing your credit report entirely, which prevents new accounts from being opened without your permission. Both are free.
How to place a fraud alert or credit freeze
To place a fraud alert, contact one of the three credit bureaus and they will notify the other two automatically. The alert lasts one year and is free. You can renew it annually if needed.
| Bureau | Phone | Website |
|---|---|---|
| Equifax | 1-800-525-6285 | equifax.com |
| Experian | 1-888-397-3742 | experian.com |
| TransUnion | 1-888-909-8872 | transunion.com |
A credit freeze is stronger but takes longer to lift. You contact each bureau separately and request a freeze. They will send you a PIN or password. When you need to apply for credit, you must contact the bureau, provide your PIN, and ask them to temporarily lift the freeze. This takes 24 to 48 hours. A freeze lasts until you ask the bureau to remove it, and it is free.
What happens if the thief used your information to open new accounts
If the thief opened credit cards, loans, or utility accounts in your name, you have a different problem than account theft. This is identity theft. You will need to file a report with the Federal Trade Commission (FTC) at IdentityTheft.gov. The FTC will create a report you can use to dispute the fraudulent accounts with creditors and credit bureaus.
For each fraudulent account, contact the creditor directly and tell them the account was opened without your permission. Provide your FTC report number. Ask them to close the account and remove it from your credit report. Some creditors will do this immediately; others will require a police report or a signed affidavit. Keep records of every conversation and every letter you send.
File a police report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. You do not need a police report to dispute fraudulent accounts, but having one strengthens your case and creates an official record of the theft. Some creditors will not remove accounts without one.
Protecting your account from future theft
Enable two-factor authentication (2FA) on your bank's online portal. This means you will need to enter a code sent to your phone or email every time you log in from a new device. Even if a thief has your password, they cannot access your account without this second code.
Set up transaction alerts through your bank's app or website. Ask the bank to send you an email or text message every time a transaction over a certain amount is made—for example, every transaction over $1, or every transaction over $100. This way you will know immediately if someone is using your account.
Use a strong, unique password for your bank account—at least 12 characters, with uppercase and lowercase letters, numbers, and symbols. Do not reuse this password on other websites. If one website is hacked, a thief can use your password to try your bank account. A password manager like Bitwarden or 1Password can generate and store strong passwords for you.
Never share your PIN, password, or security questions with anyone, including bank employees. Your bank will never ask for this information by phone, email, or text. If someone claiming to be from your bank asks for it, hang up and call the bank's main number yourself.
Frequently Asked Questions
Can the bank refuse to refund me if I was careless with my password?
No. Under Regulation E, the bank must refund you unless they can prove you authorized the transaction or that you were grossly negligent—meaning you ignored obvious signs of fraud. Simply using a weak password or reusing passwords is not gross negligence. However, if you shared your password with someone and they stole money, the bank may argue you authorized it.
What if the thief transferred money out of my account to another bank?
Report it to your bank immediately. Your bank will contact the receiving bank and ask them to freeze the funds. If the receiving bank acts quickly, they can recover the money. If the thief has already withdrawn it in cash, recovery is much harder. This is why speed matters—report within 24 hours if possible.
Do I have to pay for a new debit card?
No. Your bank must issue a replacement card for free. They may charge you for expedited shipping if you want it faster than standard mail, but the card itself is free. Some banks will overnight a temporary card number you can use immediately while you wait for the physical card.
What if my bank says the fraud was my fault and refuses to refund me?
Ask for their decision in writing and ask them to explain exactly why they believe you authorized the transaction. If you disagree, you can file a complaint with your bank's regulator—usually the Office of the Comptroller of the Currency (OCC), the Federal Reserve, or the Consumer Financial Protection Bureau (CFPB). The CFPB has a complaint portal at consumerfinance.gov.
How long does it take to get my money back?
If the bank confirms the fraud, they must credit your account within one to ten business days. Some banks do it within 24 hours; others take the full ten days. Ask your bank for a timeline when you report the theft. If the bank provisionally credited you while investigating, that money is already in your account—the final credit just makes it permanent.