What bank fraud is and how it reaches you

Bank fraud is when someone uses your account, card, or personal information to move money without your permission. The fraudster might be a stranger who stole your details online, a person with access to your physical mail, someone you know, or even an employee at a business where you gave your information. The money leaves your account or gets charged to your card, and you did not authorize it.

Bank fraud happens through dozens of routes: a data breach at a retailer, a phishing email that looks like your bank, a skimmed card at a gas pump, a stolen checkbook, a call pretending to be from your bank's fraud department, or someone using your Social Security number to open a new account in your name. The common thread is that the fraudster has either your account details or enough of your identity to convince a bank to let them in.

The speed matters. Some fraud is caught within hours. Some sits undetected for weeks or months. The longer it goes, the harder it is to recover the money and the more damage it can do to your credit if accounts are opened in your name.

Key Takeaways

  • Bank fraud includes unauthorized charges on your card, money moved from your checking or savings account without permission, and new accounts opened in your name using your identity.
  • Common entry points are phishing emails and texts, data breaches at stores or websites, skimmed cards, stolen mail, and social engineering calls pretending to be from your bank.
  • Federal law caps your liability at $50 if you report unauthorized card charges within two business days, but waiting longer can raise your liability to $500 or more.
  • Your bank must investigate and respond to your fraud report within 10 business days, and you should receive a written explanation of their findings.
  • Freezing your credit with the three major bureaus stops fraudsters from opening new accounts in your name while you resolve the fraud.

Unauthorized charges on your debit or credit card

A fraudster uses your card number—either because they stole the physical card, skimmed it at a terminal, or obtained the number from a data breach—to make purchases or withdraw cash. You see charges you did not make on your statement. This is the most common type of bank fraud and often the easiest to reverse.

With a credit card, your liability is capped at $50 under federal law, and many issuers waive that entirely. You are not responsible for the fraudulent charges once you report them. The card company investigates and removes the charges from your bill while they look into it.

With a debit card, the rules are stricter and timing matters. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you wait between two and 60 days, your liability jumps to $500. If you wait longer than 60 days, you may lose all the money taken—the bank has no obligation to refund it. Report debit card fraud immediately.

Money moved from your account without authorization

A fraudster gains access to your checking or savings account and transfers money out, sets up recurring payments, or authorizes wire transfers. This can happen if they have your account number and routing number (both printed on your checks), if they convince your bank they are you over the phone, or if they log into your online banking after stealing your password.

Unlike card fraud, unauthorized account transfers are governed by the Electronic Funds Transfer Act. You have 60 days from the date your statement is sent to report the fraud. If you report within that window, the bank must refund the money while they investigate. If you miss the deadline, you lose the right to a refund.

Wire transfers are harder to recover. Once money leaves your account via wire, it is often gone for good. Banks can try to recall it, but if the receiving bank has already released the funds, recovery is unlikely. This is why fraudsters often use wire transfers—they are fast and nearly irreversible.

New accounts opened in your name

A fraudster uses your name, Social Security number, and other personal details to open a credit card, take out a loan, or open a checking account. You do not know this happened until you check your credit report or a debt collector calls about an account you never opened. This is identity theft, and it can damage your credit for years.

The fraudster may use the new account to make purchases, take out cash advances, or simply leave it open with a balance to hurt your credit score. Each new account appears on your credit report and lowers your score. If the account goes unpaid, it shows as a delinquency in your name.

Stopping this requires more than calling your bank. You need to place a credit freeze with Equifax, Experian, and TransUnion—the three major credit bureaus. A freeze prevents anyone, including fraudsters, from opening new accounts in your name. You can place a freeze for free by visiting each bureau's website or calling them directly. The freeze stays in place until you lift it.

Phishing and social engineering

A fraudster sends you an email or text that looks like it came from your bank, asking you to "verify your account," "confirm your identity," or "update your payment method." The message includes a link that takes you to a fake website that looks identical to your real bank's site. You enter your username, password, and other details. The fraudster now has your login credentials and can access your account.

Phishing works because the fake email or text is designed to look urgent and official. It may say your account has been locked, suspicious activity was detected, or your card is about to expire. The goal is to make you click without thinking.

Social engineering is the voice version: a fraudster calls you pretending to be from your bank's fraud department and says suspicious charges were found on your account. They ask you to confirm your account number, PIN, or one-time code sent to your phone. Once you give them that information, they have what they need to access your account or move money.

Your real bank will never ask you to confirm your password, PIN, or full account number over email, text, or phone. If you get a message like this, hang up or delete it. Call your bank directly using the number on your card or statement—not a number from the suspicious message.

Data breaches at retailers and websites

A hacker breaks into a store's or website's payment system and steals credit card numbers, debit card numbers, and sometimes names and addresses. You shopped there once, gave your card information, and now your card number is in the hands of criminals. Months later, you see fraudulent charges.

Major breaches happen regularly at large retailers, payment processors, and online services. When a breach occurs, the company is usually required to notify affected customers. You may receive a letter or email telling you your information was compromised and offering free credit monitoring for a period of time.

Credit monitoring does not prevent fraud—it alerts you after fraud has already happened. A credit freeze is more effective because it stops new accounts from being opened in your name in the first place. If you were affected by a breach, place a freeze with all three bureaus even if you have not seen fraud yet.

What to do if you spot fraud on your account

First, contact your bank or card issuer immediately. Call the number on the back of your card or on your statement—not a number from any email or text you received. Tell them you see unauthorized charges or transfers. They will ask you to describe the fraudulent activity and may freeze your account or cancel your card on the spot.

Second, ask the bank to send you a written explanation of their investigation within 10 business days. Federal law requires them to investigate and respond in writing. Keep this documentation.

Third, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and gives you a recovery plan specific to your situation. The FTC does not investigate individual cases, but the report is useful if you need to dispute charges with creditors or prove to a lender that the fraud was not your fault.

Fourth, if the fraud involved your identity (new accounts opened in your name), place a credit freeze with Equifax, Experian, and TransUnion. You can do this online for free. A freeze typically takes effect within one business day.

Fifth, monitor your credit report. You are may have access to to one free report per year from each bureau at AnnualCreditReport.com. Check for accounts you do not recognize. If you find fraudulent accounts, dispute them with the bureau in writing.

Your rights and the bank's timeline

When you report fraud, your bank must acknowledge your report and begin an investigation. For debit card fraud, they must refund your money within two business days if you reported within the two-day window. For other unauthorized transfers, they must refund the money while they investigate if you reported within 60 days of your statement being sent.

The bank has 10 business days to complete their investigation and send you a written report. In some cases, they can extend this to 45 days if they need more time, but they must notify you and explain why.

If the bank finds the charges were unauthorized, they remove them from your account. If they find the charges were authorized (for example, you gave someone permission and now dispute it), they may not refund you. This is why documentation matters: keep emails, texts, receipts, and any communication related to the disputed charge.

If you disagree with the bank's decision, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. These agencies can pressure the bank to reconsider, though they cannot force a refund.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

For debit card fraud reported within two business days, the bank must refund you within two business days. For other unauthorized transfers, they must refund you while they investigate if you reported within 60 days. The full investigation takes 10 business days, though the bank may extend to 45 days. You should see the money back within a few weeks in most cases.

Can I be held responsible for fraud if someone stole my card?

No, not if you report it. Your liability for a stolen credit card is capped at $50 under federal law, and most issuers waive that. For a debit card, your liability is $50 if you report within two business days. Report any stolen card immediately to limit your exposure.

What is the difference between fraud and identity theft?

Fraud is unauthorized use of your existing account or card. Identity theft is when someone uses your personal information to open new accounts in your name. Identity theft is more damaging because it affects your credit report and can take months to resolve. Both require reporting, but identity theft also requires a credit freeze.

Will my bank refund me if I gave my password to someone and they took money?

Probably not. If you voluntarily gave someone your password or authorized them to access your account, the bank will likely say the transaction was authorized by you. The bank's position is that you are responsible for who you give your credentials to. This is different from fraud, where someone obtained your information without your knowledge.

Do I need to close my account after fraud?

Not necessarily. If your card was compromised, the bank will issue a new card. If your account number was stolen, you can ask the bank to change it or close the account and open a new one. Closing is not required, but some people prefer it for peace of mind. Ask your bank what options they offer.