Your bank covers most unauthorized transfers, but only if you report them fast

If someone accesses your checking account without permission and moves money out, your bank is required by federal law to reimburse you—but the amount depends on how quickly you notice and report it. Under the Electronic Funds Transfer Act (EFTA), your liability is capped at $50 if you report the fraud within two business days of discovering it. If you wait longer, your liability can jump to $500. If you wait more than 60 days after your bank statement arrives, you may not be covered at all for transfers that appear on that statement.

The clock starts the moment you discover the unauthorized activity, not when it happened. Many people don't check their accounts daily, so the two-day window is often shorter than it sounds in practice. The key is reporting to your bank immediately—by phone, through your online banking portal, or in person at a branch. Written notice counts, but calling is faster and creates a record with a timestamp.

Key Takeaways

  • Report unauthorized transfers to your bank within two business days to limit your liability to $50; waiting longer can raise it to $500 or eliminate coverage entirely.
  • Your bank must investigate and return your money while the investigation is ongoing, though they may temporarily reverse the credit if they find the transfer was actually authorized.
  • Debit card fraud has different rules than ACH or wire transfers—debit card disputes are handled under different consumer protections with longer reporting windows.
  • Your bank may deny coverage if they find you were negligent, such as sharing your PIN, writing your password down, or ignoring obvious signs of compromise.
  • Fraudsters often drain accounts slowly over time; checking your account at least weekly catches most fraud before the 60-day statement window closes.

How the two-day and 60-day windows work

The EFTA creates two separate deadlines, and both matter. The first is the two-day window: if you report fraud within two business days of discovering it, your liability is capped at $50. This is the best-case scenario. Business days are Monday through Friday, excluding federal holidays, so a fraud discovered on Friday evening doesn't reset the clock until Monday morning.

The second deadline is 60 days from the date your bank sends you a statement showing the unauthorized transfer. If you report the fraud after 60 days have passed since that statement arrived, your bank may refuse to cover the loss at all. This is why banks emphasize reviewing statements regularly—the 60-day window is your absolute outside limit for any protection.

Between day two and day 60, your liability can be $500. This middle zone is where most people end up if they discover fraud on a Wednesday but don't call until the following Monday, or if they notice something odd but wait a few days to confirm it before reporting.

What happens after you report the fraud

Once you report unauthorized transfers, your bank must begin an investigation. During the investigation, the bank is required to provisionally credit your account—meaning they put the money back while they look into it. This provisional credit is not final; if the bank determines the transfer was actually authorized (for example, if you gave someone access to your account), they can reverse the credit and take the money back.

The investigation typically takes 10 business days for simple cases, though banks can extend it to 45 days if the transfer involved another bank or if the circumstances are complex. You should receive written notice of the investigation's outcome, including whether the bank found the transfer unauthorized and whether you are being reimbursed permanently.

During the investigation, your bank may ask you questions about your account activity, your security practices, and how you discovered the fraud. Answer these questions fully and honestly. If the bank suspects you were negligent—for instance, if you shared your PIN with someone or wrote your password on a sticky note—they may deny coverage even if the transfer was technically unauthorized.

Debit card fraud is handled differently than ACH or wire transfers

If the hacker used your debit card number to make purchases or withdrawals, the rules are different. Debit card fraud is covered under the Fair Credit Billing Act (FCBA) and Regulation Z, which give you more time to report and often more protection. You have up to 60 days from when you first see the fraudulent charge on your statement to report it, and your liability is typically $0 if you report it promptly.

However, if the hacker accessed your account directly and initiated an ACH transfer or wire transfer to another bank account, those are electronic funds transfers under the EFTA, and the stricter two-day and 60-day windows apply. The distinction matters because debit card networks (Visa, Mastercard) often side with consumers more readily than banks do with ACH disputes.

If you are unsure which type of fraud occurred, ask your bank. They can tell you whether the transaction was a card transaction, an ACH transfer, or a wire, and which rules apply.

When your bank might refuse to cover the loss

Banks can deny coverage if they find evidence of negligence on your part. Negligence means you failed to exercise reasonable care with your account security. Examples include sharing your PIN or password with anyone, writing your password down where others could see it, using an obvious password like your birthday, failing to change a default password, or ignoring signs of compromise (like unfamiliar transactions or password reset emails).

Banks can also deny coverage if you authorized the transfer but later claimed it was fraud—for example, if you sent money to someone you met online and later realized you were scammed. That is a civil dispute with the recipient, not bank fraud, and the bank is not required to reverse it. The bank's job is to protect you from unauthorized access to your account, not from your own decisions about who to send money to.

If your bank denies your claim, you have the right to dispute it. Send a written letter to the bank's fraud department explaining why you believe you are may have access to to coverage under the EFTA. Include copies of any evidence—emails showing you did not authorize the transfer, proof that your password was compromised, or documentation of the investigation. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator.

Steps to take immediately after discovering the hack

First, call your bank's fraud line right away. Do not wait for business hours if the fraud was discovered after hours; many banks have 24/7 fraud lines. Have your account number and a list of the unauthorized transactions ready. Tell the bank exactly what you discovered and when you discovered it. Ask the bank to freeze your account to prevent further transfers.

Second, change your online banking password from a different device—not the computer or phone you normally use, in case it is compromised. Use a password that is at least 12 characters long and includes uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used elsewhere.

Third, check whether the hacker changed your contact information (phone number, email address, mailing address). If they did, change it back immediately. Hackers sometimes update contact details so you do not receive alerts about further fraud.

Fourth, enable two-factor authentication on your account if your bank offers it. This adds a second step to logging in, usually a code sent to your phone or generated by an authenticator app. Even if someone has your password, they cannot access your account without this second factor.

Fifth, monitor your account closely for the next 30 to 90 days. Check it at least weekly. Fraudsters sometimes make small test transactions first, then larger ones if they are not caught. Catching a second wave of fraud early keeps you within the two-day reporting window.

How to reduce the risk of your account being hacked

Use a unique, strong password for your bank account—one you do not use anywhere else. If a data breach exposes your password on another website, hackers will try that same password on your bank account. A password manager like Bitwarden, 1Password, or KeePass stores strong passwords securely so you do not have to remember them.

Enable two-factor authentication. Most banks offer it through their online portal. You can choose to receive codes by text, email, or through an authenticator app. Authenticator apps are more secure than text because hackers can sometimes intercept texts through SIM swapping.

Do not use public Wi-Fi to access your bank account. Public networks are easy for hackers to monitor. If you must bank on the go, use your phone's cellular data or a VPN (virtual private network) that encrypts your connection.

Check your account at least weekly. Most fraud is caught within the first few days, and weekly checks keep you well within the two-day reporting window for most unauthorized transfers.

Frequently Asked Questions

What if the hacker transferred money to another bank account—will that bank help me get it back?

Your bank will investigate and attempt to recover the funds, but the receiving bank is not required to return money unless they find evidence of fraud on their end. If the receiving bank is cooperative, they may freeze the account and return the funds. If the receiving bank refuses or if the money has already been withdrawn, recovery becomes much harder. This is why reporting within two days is critical—the faster your bank acts, the better the chance of recovery before the money is spent.

Does my bank cover fraud if I used a weak password?

A weak password alone is usually not considered negligence by the bank, as long as you did not share it or write it down. However, if your password was something obvious like your birthday or your pet's name, and the bank can prove the hacker guessed it, they may argue negligence. Using a strong, unique password protects you both from fraud and from this argument.

What if I do not notice the fraud until after 60 days?

You are not covered under the EFTA for transfers that appear on a statement you received more than 60 days ago. However, you may still have options. Contact your bank and explain the situation; some banks will cover older fraud as a courtesy, especially if the account was clearly compromised. You can also file a complaint with the CFPB, which may pressure the bank to reconsider. But the 60-day window is the legal limit, so prevention through regular account monitoring is essential.

If my checking account is hacked, will my savings account be at risk too?

Not automatically. If the hacker only has access to your checking account, they cannot access your savings account unless you gave them that access or they compromised your online banking login for the entire bank. However, if they have your online banking credentials, they may be able to access all accounts linked to that login. Change your password immediately and check all your accounts for unauthorized activity.

Can I get my money back if the hacker spent it before my bank's investigation ended?

Yes, if the bank finds the transfer unauthorized, you are reimbursed regardless of whether the hacker spent the money. Your bank absorbs the loss, not you. This is why banks take fraud seriously—they have to pay you back. The investigation determines whether the transfer was authorized; if it was not, reimbursement follows.