Your liability depends on when you report the fraud and which account type you have
If someone accesses your bank account without permission and takes money, you are usually not responsible for the full amount — but your liability is not zero, and it depends entirely on how fast you report it. Federal law limits your losses, but only if you act quickly. The moment you notice unauthorized transactions, contact your bank. The difference between reporting within two days and reporting after 60 days can cost you thousands of dollars.
Your bank account is protected under the Electronic Funds Transfer Act (EFTA), a federal rule that caps your liability for unauthorized transfers. The catch: the cap shrinks the longer you wait. Report fraud within two business days and you lose at most $50. Wait more than 60 days and you could lose everything in the account at the time of the fraud — with no protection at all.
Key Takeaways
- Report unauthorized transactions to your bank within two business days to limit your loss to $50; waiting longer raises your liability to $500 or more.
- If you do not report within 60 days of receiving your statement, you lose all federal protection and may be liable for the entire amount stolen.
- Your bank may cover losses beyond the legal limit if you report quickly and the fraud was not caused by your own negligence — but this is their choice, not your right.
- Savings accounts, money market accounts, and checking accounts all have the same EFTA protections; prepaid cards and wire transfers have different rules.
- If your debit card was physically stolen or compromised at a store, call your bank immediately; if your online login was hacked, change your password and contact your bank on the same day.
The federal liability limits and how they work
The EFTA sets three liability tiers based on how quickly you report. If you report within two business days of discovering the fraud, your liability is capped at $50. This is the strongest protection and the reason speed matters. A business day is Monday through Friday, excluding federal holidays — so if you discover fraud on a Friday evening, you have until Monday to report it and stay in the $50 tier.
If you report between two business days and 60 calendar days after your bank sends you a statement showing the unauthorized transaction, your liability jumps to $500. This means if $3,000 was stolen, you pay $500 and your bank covers $2,500. The 60-day clock starts from the date your bank mailed or made available the statement that first showed the fraud — not from the date the fraud occurred. Check your statements the moment they arrive.
If you do not report within 60 days of receiving the statement, you have no federal protection. You could lose the entire amount stolen, and your bank has no legal obligation to refund you. Some banks will still help you if you report after 60 days, but this is a courtesy, not a requirement. Do not count on it.
How to report fraud to your bank immediately
Call your bank's fraud line the moment you notice an unauthorized transaction. Do not use the number on the back of your card if you are calling from that card's phone — scammers sometimes intercept calls to fake fraud lines. Instead, look up the number on your bank's official website or on a recent statement. Most banks have a 24/7 fraud line separate from customer service.
Tell the representative the exact transaction amounts, the dates they posted, and where they occurred if you know. Your bank will ask you to confirm recent legitimate transactions to verify your identity. Be ready to describe your normal spending patterns — this helps them spot what does not belong. Ask the representative to freeze your account or block the debit card immediately. Do not wait for a replacement card to arrive; ask them to disable the current one on the phone.
After you hang up, send a written follow-up. Email or mail a letter to your bank's fraud department stating the date you called, the representative's name if you have it, and a list of the unauthorized transactions. Keep a copy. This creates a paper trail that proves you reported within the required window. Your bank may ask you to sign an affidavit swearing the transactions were not authorized — this is normal and required for them to process a refund.
What happens if your debit card was physically stolen versus your online login
If your debit card itself was stolen or lost, the liability rules are the same, but the fraud usually stops faster. Once you report the card missing, your bank deactivates it and no more transactions can go through. The thief can only use what they already have in hand. Call immediately and the damage is usually limited to a few transactions.
If your online banking login was compromised — someone got your username and password — the situation is more dangerous because the thief has ongoing access. They can transfer money out repeatedly, set up bill pay to send funds to their own account, or change your contact information so you do not see the fraud. Call your bank and ask them to change your password on their end, not yours. Then change it again from a secure device once your bank confirms the account is locked. Ask your bank to review all recent bill pay requests and standing transfers; cancel anything you did not set up.
If your debit card number was stolen but the card itself was not — for example, from a data breach at a store — the liability is still $50 if you report within two days. Your bank will issue a new card and the old number stops working. This is faster to resolve than a full account compromise because the thief cannot access your online banking.
When your bank might refuse to refund you
Your bank can deny a refund if they can prove you were negligent or that you authorized the transaction. Negligence means you did something that made the fraud easier — like writing your PIN on your debit card, sharing your password with someone, or leaving your computer unlocked with your banking app open. If your bank can show you were careless, they can reduce or eliminate your refund, even within the two-day window.
If you authorized the transaction but later claimed it was fraud — for example, you bought something online, received it, and then told your bank it was unauthorized — your bank will investigate and likely deny the claim. They will look at your IP address, device, and browsing history. If it matches your normal pattern, they will assume you authorized it.
Your bank can also refuse if you failed to report the fraud within 60 days. This is not negotiable. Once 60 days pass, you have no legal claim. Some banks have internal policies that extend this window, but you cannot count on it. The law is the floor, not the ceiling.
Protecting your account after fraud occurs
Once your account has been compromised, assume your other passwords are at risk too. Change your password for any other account that uses the same email address or similar credentials. If you reused the same password across multiple sites, change all of them. Use a password manager to generate unique, complex passwords for each account going forward.
Check your credit report for signs of identity theft. You can get a free report from each of the three major bureaus — Equifax, Experian, and TransUnion — once per year at annualcreditreport.com. If someone opened accounts in your name, you will see them here. Place a fraud alert with the bureaus if you see suspicious activity; this makes it harder for a thief to open new accounts using your identity.
Enable two-factor authentication on your bank account if it is available. This means even if someone has your password, they cannot log in without a code sent to your phone or generated by an app. Most banks offer this as an option in their security settings. Turn it on for email too, since email is often the key to resetting passwords on other accounts.
What the EFTA does not cover
Wire transfers, ACH transfers, and checks are not covered by the EFTA. If you send money via wire transfer and the recipient disappears, you have no federal protection. The money is gone. ACH transfers — the kind used for bill pay and direct deposit — have some protections, but they are weaker than debit card fraud. If someone sets up an unauthorized ACH transfer from your account, you have the same two-day and 60-day windows, but your bank may take longer to reverse it because ACH transfers are harder to stop once they leave your bank.
Prepaid cards and gift cards are not covered by the EFTA either. If your prepaid card is hacked, the issuer may refund you, but they are not legally required to. Check your card's terms to see what fraud protection it offers. Cryptocurrency transfers and peer-to-peer payment apps like Venmo or PayPal have their own rules and usually offer less protection than bank accounts.
If you authorized someone to access your account — for example, you gave your roommate your debit card to buy groceries and they spent more than you agreed to — this is not fraud. It is a dispute between you and that person. Your bank will not refund you because you gave permission, even if you did not authorize the specific amount.
Frequently Asked Questions
What if my bank says the fraud was my fault because I used a weak password?
A weak password is not the same as negligence under the EFTA. Negligence means you did something unreasonable, like writing your password down or sharing it. Using a password that is easy to guess is poor security, but it is not negligence in the legal sense. Push back if your bank denies your claim on this basis alone. If they refuse, you can file a complaint with the Consumer Financial Protection Bureau (CFPB).
Can I get my money back if I report fraud after 60 days?
Not under federal law. You lose all EFTA protection after 60 days. Some banks have internal policies that allow refunds after this window, but you have no legal right to one. Call your bank and ask if they will make an exception, but do not expect it. The best outcome is that they investigate and refund you as a courtesy — this happens occasionally but is not may provide.
Does my savings account have the same protection as my checking account?
Yes. Savings accounts, money market accounts, and checking accounts all have the same EFTA protections. The liability limits and reporting windows are identical. The difference is that savings accounts usually have limits on how many withdrawals you can make per month, but this does not affect fraud protection.
What if the thief used my debit card at an ATM to withdraw cash?
ATM withdrawals are covered by the EFTA. Report the unauthorized withdrawal the same way you would report any other fraud. Your liability is still $50 if you report within two days. The bank will reverse the withdrawal and issue you a new card. ATM fraud is actually easier to prove because there is usually video footage of who used the machine.
Should I close my account after it has been hacked?
Not immediately. Keep the account open while your bank investigates and processes your refund. Closing it can slow down the refund because the bank needs an active account to deposit the money. Once the refund clears and you have confirmed all fraudulent transactions are reversed, you can close it if you want. Open a new account at the same bank or a different one, and transfer your direct deposits and bill pay to the new account.