Yes, bank accounts can be hacked, but your money has legal protection

Your bank account can be hacked through phishing emails, malware on your computer, stolen login credentials, or someone gaining access to your email or phone number. Once inside, a hacker can transfer money out, change your password, or lock you out of your own account. The good news: federal law limits your liability for unauthorized transfers, and banks are required to reimburse you under specific conditions.

The speed of recovery depends on how quickly you report the breach and whether the bank can prove the transfer was truly unauthorized. Some transfers reverse within days. Others take weeks or months if the bank investigates whether you authorized the transaction.

Key Takeaways

  • Report unauthorized transfers to your bank within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more.
  • Banks must investigate claims of unauthorized access and either reverse the transfer or prove you authorized it, usually within 10 business days.
  • Hackers most often gain access through phishing emails, reused passwords, or malware that captures your login information.
  • If money was transferred to another bank account, recovery depends on whether that bank cooperates and how quickly you report the theft.
  • Changing your password and enabling two-factor authentication after a breach does not reverse transfers already made.

How hackers access bank accounts

The most common entry point is phishing—a fake email or text message that looks like it came from your bank, asking you to "verify your account" or "confirm your identity." The link takes you to a fake website that copies your bank's login page. You enter your username and password, and the hacker now has both.

Other common methods include malware installed on your computer or phone that records your keystrokes or takes screenshots of your login screen, credential stuffing (using passwords leaked from other websites to try your email address), and SIM swapping, where a hacker convinces your phone carrier to transfer your phone number to a new SIM card they control. Once they have your phone number, they can reset your bank password and intercept two-factor authentication codes.

Weaker entry points include reusing the same password across multiple accounts, using a password that is easy to guess, or leaving your login information written down or saved in an unencrypted file. If your email account is hacked, a hacker can use the password reset feature on your bank's website to lock you out and change your password.

What federal law requires banks to do

The Electronic Funds Transfer Act (EFTA) requires banks to investigate unauthorized transfers and either reverse them or prove you authorized the transaction. The bank must complete its investigation within 10 business days (or 20 business days if the transfer went to another bank). If the bank cannot prove you authorized the transfer, it must put the money back in your account.

Your liability for unauthorized transfers depends on how quickly you report the breach. If you report it within two business days of discovering the unauthorized transfer, your liability is capped at $50. If you wait longer than two business days but report it within 60 days of your statement, your liability can be up to $500. If you wait more than 60 days, you may lose all the money transferred, depending on the bank's policies and state law.

Some banks offer broader protection than the law requires—for example, zero liability for unauthorized transfers if you report them promptly. Check your account agreement or call your bank to learn what protection it offers beyond the federal minimum.

Transfers to other banks take longer to reverse

If a hacker transferred your money to another bank account (either at your bank or at a different bank), recovery is slower and less certain. Your bank must contact the receiving bank and ask it to freeze the account and return the funds. The receiving bank is not legally required to comply, though most do when presented with evidence of fraud.

If the receiving account was opened recently or the receiving bank suspects fraud, the funds may be frozen for 10 to 20 business days while both banks investigate. If the hacker withdrew the money in cash before the account was frozen, recovery becomes much harder—the receiving bank may have no funds to return.

This is why reporting the breach immediately matters. The faster you report it, the faster your bank can contact the receiving bank and freeze the account before the hacker moves the money again.

Steps to take if your account is hacked

Call your bank immediately using the phone number on the back of your card or on your statement—not a number from an email or text message. Tell them you have unauthorized transfers and ask them to freeze your account. Do not use the phone number in any email or text you received, as it may be fake.

Ask the bank to change your password and review your account settings. Hackers often change your password, add a backup email address, or disable alerts so you do not notice further transfers. The bank can reset these and lock out the hacker's access.

Request a written statement of the unauthorized transfers and ask the bank to begin an investigation. The bank will send you a form to sign confirming that you did not authorize the transfers. Keep a copy for your records.

Change your password from a different device (not the computer or phone that may have malware). Use a strong password that is at least 12 characters long and includes uppercase, lowercase, numbers, and symbols. Do not reuse passwords across accounts.

Enable two-factor authentication on your bank account and on your email account. Two-factor authentication requires a second form of verification (usually a code sent to your phone) before anyone can log in, even if they have your password.

Check your credit report for new accounts opened in your name. You can request a free credit report from each of the three major credit bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com. If you see accounts you did not open, contact the credit bureau and the creditor to report fraud.

How to reduce the risk of being hacked

Use a unique, strong password for your bank account—one you do not use anywhere else. If that password is compromised at another website, your bank account remains protected. A password manager like Bitwarden, 1Password, or KeePass can generate and store strong passwords so you do not have to remember them.

Enable two-factor authentication on your bank account and your email account. Text message codes are better than nothing, but an authenticator app (like Google Authenticator or Authy) is more secure because hackers cannot intercept codes sent to an app the way they can intercept text messages through SIM swapping.

Do not click links in emails or texts claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser or calling the number on your card. Banks do not ask you to verify your password or account number by email or text.

Keep your computer and phone updated with the latest security patches. Malware often exploits known vulnerabilities that patches fix. Enable automatic updates if your device offers that option.

Use a reputable antivirus program on your computer and keep it updated. Malwarebytes, Windows Defender (built into Windows), and Bitdefender are widely used options.

What happens during the bank's investigation

When you report unauthorized transfers, your bank will ask you to describe what happened, when you discovered it, and which transfers you did not authorize. The bank will then review the transaction details—the IP address and device used to log in, the time of day, whether the login matched your usual pattern, and whether you were in a different location than usual.

If the bank determines the transfer was unauthorized, it will reverse it and credit your account. If the bank believes you authorized the transfer (for example, because you logged in from your usual device at your usual time), it may deny your claim. You can dispute the bank's decision by asking to speak with a supervisor or by filing a complaint with the Consumer Financial Protection Bureau (CFPB).

The investigation timeline varies. Some banks complete it in 5 to 10 business days. Others take the full 20 business days allowed by law, especially if the receiving bank is slow to respond or if the receiving account is at a different financial institution.

Frequently Asked Questions

How long does it take to get my money back after reporting a hacked account?

Most banks complete their investigation within 10 business days if the money stayed at your bank. If it was transferred to another bank, it can take 20 business days or longer. Some banks credit your account provisionally while they investigate, so you can access the money before the investigation closes. Ask your bank whether it offers provisional credit.

What if the bank says I authorized the transfer?

If you did not authorize it, ask the bank to explain how it reached that conclusion. Request details about the IP address, device, and time of the transfer. If the bank still refuses to reverse it, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will investigate and can pressure the bank to reconsider.

Can I get my money back if I wait more than 60 days to report it?

You may lose all protection under federal law if you wait more than 60 days. However, some banks offer protection beyond the legal minimum, and some state laws provide additional safeguards. Contact your bank immediately and ask what protection applies to your account, even if you are past the 60-day window.

Do I need to close my account after it is hacked?

Not necessarily. Once the bank resets your password and you enable two-factor authentication, your account is secure again. Closing the account can create problems if you have automatic payments or direct deposits linked to it. Keep the account open unless the bank recommends closing it or you discover ongoing fraud.

What if the hacker opened new accounts in my name?

That is identity theft, not just account hacking. Contact the credit bureaus (Equifax, Experian, TransUnion) and ask them to place a fraud alert on your credit file. You can also request a credit freeze, which prevents new accounts from being opened without your permission. File a report with the Federal Trade Commission (FTC) at identitytheft.gov.