Yes, your bank account can be hacked, but your money has legal protection
Your bank account can be compromised through phishing emails, malware on your device, password reuse, public Wi-Fi, or someone obtaining your login credentials another way. Once inside, a hacker can transfer money out, change your contact information, or lock you out of your own account. The good news: federal law limits your liability for unauthorized transfers, and banks are required to reimburse you under specific conditions.
The speed of recovery depends on how quickly you notice the breach and report it. If you catch it within two business days, your liability is capped at $50. If you wait longer, you could lose up to $500. If you don't report it within 60 days of your statement, you could lose everything taken after that 60-day window—though banks often reimburse anyway as a customer service decision.
Key Takeaways
- Unauthorized transfers from your account are covered by federal law (Regulation E), which caps your liability at $50 if you report within two business days.
- Your liability increases to $500 if you report between two and 60 days after your statement shows the unauthorized transaction.
- You must report the breach to your bank in writing within 60 days of receiving your statement, or you lose protection for anything taken after that date.
- Banks can take 10 business days to investigate and another 3 to 5 days to return your money, so you may be without those funds temporarily.
- Hackers often change your password and recovery email first, so you may not be able to log in even if you notice the breach quickly.
How hackers get into bank accounts
The most common entry points are phishing emails that look like they come from your bank, asking you to "verify your account" or "confirm your identity." You click a link, enter your username and password on a fake website, and the hacker now has both. Phishing works because the email looks real—it uses your bank's logo, mentions recent transactions, or creates false urgency.
Malware on your computer or phone can capture keystrokes as you type your password or intercept one-time codes sent to your phone. Public Wi-Fi networks at coffee shops or airports are unencrypted, so anyone on the same network can see your login credentials if you check your bank account there. Password reuse is another common vulnerability: if you use the same password for your email and your bank account, and your email is breached in a data leak, a hacker can try that password on your bank.
Social engineering—calling your bank pretending to be you, or tricking customer service into resetting your password—is less common but still happens. Some breaches happen on the bank's side, not yours: if the bank's systems are compromised, hackers may obtain account numbers and passwords directly from the bank's database.
What happens immediately after your account is hacked
A hacker's first move is usually to change your password and recovery email so you can't regain access. You may not realize the breach has happened until you try to log in and get an error, or until you see a transaction you didn't make. Some hackers move slowly, making small transfers to test whether the account is monitored. Others move fast, draining the account in one or two large transfers.
The hacker may also change your phone number on file, disable text alerts, or add a new authorized user to the account. If they change your recovery email, you won't receive the bank's security alerts. This is why monitoring your account regularly—at least weekly—matters: you catch the breach before the hacker has time to move large amounts.
Your legal protection under Regulation E
Regulation E is the federal rule that protects you from unauthorized electronic transfers. It applies to transfers made through ATM, debit card, online banking, mobile app, or wire transfer. Your liability depends on how fast you report the breach:
| Reporting Timeline | Your Maximum Liability | What This Means |
|---|---|---|
| Within 2 business days of noticing the breach | $50 | You pay $50; the bank reimburses the rest. |
| Between 2 and 60 days after your statement shows the unauthorized transaction | $500 | You pay up to $500; the bank reimburses the rest. |
| After 60 days from your statement date | No protection | You may lose everything taken after the 60-day window. |
The 60-day clock starts from the date your bank sends you the statement that shows the unauthorized transaction, not from the date the transaction happened. If your statement arrives on the 15th and shows a fraudulent transfer from the 10th, you have until the 14th of the following month to report it.
How to report the breach and what happens next
Call your bank immediately using the number on the back of your debit card or on your statement—not a number from an email or search result, which could be fake. Tell them you have unauthorized transactions and ask them to freeze your account. They will usually do this right away to stop further transfers.
Follow up with a written report within two business days. Most banks accept this by email, secure message through their app, or in person at a branch. Include the date you discovered the breach, the dates and amounts of each unauthorized transaction, and the date you first reported it by phone. Keep a copy for your records.
The bank then has 10 business days to investigate. During this time, they may ask you for more information: recent statements, proof you didn't authorize the transfers, or details about how the breach happened. After 10 days, they must either return your money or tell you in writing why they believe the transfers were authorized. If they need more time, they can extend the investigation to 45 days, but they must return a provisional credit within 10 days while they investigate.
Once the bank confirms the breach was unauthorized, they return your money. This can take another 3 to 5 business days to appear in your account. During the investigation period, you may not have access to those funds, so if the amount is large, ask your bank whether they can issue a provisional credit immediately.
Protecting yourself after a breach
Change your password to something unique—at least 12 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse this password anywhere else. If the hacker also accessed your email, change your email password too, because email is the key to resetting passwords on every other account you own.
Enable two-factor authentication on your bank account if it's available. This means even if a hacker has your password, they can't log in without a code from your phone. Use an authenticator app (like Google Authenticator or Authy) rather than SMS text messages when possible, because hackers can sometimes intercept texts.
Monitor your account weekly by logging in and checking recent transactions. Set up transaction alerts through your bank's app so you're notified of any transfer over a certain amount. Check your credit report at annualcreditreport.com (the only free, official source) to see whether the hacker opened new accounts in your name. You can place a free fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) to make it harder for someone to open new credit in your name.
Use a password manager like Bitwarden, 1Password, or Dashlane to generate and store unique passwords for each account. Avoid checking your bank account on public Wi-Fi; use your phone's cellular data or a home network instead. Keep your device's operating system and antivirus software up to date.
What if the bank refuses to reimburse you
If your bank denies your claim and you believe the transfer was truly unauthorized, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can pressure banks to reverse decisions. You can also file a complaint with your state's banking regulator or attorney general's office.
If the amount is small enough, small claims court is an option, though it requires you to prove the transfer was unauthorized. Keep all documentation: your written report to the bank, the bank's response, screenshots of transactions, and any correspondence about the breach. If the hacker used your account to commit fraud elsewhere (like opening a credit card), you may also need to file a report with the Federal Trade Commission at reportfraud.ftc.gov.
Frequently Asked Questions
Can a hacker drain my entire bank account?
Yes, but you are protected by law if you report it within 60 days. Your liability is capped at $50 if you report within two business days, or $500 if you report between two and 60 days. After 60 days, you lose protection for any transfers made after that window, so the bank may not reimburse you.
How long does it take to get my money back?
The bank has 10 business days to investigate and must issue a provisional credit within that time. Final reimbursement can take another 3 to 5 business days. During the investigation, you may not have access to the disputed funds, so ask your bank for a provisional credit immediately if you need the money.
What if I can't log into my account because the hacker changed my password?
Call your bank's customer service line using the number on your card. Tell them your account has been compromised and you cannot log in. They can verify your identity through other means (last four of your Social Security number, recent transactions, security questions) and reset your password or temporarily unlock your account so you can change it.
Do I need to close my account after it's been hacked?
Not necessarily. Once the bank has reimbursed you and you've changed your password and enabled two-factor authentication, the account is usually safe. However, if you feel uncomfortable keeping it open, you can close it and open a new one. Ask the bank to flag your old account as compromised so they monitor it for any further activity.
What if the hacker used my account to send money to someone else?
Report it to your bank as an unauthorized transfer. The bank will investigate whether the transfer was truly sent from your account without your permission. If confirmed, they will attempt to recover the money from the receiving account. This can take longer than a standard fraud case, sometimes weeks or months, but you are still protected under Regulation E during the investigation.