Check your account statements and recent transactions first

Open your bank's app or website and look at your last 30 to 90 days of transactions. Search for charges you don't recognize—small ones especially, because fraudsters often test stolen cards with $1 to $5 purchases before attempting larger amounts. Look for merchant names you don't know, charges from places you've never been, or duplicate transactions that shouldn't exist.

If you see unfamiliar activity, write down the exact amount, date, and merchant name. Don't assume a charge is legitimate just because the amount is small or the name is vague. Scammers use generic-sounding business names on purpose.

Check your pending transactions too—these are charges that have posted to your account but haven't fully cleared yet. Some fraudulent transactions sit in pending status for a day or two before they disappear or complete, so catching them early gives you more time to act.

Key Takeaways

  • Review your last 30 to 90 days of transactions for charges you don't recognize, including small test purchases under $5.
  • Contact your bank immediately if you spot fraud—most banks have a fraud line that answers outside normal business hours.
  • Your bank will freeze your account, cancel your debit card, and investigate the fraudulent charges while you wait for a new card to arrive.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have documentation if the fraud spreads to other accounts or credit lines.
  • Change your online banking password and enable two-factor authentication as soon as your account is secured.

Look for signs of unauthorized access to your account settings

Log into your bank's website or app and check your account settings. Look for a phone number, email address, or mailing address that isn't yours. Fraudsters sometimes change these details so they can intercept statements, password reset links, or fraud alerts before you see them.

Check your linked accounts and authorized users. If someone else's name appears as an authorized user or if you see bank accounts or payment apps linked that you didn't set up, that's a sign of compromise. Also review any recent login activity if your bank displays it—most banks show the date, time, and device type of recent logins. Logins from cities you've never visited or at times you were asleep are red flags.

Some banks let you see which devices are currently logged into your account. If you see a device you don't recognize, that means someone else has your password and is actively using it.

Call your bank's fraud line immediately

Don't email, don't use the chat feature, and don't wait until business hours. Call the fraud phone number on the back of your debit card or on your bank's website. Most major banks have a 24-hour fraud line. When you call, have your account number and the fraudulent transactions written down so you can give exact amounts and dates.

Tell the representative you believe your account has been compromised and describe what you found. The bank will ask you to confirm recent legitimate transactions to verify your identity. Once confirmed, they will freeze your account immediately to stop further unauthorized charges. They will also cancel your debit card and order a replacement, which typically arrives in 5 to 10 business days.

Ask the representative to flag your account for fraud monitoring and to note in your file that you reported this. Request a case number for your records. Some banks will also place a temporary fraud alert on your credit report, which makes it harder for someone to open new accounts in your name.

Dispute the fraudulent charges with your bank

After you've reported the fraud by phone, your bank will send you a dispute form or allow you to file disputes through your online account. For each fraudulent transaction, you'll state that you did not authorize it. The bank will then investigate—they contact the merchant, review the transaction details, and determine whether to refund you.

Most banks refund fraudulent debit card charges within 10 business days if you report them quickly. If you wait more than 60 days, your protection is weaker and the bank may not refund you at all. Credit card fraud has stronger legal protection than debit card fraud, so if you used a credit card instead, your liability is capped at $50 by federal law.

Keep copies of everything: the dispute form you submitted, the case number from your fraud report, and any emails or letters from the bank about the investigation. If the bank denies a dispute, you'll need this documentation to escalate.

File a report with the Federal Trade Commission

Go to IdentityTheft.gov and file a report about the fraud. This creates an official record that you reported the incident, which matters if the fraud spreads to other accounts or if someone tries to open credit lines in your name later. The FTC doesn't investigate individual cases, but the report goes into a database that law enforcement can access.

When you file, you'll describe what happened and list the fraudulent transactions. The FTC will give you a recovery plan and a case number. Print or save this—you may need it if you have to dispute charges with other companies or if you need to prove to creditors that you were a victim of fraud.

Change your password and enable two-factor authentication

Once your account is frozen and your card is canceled, change your online banking password. Use a password that is at least 12 characters long and includes numbers, uppercase letters, lowercase letters, and symbols. Do not reuse a password you've used anywhere else. If you used the same password on other accounts (email, social media, shopping sites), change those passwords too, because the hacker may have tried them elsewhere.

Enable two-factor authentication on your bank account if it's not already on. This means that even if someone has your password, they can't log in without also having access to your phone or email. Most banks offer this through their settings menu. Choose the method that works for you—text message, authenticator app, or security key—but enable it now.

Do not use security questions as your only second factor if you can avoid it. Answers to common questions like "What is your mother's maiden name?" are often public or easy to guess. Stick with text message or an authenticator app instead.

Monitor your credit report and consider a credit freeze

Pull your credit report from AnnualCreditReport.com, which is the only official free source. Check for accounts you didn't open, hard inquiries you didn't authorize, or changes to your personal information. If you see fraud on your credit report, file a dispute with the credit bureau and also file a report with the FTC.

Consider placing a credit freeze with all three credit bureaus—Equifax, Experian, and TransUnion. A freeze prevents anyone, including you, from opening new accounts in your name without unfreezing it first. It's free and takes about 10 minutes per bureau. You can unfreeze temporarily if you need to apply for credit, then freeze again when you're done.

If you're concerned about ongoing identity theft, you can also place a fraud alert on your credit report. This is free and lasts one year. It tells lenders to contact you before opening new accounts in your name. It's less restrictive than a freeze but offers some protection.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Most banks refund fraudulent debit card charges within 10 business days if you report within 60 days of the transaction. Credit card fraud refunds faster—usually within 30 days. The exact timeline depends on your bank and how quickly they investigate. Ask your bank for a specific date when you call to report.

What if I see fraudulent charges but my bank says they're legitimate?

Ask the bank to explain the charge in detail—the merchant name, the date, the location. If you still don't recognize it, file a formal dispute in writing and keep a copy. If the bank denies your dispute, you can escalate to your state's banking regulator or file a complaint with the Consumer Financial Protection Bureau.

Can I use my account while it's frozen for fraud?

No. When your bank freezes your account, you can't make purchases, transfers, or withdrawals until the freeze is lifted. This is temporary—usually just a few days while the bank investigates. You'll get a new debit card in the mail, and you can use that once it arrives. If you need cash immediately, visit a branch with your ID.

Should I close my account after fraud?

Not necessarily. Closing the account doesn't erase the fraud from your history, and it can actually hurt your credit score if the account was in good standing. Most people keep the account open after the fraud is resolved. If you want to close it later, you can, but there's no urgent reason to do so right after fraud.

What if the hacker changed my password and I can't log in?

Call your bank's customer service line immediately—not the fraud line, but the main number. Tell them you can't access your account. They can verify your identity over the phone using security questions or other methods, then reset your password or unlock your account. Do this before calling the fraud line so you can access your account to review transactions.