Stop the bleeding first, then notify your bank

The moment you suspect your bank account has been hacked, call your bank's fraud line directly—do not use the number on your card or a number you find online, because scammers sometimes intercept those. Look up the number on your bank's official website or a recent statement. Tell them you believe your account has been compromised and ask them to freeze it immediately.

Your bank can reverse some fraudulent transactions, but only if you report them quickly. Federal law (Regulation E) protects you against unauthorized electronic transfers, but your liability depends on how fast you act. If you report within two business days of discovering the fraud, you are liable for no more than $50 of unauthorized transfers. If you wait longer than two business days but report within 60 days, your liability can go up to $500. After 60 days, you may lose all protection for transfers made after that point.

While you are on the phone with your bank, ask them to place a fraud alert on your account and request a new debit card and new account number if possible. Some banks will close the compromised account and open a new one on the spot.

Key Takeaways

  • Call your bank's fraud line directly using the number on your statement or official website, not a number from a text or email.
  • Report unauthorized transfers within two business days to limit your liability to $50; waiting longer increases what you may owe.
  • Ask your bank to freeze the account, issue a new card, and place a fraud alert on your credit file.
  • File a report with the Federal Trade Commission at IdentityTheft.gov and keep the report number for your records.
  • Check your credit report at all three bureaus (Equifax, Experian, TransUnion) for accounts you did not open.

Document every unauthorized transaction and get it in writing

Before you hang up with your bank, ask them to send you a written summary of all fraudulent transactions they have identified. Do not rely on a verbal conversation—you need a paper trail. Request that they email or mail you a formal dispute letter that lists each unauthorized charge, the date it occurred, and the amount.

Go through your recent statements yourself and flag anything you do not recognize. Write down the date, amount, merchant name, and transaction type (debit, ACH transfer, wire, etc.) for each one. Take screenshots of your online banking history showing the transactions. Save all of this in a folder on your computer and print copies to keep in a physical file.

Your bank will typically reverse fraudulent charges within 10 business days while they investigate, though some take longer. Ask them for a timeline and a case or reference number you can use to track the dispute.

File a report with the Federal Trade Commission

Go to IdentityTheft.gov and file a report. This is the official government site for identity theft complaints. You will answer questions about what happened, which accounts were affected, and what steps you have already taken. The site will generate an Identity Theft Report, which is a legal document that you can use to prove to creditors and banks that you are a victim.

Save your report number and download a copy of the report itself. Some banks and credit card companies will not reverse charges or remove fraudulent accounts from your credit report without this official report. You may also need it if a scammer opens new accounts in your name.

The FTC does not investigate individual cases, but your report becomes part of a national database that law enforcement agencies use to spot patterns and larger fraud schemes.

Place a fraud alert and consider a credit freeze

A fraud alert tells credit bureaus to contact you before opening new accounts in your name. It lasts one year and is free. Call one of the three major credit bureaus—Equifax, Experian, or TransUnion—and request a fraud alert. By law, that bureau must notify the other two, so you only need to call once.

A credit freeze is stronger: it locks your credit file so that no one can open new accounts without your permission, even if they have your Social Security number. Freezes last until you lift them and are also free. You place a freeze with each bureau separately. A freeze takes a few business days to go into effect and can slow down your own credit applications, so use it only if you believe your identity has been seriously compromised.

You can also request an extended fraud alert, which lasts seven years and requires you to provide an Identity Theft Report. This is useful if you have already filed with the FTC.

Check your credit report for accounts you did not open

Go to AnnualCreditReport.com (the only free, official site) and request your credit report from all three bureaus. You are may have access to to one free report per bureau per year. Look for accounts, loans, or credit inquiries you do not recognize. If you see fraudulent accounts, contact the bureau in writing and dispute them. Include a copy of your FTC Identity Theft Report.

The bureau must investigate within 30 days and remove the account if it is fraudulent. If the account remains on your report after the investigation, you can add a statement to your credit file explaining that it was opened without your consent.

Check your credit report again in three months and six months. Scammers sometimes open accounts in waves, and new fraud may appear later.

Change passwords and enable two-factor authentication on all accounts

Once your bank account is secured, change the password on every account that shares a password with your bank account or uses the same email address. This includes email, social media, shopping sites, and any financial accounts. Use a password manager like Bitwarden or 1Password to generate and store unique, strong passwords for each site.

Enable two-factor authentication (also called 2FA or multi-factor authentication) on your bank account, email, and any other sensitive accounts. Two-factor authentication requires a second form of verification—usually a code from an authenticator app, a text message, or a security key—before you can log in. This makes it much harder for a hacker to access your account even if they have your password.

Do not use SMS (text message) as your only second factor if the site offers an authenticator app or security key instead. SMS can be intercepted or redirected by sophisticated attackers.

Monitor your accounts and consider a credit monitoring service

Check your bank account, credit card accounts, and email daily for the next month. Look for login attempts from unfamiliar locations, new transactions, or password reset requests you did not make. Set up account alerts with your bank so you receive a notification for every transaction over a certain amount (many banks let you set this to $1).

Some banks and credit card companies offer free credit monitoring as part of their fraud protection. Ask your bank whether they provide this. If not, you can use free services like Credit Karma or AnnualCreditReport.com to check your credit score and report regularly. Paid services like Equifax's Credit Watch or Experian's IdentityWorks offer continuous monitoring and alerts, but they are not necessary unless you have been a victim of serious identity theft.

Keep monitoring for at least six months. Some fraudulent activity does not show up immediately.

Frequently Asked Questions

How long does it take to get my money back after my bank account is hacked?

Most banks reverse fraudulent transfers within 10 business days, though some take up to 30 days while they investigate. If you reported within two business days, the bank covers the loss. If you reported later, you may be liable for part of it. Ask your bank for a specific timeline when you report the fraud.

What if the hacker transferred money out of my account to another bank?

Your bank can attempt to recover the money from the receiving bank, but this is slower and less certain than reversing a charge. Report it immediately and ask your bank to file a recovery request. The receiving bank may freeze the funds if they are still there, but if the money has already been withdrawn, recovery becomes much harder. This is why reporting within two business days is critical.

Can I be held responsible for fraudulent charges if I did not report them right away?

Yes, potentially. Under Regulation E, if you report within two business days, you owe nothing. If you report between two and 60 days, you may owe up to $500. After 60 days, you may lose all protection. However, some banks are more lenient than the law requires, so ask your bank about their specific policy.

What if my bank says the transactions were authorized and refuses to refund them?

Ask the bank to explain in writing why they believe the transactions were authorized. If you disagree, file a written dispute with the bank's compliance department and reference Regulation E. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints and can pressure banks to reconsider.

Do I need to close my bank account after it is hacked?

Not necessarily. If your bank has frozen the account and issued a new card and account number, you can keep the account open. However, if you feel unsafe or the bank cannot secure it properly, you can close it and open a new account elsewhere. Ask your bank whether they can simply issue a new account number rather than closing the old one, since closing and reopening can temporarily affect your credit.