Your bank will reverse fraudulent transactions, but the timeline and your responsibility depend on when you report it

When someone gains unauthorized access to your bank account and moves money out, your bank is required by federal law to investigate and return the funds in most cases. The speed of that return and whether you lose any money depends on three things: how quickly you notice and report it, what type of account was compromised, and whether the thief used your debit card, online login, or ACH transfer to move the money.

If you report the fraud within two business days of discovering it, your liability is capped at $50 under the Electronic Funds Transfer Act. If you wait longer than two business days but report within 60 days, you could lose up to $500. After 60 days, you may not recover anything. The clock starts the moment you realize something is wrong, not when the fraud actually occurred.

Your bank will freeze your account while investigating, which typically takes 10 business days. During that time, you cannot access your own money. Once the investigation closes, the bank either returns the stolen funds or denies your claim. If they return it, the money usually appears within one to three business days.

Key Takeaways

  • Report unauthorized transactions to your bank within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more.
  • Your bank will freeze your account during a 10-business-day investigation, during which you cannot access any funds.
  • Fraudulent debit card charges are easier to reverse than ACH transfers or online bill payments, which require proof the transaction was not authorized by you.
  • If your account was compromised through phishing or malware, change your password and enable two-factor authentication immediately to prevent further access.
  • You may need to provide a written statement, police report, or affidavit to prove you did not authorize the transaction.

How the investigation works and what your bank needs from you

When you report fraud, your bank assigns an investigator and opens a case. They will ask you to describe what happened: when you first noticed the unauthorized activity, what transactions you did not make, and how you think the thief got access. Be specific about dates and amounts. Write this down before you call, because the bank will document everything you say.

The bank will then contact the merchant or receiving bank involved in each fraudulent transaction and request documentation. If money left your account via ACH transfer to another bank, the receiving bank must cooperate and may freeze that account. If the thief used your debit card at a store or online retailer, the bank will pull the transaction record and compare it to your normal spending patterns.

You will likely be asked to sign a written statement swearing that you did not authorize the transactions. Some banks require this before they will even begin the investigation. If the amount is large or the circumstances are suspicious, the bank may ask for a police report. You can file one with your local police department, either in person or online, though many departments now handle fraud reports by phone or through a web portal.

What happens to your account while the investigation is open

Your bank will place a hold on your account, meaning you cannot withdraw money, write checks, or use your debit card. This protects both you and the bank from further unauthorized activity while they investigate. The hold lasts for the full investigation period, which is 10 business days in most cases, though it can extend to 45 days if the bank needs more time to gather evidence from other institutions.

If you have automatic bill payments set up on the compromised account, contact those billers immediately and ask them to pause payments until your account is restored. If a payment fails because your account is frozen, contact the biller to explain the situation. Most will not report a late payment if you can show the delay was due to fraud investigation.

You will need access to money during this time. Ask your bank if they can open a temporary account or provide emergency cash. Some banks will issue a temporary debit card. If you have another account at the same bank, you may be able to transfer funds between accounts while the compromised one is frozen.

Different types of fraud require different proof

Debit card fraud is the easiest to reverse. If someone used your physical card or card number without permission at a store or online, the bank can see the transaction was not made by you (you were somewhere else, or the card was in your possession). These reversals typically happen within three to five business days.

ACH transfers and online bill payments are harder to reverse because the bank's system shows that someone with your login credentials initiated the transaction. To prove you did not authorize it, you must show that your password was compromised. This means providing evidence that you did not willingly give access to anyone, that you did not receive a confirmation email you recognized, or that your device was infected with malware. A police report strengthens your case significantly.

Wire transfers are nearly impossible to reverse once sent. If a thief tricked you into authorizing a wire transfer by posing as your bank or a trusted contact, you may not recover the money. The receiving bank can freeze the account if you report it quickly enough, but if the money has already been withdrawn, it is gone. This is why banks warn that wire transfers are irreversible.

How the thief likely got access to your account

The most common entry points are phishing emails, malware on your computer or phone, password reuse, and weak passwords. A phishing email looks like it came from your bank and asks you to "verify your account" or "confirm your identity" by clicking a link and entering your username and password. That link takes you to a fake website that captures your credentials.

Malware is software installed on your device without your knowledge that records your keystrokes or takes screenshots. If you downloaded an infected file, clicked a malicious link, or visited a compromised website, malware could have captured your login information the moment you typed it.

Password reuse means you used the same password for your bank account as you used for other websites. If one of those websites was breached, hackers have your password and your email address. They can then try that combination on your bank's login page. Weak passwords—short, simple, or based on personal information—are cracked in seconds by automated tools.

Less commonly, someone with physical access to your mail stole account statements or new debit cards. Or a data breach at a retailer or service provider exposed your account number and routing number, which is enough to set up unauthorized ACH transfers.

Secure your account immediately after reporting fraud

Change your password the moment you report the fraud, but do it on a different device if possible. If your computer or phone is infected with malware, changing your password on that device will not help—the malware will capture the new password too. If you only have one device, restart it in Safe Mode first, which disables most malware.

Enable two-factor authentication on your bank account if it is not already on. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Your bank will offer this during the fraud investigation or you can request it.

Check your credit report for new accounts opened in your name. You can view your report for free at annualcreditreport.com. If you see accounts you did not open, contact those creditors and report the fraud. Place a fraud alert on your credit file by contacting one of the three credit bureaus (Equifax, Experian, or TransUnion); the alert will notify creditors to verify your identity before opening new accounts.

Run antivirus and antimalware scans on all your devices. If you are not sure how, take your computer to a repair shop or ask a trusted tech-savvy friend. Delete any apps or browser extensions you do not recognize.

What to do if your bank denies your fraud claim

If the bank concludes that you authorized the transactions, they will deny your claim and you will not recover the money. This happens when the bank believes you gave someone your password, or that you authorized a wire transfer or large ACH transfer even if you claim you did not.

You can dispute the decision. Ask the bank for a written explanation of why they denied the claim, including what evidence they reviewed. Request the full investigation file. Then file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will contact your bank and ask them to reconsider. This process takes 30 to 60 days.

If the CFPB does not overturn the decision, you can sue your bank in small claims court if the amount is within your state's limit (usually $5,000 to $10,000). You will need to prove that the bank failed to follow the Electronic Funds Transfer Act or its own policies. Bring your investigation file, your written statement, any police report, and evidence that you reported the fraud within the required timeframe.

Frequently Asked Questions

How long does it take to get my money back?

The investigation takes 10 business days. If the bank finds in your favor, the funds are returned within one to three business days after that. In total, expect two to four weeks. If the bank needs to contact other institutions, it can take up to 45 days.

Can I be held responsible for fraudulent transactions if I did not report them right away?

Yes. If you report within two business days, you lose at most $50. If you wait two to 60 days, you could lose up to $500. After 60 days, you may lose everything. The clock starts when you discover the fraud, not when it occurred.

What if the thief transferred money to another bank account?

Your bank will contact the receiving bank and ask them to freeze that account. If the money is still there, it can be returned. If it has been withdrawn, the receiving bank will work with law enforcement to trace it. Recovery is possible but not may provide.

Do I need a police report to get my money back?

Not always, but it helps. A police report strengthens your claim, especially for large amounts or ACH transfers. You can file one with your local police department online, by phone, or in person. Provide the bank's investigation case number and the transaction details.

What if my bank account was hacked but no money was stolen?

Change your password and enable two-factor authentication immediately. Monitor your account closely for the next 30 days. Notify your bank of the unauthorized access even if no funds were taken, so they can flag your account and watch for suspicious activity.