Your bank will likely reverse the fraudulent transactions, but the timeline and what you have to do depends on how the thief moved the money

When someone gains access to your bank account without permission, the bank's fraud department will investigate the unauthorized transactions you report. Most banks reverse fraudulent charges within 10 business days if you report them quickly—but only if the money is still traceable. If the thief moved funds to another account, converted them to cryptocurrency, or withdrew cash, recovery becomes much harder and may take weeks or months.

The speed of your recovery depends on three things: how fast you notice the theft, how quickly you report it, and whether the stolen money is still in the banking system. A charge made with your debit card yesterday is easier to reverse than a wire transfer sent three days ago to an account outside the country. Your job is to report the fraud immediately and document everything—the bank needs your report to start the investigation.

Key Takeaways

  • Report unauthorized transactions to your bank within 24 hours; federal law limits your liability to $50 if you report a debit card theft within two business days, but waiting longer can cost you thousands.
  • The bank will freeze your account, reverse fraudulent charges, and issue a new card or account number, usually within 5 to 10 business days.
  • Money moved to another bank or converted to cryptocurrency is much harder to recover and may require law enforcement involvement.
  • You must provide the bank with a written statement of the unauthorized transactions within 60 days of receiving your statement to preserve your legal protections.
  • Change your password, enable two-factor authentication, and monitor your credit report for new accounts opened in your name.

What the bank does in the first 24 to 48 hours

When you call your bank and report fraudulent activity, the fraud department will immediately freeze your account to stop further unauthorized transactions. They will ask you to confirm which transactions were not made by you, and they will document your report in writing. You should receive a confirmation number and the name of the investigator assigned to your case.

The bank will also issue a new debit card or account number within 24 to 48 hours. If the thief has your card number, that card is now useless to them. If they have your online banking login, the bank will reset your password and may require you to answer security questions or verify your identity in person before you can access the account again.

During this time, your account is locked. You cannot make withdrawals or transfers until the investigation begins. This is intentional—it protects you from further theft, but it also means you may not have access to your own money for a few days. If you need cash urgently, ask the bank whether they can issue an emergency advance or temporary card.

How long the investigation takes and what happens to your money

The bank's investigation typically takes 10 business days. During this time, they trace each fraudulent transaction to see where the money went. If the thief used your debit card at a store or online retailer, the bank contacts that merchant to reverse the charge. If the thief made a wire transfer or ACH transfer to another bank account, the bank contacts that receiving bank and asks them to freeze the funds and return them.

The outcome depends on where the money is now. If it is still in another bank account in the United States, the receiving bank can usually return it within 5 to 10 business days. If it was withdrawn as cash, converted to cryptocurrency, or sent to an account outside the country, the bank may not be able to recover it at all. In those cases, the investigation will document what happened, and you may need to file a police report to pursue the matter further.

At the end of the investigation, the bank will either credit your account for the full amount of the fraudulent transactions or send you a written explanation of why they cannot recover the money. If they credit you, the money should appear in your account within one to two business days after the investigation closes.

Your legal liability for the theft

Federal law (Regulation E) limits your liability for unauthorized debit card transactions, but the limit depends on when you report the theft. If you report it within two business days of discovering the fraud, your liability is capped at $50. If you wait longer than two business days but report it within 60 days of receiving your bank statement, your liability can be up to $500. If you wait more than 60 days, you may lose all protection and be liable for the entire amount stolen.

This is why speed matters. A thief who drains your account on a Friday and you do not notice until Monday morning has already cost you money in potential liability. Call your bank the moment you see an unauthorized transaction, even if it is small. The $50 cap applies to each incident, so if multiple fraudulent transactions occurred, you are protected on all of them as long as you report within the window.

Credit card fraud has different rules—your liability is capped at $50 regardless of when you report it. But debit card fraud is stricter, which is why many people prefer credit cards for everyday purchases. You are spending the card issuer's money, not your own, and they have more incentive to investigate quickly.

What to do while the investigation is ongoing

While the bank investigates, you need to protect yourself from further damage. Change the password on your online banking account immediately, using a password you have never used before. If you used the same password on other accounts (email, social media, shopping sites), change those too. A thief who has your email password can reset passwords on other accounts and lock you out of your own life.

Enable two-factor authentication on your bank account if it is available. This means the bank will send you a code via text or email every time someone tries to log in from a new device. Even if the thief has your password, they cannot access your account without that code.

Check your credit report for new accounts opened in your name. You can order a free report from each of the three credit bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com. If you see accounts you did not open, contact the bureau immediately and file a dispute. You can also place a fraud alert on your credit file, which tells lenders to verify your identity before opening new accounts in your name.

Keep all documentation from your bank—the fraud report, the investigation summary, the credit for the stolen funds, and any correspondence. If the thief opens new accounts or takes out loans in your name, you will need this paper trail to prove you reported the original fraud.

When the bank cannot recover the money

If the investigation concludes that the money cannot be recovered, the bank will send you a written explanation. This usually happens when the thief withdrew cash, sent money to an account outside the United States, or converted the funds to cryptocurrency. In these cases, the money is gone from the banking system and the bank has no way to retrieve it.

At this point, you have two options: accept the loss or file a police report and pursue the matter through law enforcement. A police report creates an official record that may help you if the thief tries to use your identity for other crimes. It also gives you documentation for your insurance company if you have identity theft coverage.

Law enforcement can sometimes trace cryptocurrency transactions or international wire transfers, but this is slow and not always successful. If the amount stolen is small (under $1,000), police may not prioritize the case. If it is large or part of a pattern of fraud, they may investigate further. Either way, filing a report costs nothing and gives you a paper trail.

Preventing the same thing from happening again

After your account is restored, take steps to make it harder for a thief to access it again. Use a unique, strong password for your bank account—at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Do not use your birthday, address, or pet's name. Do not reuse passwords across accounts.

Set up alerts on your bank account so the bank texts or emails you every time a transaction over a certain amount occurs. Many banks let you set this threshold—you might choose $50 or $100. This way, if someone uses your card, you know within minutes.

Check your bank statements every week, not just once a month. The sooner you spot fraud, the sooner you can report it and the more money the bank can recover. Many banks offer free online access to your statement, so there is no excuse to wait.

Consider using a credit card for everyday purchases instead of a debit card. Credit card fraud is easier to dispute, your liability is lower, and you are not spending your own money while the investigation happens. Keep your debit card for ATM withdrawals only.

Frequently Asked Questions

Can the bank make me pay for fraudulent transactions while they investigate?

No. Once you report the fraud, the bank must credit your account for the disputed amount while they investigate, as long as you file a written statement within 60 days of receiving your statement. You do not have to wait for the investigation to close to get your money back. However, if the investigation later determines that you authorized the transaction, the bank can reverse the credit.

What if the thief used my account to pay someone else's bill or loan?

Report it to your bank as an unauthorized ACH or wire transfer. The bank will contact the receiving bank and ask them to return the funds. If the receiving bank cannot recover the money because it was already spent, the bank will document this in the investigation and may refer the case to law enforcement. You are not responsible for paying the bill or loan.

Do I need to close my account and open a new one?

Not necessarily. The bank will issue you a new card and reset your account access, which is usually enough. However, if the thief has your account number and routing number, they could potentially set up unauthorized ACH transfers even with a new card. If you are concerned, ask the bank whether closing the account and opening a new one is recommended. This takes a few days but gives you a completely fresh start.

What if my bank says the fraud was my fault because I shared my password?

Push back. Sharing a password with someone you trust does not mean you authorized them to steal from you. If you can show that the transactions were made without your knowledge or consent, the bank must reverse them. Document everything in writing and ask to speak to the fraud department supervisor if the first investigator denies your claim.

Can I get my money back if the thief sent it to cryptocurrency?

Probably not through your bank. Once money is converted to cryptocurrency, it leaves the traditional banking system and is nearly impossible to trace or recover. Your bank will document this in the investigation, but they cannot force the thief to convert it back. Law enforcement may be able to investigate if the amount is large enough, but recovery is unlikely. This is why cryptocurrency theft is so common—it is fast and irreversible.