Stop the bleeding first, then notify your bank
The moment you suspect your bank account has been hacked, call your bank's fraud line directly—do not use the number on your card or a number you find online, because scammers sometimes intercept those. Look up the number on your bank's official website or a recent statement. Tell them you believe your account has been compromised and ask them to freeze it immediately. Most banks can do this within minutes.
Your bank will then walk you through what they see: which transactions are fraudulent, which accounts are affected, and what they can reverse. Do not hang up until you have a case number and the name of the person handling your claim. Write both down.
After the call, change your online banking password from a different device—ideally a phone or computer that has never accessed that account. Use a password you have never used anywhere else, at least 16 characters long, with uppercase, lowercase, numbers, and symbols mixed in.
Key Takeaways
- Call your bank's fraud line immediately using the number on your official statement or website, not a number from a text or email.
- Your bank can freeze your account within minutes and will show you which transactions they can reverse.
- Change your password from a different device and use a unique, long password with mixed character types.
- File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record and unlock fraud protections.
- Monitor your credit reports for new accounts opened in your name, which may appear weeks or months after the initial hack.
Understand what your bank will and will not cover
Federal law limits your liability for unauthorized transactions, but the timeline matters. If you report the hack within two business days of discovering it, you are liable for no more than $50 of fraudulent charges. If you wait longer than two business days but still report within 60 days of your statement, you could be liable for up to $500. After 60 days, you may lose all protection.
This protection applies to debit card fraud and unauthorized transfers. It does not cover money you sent yourself to a scammer—if you were tricked into wiring money or sending a gift card, that money is usually gone. The bank will not reverse it because you authorized the transaction, even though you were deceived.
Transactions made before your bank froze the account are the bank's problem to investigate and reverse, not yours. They have 10 business days to complete an investigation and tell you the results. If they find the transaction was fraudulent, they must credit your account. If they find it was authorized (even if you dispute that), they can hold you liable.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report. This is free and creates an official record that you reported the hack. The FTC does not investigate individual cases, but the report unlocks two important protections: you can place a fraud alert on your credit file, and you can request a free credit freeze.
A fraud alert tells credit bureaus and lenders that you may be a victim of identity theft. It requires lenders to verify your identity before opening new accounts in your name. The alert lasts one year and is free to place. A credit freeze locks your credit file so that no one—including you—can open new accounts without unfreezing it first. This is stronger protection but also more inconvenient if you need to apply for credit yourself.
After you file the FTC report, you will receive a recovery plan tailored to your situation. Print it and keep it with your case number from your bank.
Check your credit reports for new accounts
Hackers often use stolen bank information to open credit cards, loans, or other accounts in your name. These may not show up for weeks or even months. Request your free credit reports from all three bureaus—Equifax, Experian, and TransUnion—at AnnualCreditReport.com. You are may have access to to one free report per bureau per year.
Look for accounts you do not recognize, hard inquiries you did not authorize, and changes to your personal information like address or phone number. If you find fraudulent accounts, contact the bureau that reported them and dispute the account in writing. Include a copy of your FTC report and your bank's case number.
After the initial hack, check your reports again in three months and six months. Identity theft can unfold slowly, and catching new fraud early limits the damage.
Secure your other accounts and devices
If your bank account was hacked, assume your email and other passwords may be compromised too. Change the password on your email account first—this is the master key to resetting passwords everywhere else. Then change passwords on any financial accounts: credit cards, investment accounts, insurance, retirement accounts, anything that holds money or personal information.
Use a password manager like Bitwarden, 1Password, or KeePass to generate and store unique passwords for every account. Do not reuse passwords across sites, because if one account is breached, hackers will try that password on your bank, email, and other services.
Run a malware scan on any device you use to access your bank account. Download Malwarebytes (free version) or Windows Defender (built into Windows) and run a full system scan. If you use a Mac, run Malwarebytes for Mac. If the scan finds malware, remove it and change your passwords again from a clean device.
Document everything for your records
Keep a folder—digital or physical—with copies of all communications about the hack. This includes your bank's case number, the FTC report number, emails from your bank, credit bureau dispute letters, and any police report if you filed one. If a creditor later tries to collect on a fraudulent account, you will need this documentation to prove it was not yours.
Write down the date you discovered the hack, the date you called your bank, and the date you filed the FTC report. If your bank asks you to sign anything, keep a copy. If a debt collector contacts you about a fraudulent account, respond in writing within 30 days and include copies of your FTC report and bank case number.
Know when to file a police report
You do not need a police report to recover money from your bank—the bank's fraud investigation is separate from law enforcement. However, filing a police report creates an official record that may help if a creditor or debt collector pursues you for a fraudulent account opened in your name.
File a report with your local police department or, if the hack involved interstate wire fraud or identity theft across state lines, with the FBI's Internet Crime Complaint Center at IC3.gov. You will not need to go to a police station; many departments accept reports online or by phone. Ask for a report number and keep it with your other documentation.
Frequently Asked Questions
How long does it take to get my money back?
Your bank has 10 business days to investigate and tell you whether they will reverse the charges. If they find the transaction was fraudulent, the credit usually appears within one to three business days. If they need more time, they must return a provisional credit within 10 days while they continue investigating.
What if the hacker changed my password and I cannot log in?
Call your bank's customer service line and tell them you cannot access your account. They can verify your identity using security questions, your Social Security number, or recent transactions, then reset your password or issue a temporary one. Do this before calling the fraud line so you have access to your account history.
Do I need to close my bank account?
Not necessarily. If your bank froze the account and reversed the fraudulent charges, you can keep it open. However, if you feel unsafe or the bank cannot stop the fraud, closing the account and opening a new one at a different bank is an option. Ask your bank about the process—they may waive fees for accounts closed due to fraud.
Will this affect my credit score?
Fraudulent transactions on your existing account should not hurt your score. However, if the hacker opened new credit accounts in your name and those accounts went unpaid, they will damage your score until you dispute and remove them. This is why checking your credit reports regularly is critical.
What if my bank says the transaction was authorized?
If your bank concludes you authorized a transaction even though you did not, you can dispute it in writing. Include your FTC report, your bank's case number, and a detailed explanation of why you did not authorize it. If the bank still refuses to reverse it, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau.