Stop the bleeding first, then notify your bank
The moment you notice unauthorized transactions or suspect your account has been compromised, call your bank's fraud line directly—do not use the number on your card or a number you find online, because scammers sometimes intercept those. Look up the number on your bank's official website or your statement. Tell them you believe your account has been hacked and ask them to freeze or lock your account immediately so no further transactions can go through.
Your bank can reverse fraudulent transactions, but only if you report them within a specific window. Most banks give you up to 60 days from when your statement is mailed to dispute unauthorized charges, though some offer longer protection. The sooner you call, the sooner they can stop the bleeding and begin investigating. Ask the bank to confirm in writing what they've done: which transactions they're disputing, what temporary measures they've put in place, and what your liability is.
Do not close the account yourself yet. Your bank needs it open to investigate and reverse charges. They will tell you when it's safe to close or when they've issued a new card.
Key Takeaways
- Call your bank's fraud line immediately using the number on your official statement or website, not a number from a text or email.
- Your bank can reverse fraudulent charges, but you must report them within 60 days of your statement date to stay protected under federal law.
- You are not liable for unauthorized transactions if you report them promptly, though your bank may require you to file a written dispute within 10 days.
- Change your online banking password from a different device and enable two-factor authentication once your account is secured.
- Monitor your credit reports and consider a fraud alert or credit freeze to prevent the hacker from opening new accounts in your name.
What your bank will ask you and what you need to provide
When you call, have your account number, recent statements, and a list of transactions you don't recognize ready. The bank will ask you to describe what you noticed—whether you saw charges you didn't make, received a notification of a login from an unfamiliar location, or got a call from someone claiming to be from the bank. They will also ask whether you've shared your password, PIN, or card details with anyone, used public Wi-Fi to log in, or clicked any suspicious links recently.
Most banks require you to file a written dispute within 10 days of your phone call. This is usually a form you can complete online, by mail, or in person. The form asks you to list each fraudulent transaction, the amount, and why you believe it's unauthorized. Keep copies of everything you send and get a confirmation number or receipt.
Your bank may also ask you to sign an affidavit swearing that you did not make the transactions. This is standard and protects both you and the bank legally. If you're unsure whether a transaction was yours, tell the bank—they can investigate rather than you guessing wrong.
How long reversal takes and what happens while you wait
Your bank must acknowledge your dispute within 30 days and complete their investigation within 45 days. During this time, they will typically credit your account provisionally—meaning the money goes back to you while they investigate—so you can access your funds. This provisional credit is not final; if the bank later determines the transaction was legitimate, they can take the money back, though this is rare if you reported promptly.
Some banks credit you immediately; others take a few business days. Ask when you call what their timeline is. If your account is frozen or locked, ask whether you can still make essential payments like bills or rent, or whether you need a temporary card or access method while the investigation proceeds.
If the hacker made a large withdrawal or transferred money out of your account, ask your bank whether they can contact the receiving bank to attempt recovery. If the money went to another bank account, the receiving bank may be able to freeze it while the dispute is resolved. This is not may provide, but it's worth asking.
Changing your password and securing your devices
Do not change your banking password from the device you normally use until you know whether that device has been compromised. Instead, use a different computer or phone—a friend's device, a library computer, or a phone you know is clean. Log into your bank's website (not through an email link) and change your password to something completely new that you've never used before.
Make the new password at least 12 characters long and include uppercase letters, numbers, and symbols. Do not use your name, birthdate, or anything someone could guess from your social media. Write it down and store it somewhere secure, or use a password manager like Bitwarden or 1Password if you have one.
Once you've changed your password, enable two-factor authentication if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Ask your bank which methods they support—text message, email, or an authenticator app—and choose the most secure option available to you.
Checking your credit and placing a fraud alert
A hacker with your personal information might try to open new credit cards, loans, or accounts in your name. To catch this early, check your credit reports at AnnualCreditReport.com, which is the only free, official source for your reports from Equifax, Experian, and TransUnion. You get one free report from each bureau per year, and you can stagger them—check one now, one in four months, and one in eight months—to monitor throughout the year.
Look for accounts you don't recognize, inquiries from lenders you didn't contact, or addresses that aren't yours. If you find fraud on your credit report, you can dispute it directly with the credit bureau by mail or online. The bureau must investigate within 30 days and remove inaccurate information.
You can also place a fraud alert with any one of the three credit bureaus, and they will notify the other two. A fraud alert tells lenders to verify your identity before opening new accounts in your name. It lasts one year and is free. If you believe you're at high risk—for example, if your Social Security number was stolen—you can place a credit freeze instead, which blocks all access to your credit report until you lift it. A freeze also lasts until you remove it and is free under federal law.
Recovering money sent to another person or account
If the hacker transferred money to another bank account, your bank can contact the receiving bank and ask them to freeze the funds while the dispute is resolved. This works best if the receiving account is at a different bank and the transfer happened recently. Provide your bank with the receiving account number and routing number if you have it, or the name and bank of the recipient if you don't.
If the money was sent through a payment app like Venmo, PayPal, or Cash App, contact that app's fraud team immediately. These services can sometimes reverse transfers or freeze the recipient's account while they investigate. However, if the recipient has already withdrawn the money to their bank account or spent it, recovery becomes much harder.
If the hacker used your debit card to make purchases at stores or online, those transactions are handled the same way as any other fraudulent charge—your bank disputes them and reverses them. If they used your card information to set up recurring charges (like a subscription), ask your bank to cancel those authorizations and issue you a new card number.
Protecting yourself from future hacks
After your account is secured, take steps to prevent it from happening again. Use a unique password for your bank account that you don't use anywhere else—if another website gets hacked and your password is exposed, a hacker can't use it to access your bank. Enable two-factor authentication on every account that offers it, starting with email and banking.
Check your bank's security settings and see whether they offer options like login notifications (alerts when someone logs in from a new device), IP address restrictions (only allow logins from your home network), or spending limits (block transactions over a certain amount). These are not foolproof, but they add layers that make your account a harder target.
Be cautious with public Wi-Fi and never log into your bank account from a coffee shop or airport network. If you must access your account away from home, use your phone's cellular data instead of Wi-Fi, or use a VPN service. Do not click links in emails or texts claiming to be from your bank—instead, go directly to the bank's website by typing the address yourself or calling the number on your card.
What happens if you don't report in time
Federal law limits your liability for unauthorized transactions, but only if you report them within specific timeframes. If you report within two business days of noticing the fraud, your liability is capped at $50. If you report within 60 days of your statement being mailed, your liability is capped at $500. If you wait longer than 60 days, you may be liable for the full amount of the unauthorized transactions.
This is why calling your bank immediately matters—you lose protection the longer you wait. Even if you're not sure whether a transaction is fraudulent, call and ask. Your bank would rather investigate a legitimate transaction than have you lose money because you waited too long.
Frequently Asked Questions
Can my bank hold me responsible for fraudulent charges?
No, if you report them within 60 days of your statement date. Federal law caps your liability at $50 if you report within two business days, and $500 if you report within 60 days. After 60 days, you may be liable for the full amount, which is why speed matters.
What if the hacker used my debit card to withdraw cash from an ATM?
ATM withdrawals are treated the same as other fraudulent transactions—report them to your bank and they will dispute them. However, if the withdrawal happened at an ATM and the hacker used your PIN, your bank may argue you authorized it. This is why changing your PIN immediately is important, and why you should tell your bank if you believe your PIN was compromised.
Do I have to pay my bills while my account is frozen?
Ask your bank whether you can set up temporary payments or whether they can issue you a temporary card or access method. Most banks allow you to make essential payments even while an account is under investigation. If you have automatic bill payments set up, ask your bank to pause them until your account is fully secured.
Should I close my account after the fraud is resolved?
You don't have to, but some people do for peace of mind. If you close it, make sure all pending disputes are resolved first and that you've transferred any remaining balance. If you keep it open, continue monitoring it for at least a few months to make sure no new fraudulent activity appears.
What if the hacker opened a new credit card in my name?
That's identity theft, not just account hacking. File a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record. You can also file a police report in your city. Contact the credit card company that issued the fraudulent card and tell them it's not yours. Dispute it on your credit report and place a fraud alert or credit freeze to prevent further accounts from being opened.