Stop the bleeding first, then notify your bank

The moment you realize your account has been hacked, call your bank's fraud line—not the main customer service number. The phone number is on the back of your debit card or in your online banking app. Tell them you suspect unauthorized access and ask them to freeze your account immediately. This stops new transactions from going through while you sort out what happened.

Your bank will likely cancel your current debit card and issue a replacement, which takes 5 to 10 business days to arrive. In the meantime, ask if they can issue a temporary card number or enable cardless ATM withdrawals so you can still access your money. Many banks do this at no cost when fraud is involved.

Do not wait for a statement to arrive or for the bank to contact you. The faster you call, the faster they can reverse unauthorized charges and prevent further damage. Document the date and time you called, the name of the person you spoke with, and what they told you to do next.

Key Takeaways

  • Call your bank's fraud line immediately—not the main number—and ask them to freeze your account before reviewing what was stolen.
  • Your bank will reverse most unauthorized debit card charges within one to three business days if you report them before the money leaves your account.
  • Change your online banking password from a different device (phone, laptop, or computer that was not compromised) and enable two-factor authentication if you have not already.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record for disputing charges and protecting your credit.
  • Check your credit reports at AnnualCreditReport.com for accounts you did not open, and place a fraud alert with the three credit bureaus if your Social Security number was exposed.

Review what was taken and dispute unauthorized charges

Once your account is frozen, log into your online banking from a secure device and review your recent transactions. Look for charges you do not recognize, transfers to unfamiliar accounts, or changes to your contact information (email, phone number, mailing address). Write down the date, amount, and merchant name for every unauthorized transaction.

Contact your bank again and report each fraudulent charge. Most banks reverse unauthorized debit card transactions within one to three business days if you report them before the money actually leaves your account. If the money has already been transferred out, the timeline is longer—sometimes two to four weeks—because the bank has to trace where it went and request it back from the receiving bank.

Ask your bank for a written summary of all disputed charges and the status of each one. Keep this document for your records. If your bank denies a dispute, you have the right to file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov.

Change your password and enable two-factor authentication

Do this from a device that was not compromised—a phone, laptop, or computer you know is clean. Do not change your password from the same device where you noticed the hack, because malware on that device could capture your new password immediately.

Your new password should be at least 12 characters long and include uppercase letters, lowercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you use the same password across multiple accounts, change those too—starting with email, because email is the master key to resetting passwords on every other account.

Enable two-factor authentication (also called 2FA) on your bank account if it is not already on. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Ask your bank which 2FA methods they support—text message codes are better than nothing, but an authenticator app like Google Authenticator or Authy is more secure because text messages can be intercepted.

File a report with the Federal Trade Commission

Go to IdentityTheft.gov and file a report. This is a free government resource run by the Federal Trade Commission. You will answer questions about what happened, what information was exposed, and what accounts were affected. At the end, you will receive an Identity Theft Report, which is an official document you can use to dispute fraudulent charges and place fraud alerts with credit bureaus.

The FTC does not investigate individual cases, but your report creates a record that helps law enforcement and financial institutions track patterns of fraud. You can also file a police report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, though police reports rarely lead to arrests for small-scale account hacks.

Keep your Identity Theft Report and any police report number in a safe place. You will need them if you have to dispute charges later or if you discover that your information was used to open accounts in your name.

Monitor your credit and place a fraud alert

Check your credit reports at AnnualCreditReport.com, which is the only free, official source for credit reports. You are may have access to to one free report from each of the three major credit bureaus—Equifax, Experian, and TransUnion—every 12 months. Pull all three now and look for accounts you did not open, inquiries from lenders you did not contact, or changes to your personal information.

If you find fraudulent accounts or inquiries, place a fraud alert with all three credit bureaus. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place an initial fraud alert for free by calling one bureau; they are required to notify the other two. The alert lasts one year and can be renewed.

If your Social Security number was exposed or you believe someone may try to open accounts in your name, consider a credit freeze instead. A freeze locks your credit reports so that no one—including you—can open new accounts without unfreezing first. Freezes are free and last until you remove them. Some states allow you to freeze your credit for free; others charge a small fee. Check your state's attorney general website for the exact process.

Watch for ongoing fraud and recover your account access

For the next 30 to 90 days, check your bank account and credit card statements weekly for new unauthorized charges. Fraudsters sometimes make small test charges first to see if the account is still active, then make larger purchases later. If you spot new fraud, report it to your bank immediately using the same process as before.

If the hacker changed your online banking password or recovery email, you may not be able to log in. Contact your bank's account recovery team—they can verify your identity using information only you would know (like your Social Security number, mother's maiden name, or answers to security questions) and restore your access. This usually takes one business day.

If you cannot recover your account or if your bank suspects the hack was part of a larger breach affecting many customers, they may close your account and open a new one for you. This is inconvenient but protects you from further fraud on that account. Update any automatic payments or direct deposits to your new account number as soon as the new account is active.

Understand what your bank is required to cover

Federal law protects you from most unauthorized debit card charges. If you report the fraud within two business days of discovering it, you are liable for no more than $50 of unauthorized charges. If you report it after two business days but within 60 days, you are liable for up to $500. If you wait longer than 60 days, your bank does not have to refund anything.

This protection applies to debit card transactions and transfers initiated by someone else using your card or account number. It does not cover money you sent to someone yourself, even if you were tricked into sending it (that is called a scam, not fraud, and the rules are different).

Credit cards have stronger protections—you are liable for no more than $50 of unauthorized charges, period, regardless of how long you wait to report it. If your credit card was compromised instead of your debit card, the process is similar but your liability is capped lower.

Frequently Asked Questions

How long does it take to get my money back?

If you report fraud before the money leaves your account, most banks reverse charges within one to three business days. If the money has already been transferred out, it can take two to four weeks because the bank has to request it from the receiving institution. Some transfers cannot be recovered if the receiving account has already been closed or emptied.

What if my bank says the charges were authorized?

Dispute it in writing. Send a letter to your bank's fraud department (the address is usually on your statement) explaining that you did not authorize the charges and requesting a reversal. Include copies of your Identity Theft Report from IdentityTheft.gov. If your bank still refuses, file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov.

Do I need to close my bank account?

Not necessarily. If your bank froze the account and issued a new card, you can keep the account open and use the new card. Close it only if your bank recommends it or if you no longer trust the institution. Closing accounts can temporarily lower your credit score, so avoid it unless there is a good reason.

Will this affect my credit score?

Not directly. Fraud itself does not damage your credit. However, if the hacker opened new accounts in your name and those accounts went unpaid, those accounts will hurt your score. That is why monitoring your credit reports and placing a fraud alert are important—they help you catch and dispute fraudulent accounts before they damage your score.

What if the hacker is still accessing my account?

Your bank will freeze the account, but if you suspect ongoing access, ask them to investigate whether malware is on your devices. Run a full antivirus scan on your computer and phone using software like Malwarebytes (free version available). If malware is found, remove it and change all your passwords again from a clean device. Consider taking your computer to a professional if you are not comfortable doing this yourself.