Stop the bleeding first: freeze access and contact your bank

Call your bank's fraud line the moment you notice unauthorized transactions. Most banks have a 24-hour number on the back of your card or on their website. Tell them which transactions are not yours and ask them to freeze your account immediately. Do not wait for business hours or try to resolve it online first — the phone call creates a record with a timestamp, and your bank can block new transactions within minutes.

Your bank will likely cancel your debit card on the spot and mail a replacement. Ask whether they can issue a temporary card number or expedited card while you wait. If you have automatic bill payments set up, ask which ones will fail when your old card stops working — you may need to update those payments manually or pause them until your new card arrives.

Most banks will reverse fraudulent debit card charges within one to three business days if you report them before the money leaves your account. If the money has already gone, the reversal still happens, but it may take longer. Write down the exact dollar amount of each fraudulent transaction and the date it posted — you will need this for your dispute claim.

Key Takeaways

  • Call your bank's fraud line immediately, not the main customer service number, and ask them to freeze your account and cancel your card.
  • Unauthorized debit card charges are usually reversed within one to three business days if you report them before the money leaves your account.
  • Change your online banking password from a different device (not the one that may be compromised) and enable two-factor authentication if your bank offers it.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record in case the fraud spreads to other accounts or credit lines.
  • Monitor your credit report for new accounts opened in your name; you can check it free once per year at AnnualCreditReport.com.

Secure your online banking access before the hacker locks you out

Do not log into your bank account from the device that may be compromised. Use a different computer, phone, or tablet — ideally one you have not used for email or web browsing on the day you discovered the fraud. Go to your bank's website directly by typing the address into your browser, not by clicking a link in an email.

Change your online banking password to something you have never used before. Make it at least 12 characters long and use a mix of uppercase, lowercase, numbers, and symbols. If your bank offers two-factor authentication — a code sent to your phone or generated by an app — turn it on immediately. This makes it much harder for someone with your password to access your account.

Check your bank's account settings for any changes: linked email addresses, phone numbers, or recovery options. Hackers sometimes change these so they can reset your password later. If anything looks wrong, change it back and document what was altered. Take a screenshot if your bank allows it.

Check whether the hacker got into other accounts

Your checking account password may have been used on other websites. If you use the same password for email, social media, shopping sites, or other banks, change those passwords too — again, from a clean device. Start with your email account, because email is the master key: anyone with access to your email can reset passwords on almost every other account you own.

Log into your credit card accounts and any other bank accounts you have. Look for unauthorized transactions, new cards ordered, or changes to your address or phone number. If you find fraud on a credit card, call that card's fraud line and report it the same way you did with your checking account.

If you use a password manager, log into it and check whether any passwords have been changed or new entries added. If you do not use one, consider setting one up after this is resolved — it makes it easier to use a different, strong password for every account.

Report the fraud to the Federal Trade Commission

Go to IdentityTheft.gov and file a report. This is a free government resource that creates an official record of the fraud. You will answer questions about what happened, which accounts were affected, and what steps you have already taken. At the end, you get a recovery plan and an Identity Theft Report that you can show to your bank, credit card companies, or creditors if needed.

The FTC report does not stop the fraud by itself, but it documents it. If the hacker opens new accounts in your name later, you will have proof that you reported the original incident. Some creditors will not dispute fraudulent accounts without this report.

Keep a copy of your FTC report and the case number. You may need to reference it when you contact your bank or credit card companies about other fraud.

Place a fraud alert on your credit file

Call one of the three major credit bureaus — Equifax, Experian, or TransUnion — and ask them to place a fraud alert on your credit file. You only need to call one; by law, that bureau must tell the other two. A fraud alert tells lenders to verify your identity before opening new accounts in your name.

The fraud alert lasts one year. After that, you can renew it if you want. If the fraud is serious or ongoing, you can ask for an extended alert that lasts seven years, though this requires additional documentation.

A fraud alert is not the same as a credit freeze. An alert lets lenders still check your credit, but they have to contact you first. A freeze blocks access to your credit report entirely. You can place a freeze for free, but it makes it harder for you to open new accounts too. Many people use an alert first and switch to a freeze if fraud continues.

Monitor your credit report for new accounts

You can check your credit report free once per year at AnnualCreditReport.com. This is the only official site for free reports; other sites that advertise free credit reports usually try to sell you monitoring services. Pull your report now and look for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours.

If you find fraudulent accounts on your report, contact the credit bureau that listed them and file a dispute. You will need to provide documentation — usually a copy of your FTC Identity Theft Report or a police report. The bureau has 30 days to investigate and remove the account if it is fraudulent.

Check your report again in three months, then again in six months. Fraud can take time to show up, and new accounts may appear weeks or months after the initial breach.

Decide whether to file a police report

You are not required to file a police report for account fraud, but doing so gives you an official document that some creditors will accept instead of an FTC report. If the amount stolen is large or if the fraud is ongoing, a police report can strengthen your case when you dispute fraudulent accounts.

File the report in the city or county where you live, not where the hacker is located. You can usually file online or by phone. Bring your FTC report and documentation of the fraudulent transactions. The police will give you a report number; keep this for your records.

A police report does not mean the police will investigate or catch the hacker. It simply creates an official record that you reported the crime. That record can help you later if you need to dispute accounts or prove you were a victim of fraud.

Frequently Asked Questions

How long does it take to get my money back?

Debit card fraud reversals usually take one to three business days if you report it before the money leaves your account. If the money has already transferred out, the reversal still happens but may take up to 10 business days. Your bank must complete the investigation within 45 days. Ask your bank for a provisional credit while they investigate — many will give you the money back temporarily while they confirm the fraud.

Can the hacker get back into my account after I change my password?

Not if you change your password from a clean device and enable two-factor authentication. Two-factor authentication requires a code from your phone or an authenticator app, so even if someone has your password, they cannot log in without that second code. If your device is infected with malware, change your password from a different device and consider having the infected one checked by a professional.

What if my bank says the transactions were authorized?

Dispute it. Tell your bank that you did not make those transactions and ask them to file a formal dispute. You have the right to challenge any transaction you did not authorize. Provide documentation: screenshots of your account, the dates and amounts of the fraudulent charges, and your FTC Identity Theft Report. If your bank refuses to reverse the charges, you can file a complaint with the Consumer Financial Protection Bureau.

Do I need to close my checking account?

Not necessarily. Closing the account does not erase the fraud from your record, and it can hurt your credit if the account had a negative balance. Keep the account open, get a new card, and monitor it. If fraud continues on the same account after you have changed your password and enabled two-factor authentication, then closing it makes sense.

What if the hacker used my account to send money to someone else?

Report it to your bank immediately. If the money was sent via wire transfer or ACH, your bank may be able to recall it within 24 hours. If it was sent via a peer-to-peer app like Venmo or PayPal, contact that app's fraud team right away. The longer you wait, the harder it is to recover the money. Your bank will still reverse the fraudulent transaction on your account, but recovering money that left your account is harder than stopping a charge before it posts.