Stop the bleeding first, then notify your bank
The moment you notice unauthorized transactions or suspect your account has been compromised, call your bank's fraud line directly—do not use the number on your card or a number you find online, because scammers sometimes intercept those. Look up the number on your bank's official website or a recent statement. Tell them your account may be compromised and ask them to freeze it immediately.
Your bank can reverse fraudulent transactions, but only if you report them within a specific window. Most banks give you up to 60 days from when you receive your statement to dispute unauthorized charges, though some offer longer protection. The sooner you call, the sooner they can lock the account and begin investigating. Do not wait for your next statement to arrive.
While on the phone, ask the bank to cancel your current debit and credit cards and issue new ones. Request expedited shipping if available—some banks can get a replacement card to you in one to three business days. Ask whether they can issue a temporary card number you can use online while you wait for the physical card.
Key Takeaways
- Call your bank's fraud line immediately using the number on your official statement or website, not a number from a text or email.
- Your bank can reverse fraudulent charges, but you must report them within 60 days of receiving your statement.
- Change your online banking password from a different device (not the one that may be compromised) and enable two-factor authentication if you have not already.
- Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) to prevent a hacker from opening new accounts in your name.
- Check your credit report for accounts you did not open, and file a report with the Federal Trade Commission if identity theft occurred.
Secure your online banking access before the hacker does more damage
Do not change your password from the same computer or phone you normally use to access your account, because malware on that device may capture the new password immediately. Use a different device—a work computer, a friend's phone, or a public library computer—to log into your bank's website and change your password to something completely new. Make it at least 12 characters long and use a mix of uppercase, lowercase, numbers, and symbols.
After changing your password, enable two-factor authentication (also called 2FA) if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Ask your bank which methods they support—text message codes are better than nothing, but an authenticator app like Google Authenticator or Authy is more secure because texts can be intercepted.
Check your bank's list of connected apps and devices. Log into your online banking settings and look for a section called "Connected Apps," "Authorized Devices," or "Active Sessions." Remove anything you do not recognize. If you see a device or app you do not remember authorizing, that is a sign the hacker had access to your account.
Report the fraud to credit bureaus and the government
Place a fraud alert with all three credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place one for free by calling or visiting the website of any one bureau, and they are required to notify the other two. The alert lasts one year and can be renewed.
To place a fraud alert, contact one of these bureaus:
- Equifax: 1-800-525-6285 or www.equifax.com
- Experian: 1-888-397-3742 or www.experian.com
- TransUnion: 1-800-680-7289 or www.transunion.com
After placing the alert, request a free copy of your credit report from each bureau. You are may have access to to one free report per bureau per year through www.annualcreditreport.com. Review each report carefully for accounts you did not open, inquiries you did not authorize, or addresses that are not yours. If you find fraudulent accounts, contact the bureau in writing and ask them to remove the account from your report.
File a report with the Federal Trade Commission at www.identitytheft.gov. This creates an official record of the theft and generates a recovery plan tailored to your situation. The FTC does not investigate individual cases, but the report is useful if you need to dispute fraudulent accounts or prove to creditors that you are a victim of identity theft.
Check what the hacker accessed and what they might do next
Log into your bank account (from a secure device) and review your recent transactions going back at least 90 days. Write down the date, amount, and merchant name for every transaction you did not make. Your bank will need this information to investigate and reverse the charges.
Check whether the hacker changed your account settings. Look for changes to your address, phone number, email address, or security questions. If any of these were altered, change them back immediately and ask your bank whether they can see when the changes were made—this helps them understand how long the account was compromised.
Review your other financial accounts: credit cards, investment accounts, retirement accounts, and any loans. Hackers who access one account often try to access others using the same password. Change the password on every account that used the same or a similar password as your bank account.
Monitor your accounts and credit for the next year
Check your bank and credit card statements weekly for the next three months, then monthly for the rest of the year. Set up account alerts through your bank's website or app so you receive a notification whenever a transaction occurs. Most banks let you set a minimum amount—for example, you could ask to be alerted for any transaction over $1.
Check your credit report again three months after the fraud, then once more at six months. You can order additional free reports from www.annualcreditreport.com once per year per bureau, or you can use a credit monitoring service. Many banks and credit card companies offer free credit monitoring to customers; ask whether yours does.
Watch for signs that the hacker is still using your information: bills arriving for accounts you did not open, calls from debt collectors about debts you did not incur, or mail from the IRS about income you did not earn. If any of these happen, contact the relevant organization immediately and provide them with a copy of your FTC identity theft report.
Understand what your bank will and will not cover
Federal law protects you against unauthorized transactions on your debit card, but the amount of protection depends on how quickly you report the fraud. If you report it within two business days of discovering the unauthorized transaction, your liability is capped at $50. If you report it between two and 60 days after your statement is sent, your liability can be up to $500. If you wait longer than 60 days, you may lose all protection.
Credit card fraud has stronger protection: you are liable for no more than $50 per card, and many issuers waive even that amount. However, this protection only applies if you report the fraud within 60 days of receiving your statement.
Your bank may reverse fraudulent transactions even if you miss these deadlines, but they are not required to. Some banks have their own policies that are more generous than federal law. Ask your bank what their specific fraud policy is and whether they will cover losses beyond the legal minimum.
Frequently Asked Questions
How long does it take for my bank to refund fraudulent charges?
Most banks issue a provisional credit within one to three business days while they investigate. A full refund typically takes 10 to 30 days, though some banks take longer. Ask your bank for a timeline when you report the fraud. In the meantime, ask whether they can waive overdraft fees if the fraudulent charges caused your account to go negative.
What if the hacker transferred money out of my account to another bank?
Tell your bank immediately. They can contact the receiving bank and ask them to freeze the funds while the fraud investigation happens. The receiving bank is required to cooperate with fraud investigations. Recovery is slower than reversing a purchase—it can take several weeks—but your bank should still be able to recover the money.
Do I need to close my bank account?
Not necessarily. Your bank can freeze the account, issue new cards, and change your access credentials without closing it. Closing the account can actually make things harder because you lose the transaction history and the bank's ability to investigate. Keep the account open unless your bank recommends closing it.
Can the hacker use my account information again after I change my password?
Not if you change your password from a secure device and enable two-factor authentication. However, if your computer or phone is still infected with malware, the hacker may be able to capture your new password. Run a full antivirus scan on any device you use to access your bank account, or consider having a professional check it.
What if my bank says the transactions were authorized and refuses to refund them?
Ask the bank to provide written documentation of their decision. If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at www.consumerfinance.gov. The CFPB investigates complaints against banks and can pressure them to reconsider. You can also dispute the charges through your credit card company if you used a credit card to make the unauthorized transaction.