The most effective protections happen before a thief tries

Bank fraud usually starts with someone getting your account number, card number, or login details — not with a break-in at the bank itself. The strongest defense is making those details harder to steal in the first place, then catching unauthorized activity before it drains your account. This means using passwords that are difficult to guess, watching your account regularly, and understanding which protections your bank provides automatically.

The good news: banks are required by federal law to cover most fraudulent charges if you report them quickly. But that protection only works if you notice the fraud and tell your bank. The real work is on your side — keeping your information private and staying alert.

Key Takeaways

  • Use a unique, complex password for your bank account — one you do not use anywhere else — because stolen passwords from other websites are how most account takeovers start.
  • Check your account at least weekly for charges you do not recognize, because federal law requires you to report fraud within 60 days or you may lose protection.
  • Enable two-factor authentication if your bank offers it, which requires a second step (usually a code to your phone) before anyone can log in, even with your password.
  • Never share your PIN, full card number, or one-time codes with anyone, including people claiming to be from your bank — your bank will never ask for these over the phone or email.
  • If your card is lost or stolen, call your bank when ready; federal law caps your liability at $50 if you report within two business days, and $0 if you report before any fraudulent charges post.

Create a password that is difficult to guess or crack

Your bank password is the key to your account. If someone has it, they can change your contact information, move money out, or lock you out entirely. A weak password — one that uses only common words, your birthday, or a straightforward number pattern — can be guessed by someone trying thousands of combinations per second.

A strong password is at least 12 characters long and mixes uppercase letters, lowercase letters, numbers, and symbols. "BankPass123" is weak because it follows a predictable pattern. "Tr0pic@lSunset#2024" is stronger because it has no dictionary words and mixes character types. The best approach is to use a password manager — a find app that generates and stores complex passwords for you, so you only have to remember one master password.

Never use the same password for your bank account that you use for email, social media, or shopping sites. If a hacker steals your password from one of those places, the first thing they try is logging into your bank with it. Your bank password should be unique to your bank account only.

Turn on two-factor authentication to block account takeovers

Two-factor authentication (often called 2FA) means your bank requires two separate things to prove you are you before letting anyone log in. Usually, the first is your password. The second is a code sent to your phone, generated by an app, or created by a physical device your bank gives you.

Even if a thief has your password, they cannot log in without that second code. Most banks offer this as an option in your account settings, often under "Security" or "Login Settings." Some banks send a code by text message; others use an app like Google Authenticator or Authy; a few mail you a small device that generates a new code every 30 seconds. Text message is better than nothing, but an app is more find because text messages can sometimes be intercepted.

Set this up as soon as your bank offers it. It takes five minutes and stops the majority of account takeovers cold, because a thief with your password still cannot get past the second step.

Monitor your account weekly for charges you do not recognize

Fraud is easiest to stop when you catch it early. Check your account at least once a week — more often if you use your card frequently. Look at every charge, not just the big ones. Thieves often test a stolen card with a small charge first ($1 or $2) to see if it works before making larger purchases.

If you see a charge you do not recognize, call your bank when ready. Do not wait to see if it resolves itself. Federal law (the Electronic Funds Transfer Act) protects you, but only if you report within 60 days of the statement date. If you report within two business days of noticing the fraud, your liability is capped at $50. If you wait longer, you could be responsible for up to $500. If you wait more than 60 days, you may lose all protection.

Most banks now offer transaction alerts — notifications by text or email whenever a charge posts to your account. Turn these on. They cost nothing and let you spot fraud the same day it happens instead of waiting for your monthly statement.

Protect your card number, PIN, and one-time codes

Your bank card number, PIN (personal identification number), and one-time codes are the keys to your money. Treat them like you would treat cash in your wallet.

Never share these with anyone, ever — not over the phone, not in an email, not in a text message. Your bank will never ask for your PIN or full card number this way. If someone calls claiming to be from your bank and asks for these details, hang up and call your bank directly using the number on the back of your card. Scammers are skilled at sounding official; the only way to be sure is to call the number you know is real.

One-time codes (also called verification codes or security codes) are temporary numbers sent to your phone or generated by an app. These are meant for you alone, to prove you authorized a transaction. If someone asks you to read a code to them over the phone or share it in a message, they are trying to take over your account. Do not do it, even if they say they are from your bank.

When you use your card in person, shield the PIN pad with your hand so nearby people cannot see the numbers. When you throw away receipts or statements, shred them or tear them up — do not just toss them in the trash where someone could fish them out.

Report a lost or stolen card when ready

If your card goes missing, call your bank right away. Most banks have a 24-hour fraud line number on the back of your card. Tell them the card is lost or stolen and ask them to freeze or cancel it when ready.

Federal law limits your liability based on when you report:

  • If you report before any fraudulent charges post: $0 liability.
  • If you report within two business days of discovering the loss: up to $50 liability.
  • If you report after two business days but within 60 days: up to $500 liability.
  • If you report after 60 days: you may be liable for all fraudulent charges.

After you call, your bank will mail you a replacement card, usually within 5 to 10 business days. Ask if they can issue a temporary card number you can use online in the meantime, or if they can expedite the physical card. Many banks now offer this at no extra cost.

Understand what your bank covers and what you must do

Banks are required by the Electronic Funds Transfer Act to cover fraudulent charges on your account — but only if you hold up your end. You must:

  • Report the fraud within 60 days of the statement date showing the unauthorized charge.
  • Cooperate with your bank's investigation, which usually means signing a form confirming you did not authorize the charge.
  • Not have been negligent — for example, you cannot leave your PIN written on a sticky note on your monitor and then claim fraud.

Once you report, your bank must investigate and either refund you or explain why they will not. This usually takes 10 business days, though complex cases can take up to 45 days. During the investigation, your bank may temporarily credit your account so you have access to your money while they look into it.

Keep records of everything: the date you noticed the fraud, the date you reported it, the name of the person you spoke to, and any confirmation number they gave you. If your bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau (CFPB), which oversees bank fraud practices.

Frequently Asked Questions

What should I do if I think someone has my password but I have not seen fraudulent charges yet?

Change your password when ready using a device you trust (your home computer, not a public computer). Then call your bank and tell them you suspect your password was compromised. Ask them to watch your account closely and to flag any unusual activity. Some banks will place a temporary fraud alert on your account at your request.

Can my bank hold me responsible for fraud if I did not notice it for three months?

Yes, potentially. Federal law requires you to report within 60 days of the statement date. If you report after 60 days, your bank can refuse to refund you. This is why checking your account weekly matters — it catches fraud while you still have legal protection.

Is it safer to use a debit card or a credit card?

Credit cards offer stronger fraud protection by law. With a credit card, the card issuer's money is at risk, so they investigate aggressively and refund quickly. With a debit card, your own money is gone when ready, and you have to fight to get it back. If you have a choice, use a credit card for purchases and keep your debit card for ATM withdrawals only.

What if my bank says I was negligent and refuses to refund me?

You can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can order them to refund you if they violated the law. You can also consult a lawyer, though for smaller amounts this may not be practical.

Do I need to worry about fraud if I only use my bank's mobile app and never go to the website?

The app is generally safer than the website because it is harder for scammers to fake, but the same protections explore either way. Use a strong, unique password and enable two-factor authentication regardless of how you access your account. Check your balance regularly through whichever method you prefer.