Your bank covers most unauthorized transactions, but the speed of your report matters

If someone gains access to your checking account and makes unauthorized transfers or withdrawals, your bank is required by federal law to refund the money—but only if you report it within a specific window. The Electronic Funds Transfer Act (EFTA) sets the rules: if you report the fraud within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report within 60 calendar days, you could lose up to $500. After 60 days, you may not recover anything.

The catch is that "discovering it" means the moment you realize something is wrong—not the moment the transaction happened. Many people don't check their accounts daily, so the clock doesn't start until you actually see the fraudulent activity. This is why setting up account alerts and checking your balance regularly matters more than most people realize.

Banks move quickly once you report. Most will issue a provisional credit within one to three business days while they investigate. The full investigation typically takes 10 business days, though complex cases can stretch to 45 days. During that time, the money is usually back in your account, even if the bank is still determining fault.

Key Takeaways

  • Report unauthorized transactions to your bank within two business days to limit your loss to $50; waiting longer increases your liability to $500 or more.
  • The clock starts when you discover the fraud, not when it occurred, so daily account monitoring protects you by catching problems early.
  • Banks must issue a provisional credit within one to three business days while they investigate, so you usually regain access to the money quickly.
  • Transfers to accounts at other banks take longer to reverse than debit card fraud, sometimes requiring the receiving bank's cooperation.
  • If your bank denies your claim, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau.

How the EFTA protection works in practice

The Electronic Funds Transfer Act protects you when someone uses your debit card, PIN, or online banking credentials without permission. It does not cover credit card fraud (which has its own rules under the Fair Credit Billing Act) or checks written on your account. If someone steals your checkbook and forges your signature, you have different protections under the Uniform Commercial Code, which varies by state.

The two-day window is strict. If you discover unauthorized activity on a Friday evening and don't report it until Monday, you've already passed the 48-hour mark. Some banks are lenient if you call first thing Monday morning, but they're not required to be. The safest approach is to call your bank's fraud line the moment you spot something wrong, even if it's after hours—most banks have 24/7 fraud reporting lines, and your call is timestamped.

Once you report, the bank must acknowledge your claim in writing within three business days. They'll ask you to sign an affidavit swearing the transactions were unauthorized. This is standard procedure and protects both you and the bank by creating a legal record. Don't skip this step—banks need it to justify the refund to their regulators.

What happens during the investigation

When you report fraud, your bank will freeze the compromised account and issue you a new debit card. They'll also begin tracing the unauthorized transactions. If the money left your account as a transfer to another bank, they'll contact that bank and ask them to hold the funds pending investigation. If it was a debit card transaction at a merchant, they'll request transaction records from the merchant and the payment processor.

The investigation timeline depends on where the money went. Debit card transactions at stores or online retailers are usually resolved within 10 business days because the merchant's records are clear and the funds haven't moved far. Transfers to another bank account take longer because the receiving bank must be contacted, and if the receiving account has already spent the money, recovery becomes complicated. In those cases, the investigation can stretch to 45 days.

During the investigation, you have access to the provisional credit, so you can pay bills and buy groceries normally. The bank is essentially lending you the money while they determine whether the fraud claim is valid. If they find that you authorized the transaction or that you were negligent in protecting your credentials, they can reverse the provisional credit and you'll owe the money back. This is rare but does happen—for example, if you shared your PIN with someone who then withdrew funds and claimed fraud.

When the bank denies your claim

Banks deny fraud claims when they believe you authorized the transaction or failed to exercise reasonable care in protecting your account. "Reasonable care" means you didn't write your PIN on your debit card, didn't share it with anyone, and didn't ignore obvious signs of compromise. If your account was compromised because you used the same password on your bank account as on a retailer's website that was hacked, the bank may argue you were negligent.

If your bank denies your claim, you have the right to dispute it. Send a written letter to the bank's dispute department (not the branch) stating why you believe the transactions were unauthorized. Include copies of any evidence: emails showing you didn't authorize the transaction, proof that your card was in your possession, or documentation that your credentials were compromised in a data breach. The bank must respond in writing within 10 business days.

If the bank still refuses, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB). The CFPB accepts complaints online at consumerfinance.gov. Include your bank's written denial, your evidence, and a clear explanation of why you believe the transactions were unauthorized. The CFPB will forward your complaint to the bank, which must respond within 15 days. This doesn't may provide a reversal, but it creates pressure and a paper trail.

Protecting yourself from future hacks

The best protection is preventing the hack in the first place. Use a unique, strong password for your online banking account—not one you've used anywhere else. Enable multi-factor authentication if your bank offers it; this requires a second form of verification (usually a code sent to your phone) before anyone can log in, even if they have your password. Check whether your bank offers transaction alerts, which notify you by text or email whenever money leaves your account. These alerts catch fraud within hours instead of days.

Monitor your credit reports for signs of identity theft. You can request a free credit report from each of the three major bureaus (Equifax, Experian, TransUnion) once per year at annualcreditreport.com. If someone opened accounts in your name, you'll see them here. You can also place a fraud alert on your credit file, which requires lenders to verify your identity before opening new accounts in your name.

If your checking account was hacked through a data breach at a retailer or service you use, consider whether your credentials were compromised elsewhere. Check haveibeenpwned.com, a free tool that tells you whether your email address appeared in known data breaches. If it did, change your password on any other accounts where you used the same one. This prevents attackers from using credentials stolen in one breach to access your bank account.

Transfers versus debit card fraud—different timelines

The type of fraud matters because it determines how fast your money comes back. If someone used your debit card number to make online purchases or withdrew cash from an ATM, the bank can usually reverse those transactions within 10 business days. The merchant or ATM operator has clear records showing the transaction, and the money either hasn't moved or is still in the merchant's account.

If someone transferred money from your account to another bank account—either through online banking, a wire transfer, or an ACH transfer—recovery is slower. The receiving bank must be contacted, and if the receiving account holder has already spent the money, the receiving bank may refuse to reverse it. The sending bank (yours) can still refund you under EFTA, but they'll pursue the receiving bank for reimbursement, which can take weeks. In the meantime, you get your money back from your bank.

International wire transfers are the hardest to recover. Once money leaves the U.S. banking system, your bank has limited ability to reverse it. If you authorized the transfer but were tricked into doing so by a scammer (a "social engineering" attack), EFTA may not protect you because you technically authorized it. This is why banks warn customers never to wire money to unknown recipients, even if someone claiming to be from the bank asks you to.

What to do right now if your account is compromised

Call your bank's fraud line when ready. Most banks have a 24/7 number on the back of your debit card or on their website. Tell them which transactions are unauthorized and ask them to freeze your account. They'll cancel your current debit card and mail you a new one, usually within three to five business days. Ask for a temporary card or emergency cash advance if you need money before the new card arrives.

Request a written summary of the unauthorized transactions. This becomes your evidence if you need to file a complaint later. Ask the bank when they'll issue the provisional credit and when you can expect the investigation to be complete. Get the name and direct number of the fraud investigator assigned to your case.

Change your online banking password when ready from a different device (not the one that may have been compromised). If you use the same password anywhere else, change it on those accounts too. Enable multi-factor authentication if you haven't already. Consider placing a fraud alert on your credit file by contacting one of the three credit bureaus; they'll notify the others automatically.

Frequently Asked Questions

What if I report the fraud after 60 days?

You lose EFTA protection and the bank has no legal obligation to refund you. However, many banks will still investigate and may refund the money as a courtesy, especially if the fraud was due to a data breach rather than your own negligence. Call your bank and explain the situation; the worst they can say is no. If they refuse, you can file a complaint with the CFPB, though it won't force them to refund you.

Does my bank cover fraud if I shared my password with someone?

Probably not. If you voluntarily shared your credentials with someone who then withdrew funds and you claim fraud, the bank will likely deny your claim because you failed to exercise reasonable care. The exception is if someone coerced you or tricked you into sharing it. If a scammer called pretending to be from your bank and you gave them your password, that's different—document the call and explain it to your bank.

Can the bank hold my money while they investigate?

No. They must issue a provisional credit within one to three business days. You can spend this money normally. If the investigation later determines the transaction was authorized, they can reverse the provisional credit, but this is rare. The provisional credit is essentially a loan from the bank while they investigate.

What if the hacker transferred money to another bank and spent it?

Your bank still refunds you under EFTA. They'll pursue the receiving bank for reimbursement, but that's between the banks. You get your money back from your bank regardless of whether they recover it from the receiving bank. If the receiving bank can't recover the funds, your bank absorbs the loss.

Do I need to file a police report?

Not required by law, but it helps. A police report creates an official record of the crime and can strengthen your fraud claim if the bank denies it. You can file a report online through your local police department's website or in person at a precinct. Give them the same information you gave your bank: dates, amounts, and which transactions were unauthorized.