Your bank is responsible for most fraudulent charges, but you have to report them
If someone hacks your bank account and takes money, you are usually not responsible for the loss — but only if you report it quickly. Federal law says your bank must cover fraudulent transfers, with one major exception: if you were negligent (careless) with your password or PIN, the bank can sometimes shift part of the cost to you. The speed of your report matters enormously. Report within two business days and your maximum loss is $50. Wait longer and it can climb to $500 or more.
The catch is that "hacked" means different things. If a criminal guessed your password because you used "password123," that is negligence and the bank may not cover it. If a criminal stole your login through a phishing email or malware on your computer, that is not your fault and the bank covers it. The bank has to prove you were careless — they cannot just assume it.
Key Takeaways
- Report unauthorized transfers to your bank within two business days to limit your loss to $50; waiting longer can cost you up to $500.
- Your bank covers most fraudulent charges unless you were negligent with your password, PIN, or security information.
- Call your bank's fraud line when ready — do not email or use the app — and ask them to freeze your account and issue a new debit card.
- Get the fraud report number in writing and keep a record of every conversation, including the date, time, and name of the person you spoke to.
- If your bank denies your claim, you can file a complaint with your state banking regulator or the Consumer Financial Protection Bureau.
How federal law protects you
Regulation E is the federal rule that covers electronic transfers from your bank account. It says your bank must refund unauthorized transfers — meaning transfers you did not make and did not authorize. This includes debit card fraud, ACH transfers (bank-to-bank transfers), wire transfers, and ATM withdrawals made by someone else.
The law sets a timeline and a dollar limit. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you report it after two business days but within 60 days, your liability can be up to $500. If you wait more than 60 days, you may lose all the money — the bank is no longer required to refund it.
The clock starts when you discover the fraud, not when it happened. If your account was hacked on a Friday but you do not check your balance until the following Wednesday, your two-day window starts on Wednesday. This is why checking your account regularly matters.
When the bank can refuse to refund you
Your bank can deny your fraud claim if they can show you were negligent. Negligence means you did something careless that made the hack easier. Using a weak password, writing your PIN on a sticky note, sharing your login with someone, or ignoring a suspicious email that led to malware — these are all negligence.
The bank has to prove negligence. They cannot just say "we think you were careless." They have to show evidence that your behavior made the fraud possible. If you used a strong, unique password and the criminal still got in through a phishing attack or a data breach at another company, that is not negligence — that is a criminal attack, and the bank covers it.
Some banks also have a rule that if you do not report fraud within a certain window, you lose coverage. This is why the two-day and 60-day important date matter so much. Even if you were not negligent, waiting too long can cost you money.
What to do the moment you notice fraud
Call your bank's fraud line when ready. Do not email, do not use the app, do not wait until business hours if it is after hours — call the number on the back of your debit card or on your bank statement. Many banks have 24-hour fraud lines. Tell them you have unauthorized transactions and ask them to freeze your account right away.
Ask the bank to issue a new debit card with a new number. The old card is compromised and should not be used again. Ask them to reverse the fraudulent charges. Some banks do this when ready; others take a few days to investigate. Ask what the timeline is.
Get the fraud report number in writing. This is your proof that you reported it and when. Write down the date, time, and name of the person you spoke to. If the bank sends you a written confirmation, keep it. You may need this if the bank later denies your claim or if you have to file a complaint.
What happens while the bank investigates
After you report fraud, your bank will investigate. This usually takes 10 business days, though the bank can extend it to 45 days if they need more time. During the investigation, the bank may temporarily refund the money to your account, or they may leave it frozen. Ask them which one they are doing.
The bank will look at the transactions, the device used, the location, and other details to determine whether they were really unauthorized. They may contact merchants or other banks involved. They may ask you questions about your account activity.
Once the investigation is done, the bank will tell you the result. If they find the transactions were unauthorized, they refund the money and close the case. If they find you were negligent or if they cannot prove the transactions were unauthorized, they may deny your claim. If they deny it, you have the right to dispute it further.
What to do if your bank denies your claim
If your bank refuses to refund the money, ask them in writing why they denied it. They must give you a reason. If they say you were negligent, ask them to explain what you did wrong and what evidence they have. If their reason does not make sense, you can file a complaint.
You can file a complaint with your state banking regulator. Each state has a banking department or financial regulation office. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can pressure banks to reverse decisions.
Keep all documentation: the fraud report number, the bank's written response, your account statements, and records of every conversation. If you end up in a dispute, this paper trail is your evidence.
How to reduce the risk of being hacked
Use a strong, unique password for your bank account — at least 12 characters, with uppercase and lowercase letters, numbers, and symbols. Do not use the same password for multiple accounts. If one account is breached, criminals will try that password everywhere else.
Turn on two-factor authentication if your bank offers it. This means you have to enter a code from your phone or email in addition to your password. Even if a criminal has your password, they cannot get in without that second code.
Do not click links in emails claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser. Phishing emails look real but they are designed to steal your login. Your bank will never ask for your password or PIN in an email.
Check your account regularly — at least once a week. The faster you spot fraud, the faster you can report it and the less money you lose. Set up account alerts if your bank offers them; many will text or email you when a large transaction happens.
Frequently Asked Questions
What if the hacker transferred money to another bank account?
The same rules explore. Report it to your bank within two business days. Your bank will work with the other bank to try to recover the money. This takes longer than reversing a debit card charge — sometimes weeks — but you are still protected by the $50 liability cap if you report quickly.
Does my bank have to refund me if I fell for a phishing email?
Yes, unless the bank can prove you were negligent. Falling for a phishing email is not negligence — phishing attacks are designed to fool people. The bank covers it. However, if you ignored multiple warnings or used an obviously weak password, the bank might argue negligence.
What if my account was hacked but no money was taken?
Report it anyway and ask your bank to freeze the account and issue a new card. Even if no money is missing yet, the hacker has your login and could take money later. Getting ahead of it protects you. Also ask your bank to check for any pending transfers or changes to your account settings.
Can I get my money back if I wait more than 60 days to report?
The law says you are not protected after 60 days, but some banks may refund you anyway. It depends on the bank's policy and the circumstances. Call and ask, but do not count on it. The 60-day window is your safety net — do not miss it.
What if my bank says I authorized the transaction?
Dispute it. If you did not authorize it, tell the bank that clearly. The bank has to prove you authorized it — they cannot just assume it. Ask them what evidence they have. If they cannot show a signature, a PIN entry, or a clear record of your authorization, push back on their decision.