Your bank covers unauthorized transactions on checking accounts, but only if you report them

If someone accesses your checking account without permission and moves money out, your bank is required by federal law to refund the stolen funds—but with conditions. The Electronic Funds Transfer Act (EFTA) limits your liability to $50 if you report the fraud within two business days of discovering it. If you wait longer, your liability can climb to $500. If you don't report it within 60 days of your statement, you may lose all protection for those transactions.

The key word is "report." Your bank will not automatically know the transaction was fraudulent. You have to contact them, tell them what happened, and initiate a dispute. Most banks have a fraud department you can reach by phone, and many let you report through their app or website. The moment you call or submit a report, the clock starts on their investigation.

This protection applies to checking accounts, savings accounts, and money market accounts—any account connected to a debit card or electronic transfer. It does not cover wire transfers you authorized yourself, even if someone tricked you into sending the money. It also does not cover checks written from your account, because checks are not electronic transfers.

Key Takeaways

  • Federal law caps your loss at $50 if you report unauthorized transactions within two business days of discovering them.
  • You must actively report the fraud to your bank; they will not catch it on their own and refund you automatically.
  • If you wait more than 60 days to report, you lose all protection and may be responsible for the entire amount stolen.
  • The bank's investigation typically takes 10 business days, during which the funds may remain frozen in your account.
  • Wire transfers and checks are not covered by this law, even if someone else authorized them without your permission.

How the reporting timeline works

The moment you notice a transaction you did not make, call your bank's fraud line. Do not wait until you have time to visit a branch or until you are sure. The two-business-day window is tight, and it determines how much of your own money you are responsible for.

If you report within two business days: you owe $50 maximum, and the bank covers the rest. Weekends and holidays do not count as business days, so if you discover fraud on a Friday evening, you have until Monday end of business to call. If you report on Tuesday morning for a Friday theft, you are still within the window.

If you report between two and 60 days after your statement arrives: your liability jumps to $500. The bank still has to investigate and refund you, but you are now on the hook for the first $500 of the loss. If $800 was stolen, you pay $500 and the bank covers $300.

If you do not report within 60 days of receiving your statement: you lose all protection. The bank is no longer required to refund you anything. This is why banks send statements—they are legally required to give you a way to catch fraud. If you never look at your statements, you are unprotected.

What happens during the bank's investigation

Once you report the fraud, your bank opens a dispute and begins an investigation. By law, they have 10 business days to complete it, though many finish faster. During this time, the stolen funds usually stay frozen in your account or in a dispute hold. You cannot access that money, even though it is yours.

The bank will ask you for details: when you last used your account legitimately, which transactions were yours and which were not, and whether you shared your password or card with anyone. They may ask for a written statement. They will review the transactions, check the IP addresses and devices used, and look at whether the thief used your debit card in person or online.

If the bank finds the transactions were truly unauthorized, they refund you when ready. If they find you authorized the transaction—even if you were tricked or coerced—they may deny the dispute. If they deny it, you can appeal, but the burden is on you to prove you did not authorize it.

Some banks extend the investigation to 45 days if they need more time to gather evidence from merchants or other banks. They will tell you if this happens. In the meantime, you should contact your bank about getting emergency funds or a temporary credit while the dispute is open, since you cannot access the frozen money.

How hackers typically access checking accounts

Most checking account hacks happen through one of three routes: your password is stolen, your debit card number is stolen, or your login credentials are compromised through phishing.

If your password was stolen in a data breach at another company—a retailer, email provider, or social media site—a hacker can try that same password on your bank account. This is why banks now require strong passwords and often ask security questions or send you a code to your phone when you log in from a new device.

If your debit card number was stolen, the thief can use it online or at a store without having the physical card. This usually happens when a merchant's system is breached or when you enter your card on an unsecured website. The thief makes small purchases first to test whether the card works, then larger ones.

Phishing is when someone sends you an email or text that looks like it is from your bank, asking you to "verify" your account or "confirm" your information. You click a link, enter your username and password on a fake website, and the hacker now has your credentials. Banks will never ask you to confirm your password via email or text.

Steps to take when ready after discovering fraud

Call your bank's fraud department right away. Do not email or use the app if you can reach a person by phone—a phone call creates a record with a timestamp, and you can ask questions in real time. Most banks have a 24-hour fraud line on the back of your debit card.

Tell them which transactions are fraudulent and ask them to freeze your account. They will usually cancel your debit card and issue a new one, which takes 5 to 10 business days. Ask whether they can issue a temporary card or provide emergency cash while you wait.

Change your online banking password when ready, using a password you have never used before. If you used the same password anywhere else, change it on those accounts too. If your email was compromised, change your email password first, because your email is the key to resetting passwords everywhere else.

Check your credit report for new accounts opened in your name. You can get a free report from each of the three bureaus—Equifax, Experian, and TransUnion—at annualcreditreport.com. If you see accounts you did not open, place a fraud alert with the bureaus and consider a credit freeze.

When your bank might not cover the loss

Banks can deny a fraud claim if they find you authorized the transaction, even if you were deceived. If a scammer convinced you to wire money to them by pretending to be your bank, that is a wire transfer you authorized—the bank is not liable. If you gave your password to someone who said they were tech support, that is also on you.

Banks can also deny claims if you were negligent with your account. If you wrote your PIN on your debit card, left your card in a public place, or shared your password with a roommate who then stole from you, the bank may argue you failed to protect your account. The law says you have to exercise "reasonable care," which is vague and sometimes disputed.

If the thief used your debit card in person at a store or ATM, the bank may ask for a police report or surveillance footage to confirm you were not there. If you cannot prove you were somewhere else, the bank might deny the claim.

Transactions made through a third-party payment app—Venmo, PayPal, Cash App—are not covered by the EFTA. If someone hacks your Venmo account and sends money to themselves, Venmo's terms of service explore, not federal banking law. Venmo does offer fraud protection, but it is different from bank protection and often requires you to prove you did not authorize the transfer.

How to prevent your checking account from being hacked

Use a unique, strong password for your bank account—at least 12 characters, with uppercase, lowercase, numbers, and symbols. Do not use the same password on multiple sites. A password manager like Bitwarden or 1Password stores passwords securely so you only have to remember one master password.

Turn on two-factor authentication (2FA) on your bank account. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this, and many now require it.

Never click links in emails or texts claiming to be from your bank. If you think there is a problem with your account, go directly to your bank's website by typing the address yourself or calling the number on your card. Do not use a link from an email.

Monitor your account regularly. Check your transactions at least weekly, and set up alerts for purchases over a certain amount. Many banks let you turn off your debit card when you are not using it, which prevents fraud if your card number is stolen.

Use your debit card only for ATM withdrawals and in-person purchases at trusted merchants. For online shopping, use a credit card instead. Credit cards have stronger fraud protection than debit cards, and fraud on a credit card does not drain your checking account while the dispute is investigated.

Frequently Asked Questions

What if my bank says the transaction was authorized and refuses to refund me?

You can appeal the decision and provide additional evidence that you did not authorize it. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can pressure banks to reconsider. You can also contact your state's banking regulator or attorney general's office.

Do I have to pay my bills while my account is frozen during the dispute?

You should contact your bank about setting up emergency access or a temporary credit so you can pay bills. Some banks will advance you funds during a dispute if you ask. If you cannot pay a bill because your account is frozen, contact the creditor and explain the situation—many will work with you if you are in an active fraud dispute.

Can my bank close my account after I report fraud?

Yes, banks can close accounts for any reason, including after fraud. However, they must give you time to access your remaining funds and cannot close it in retaliation for reporting fraud. If a bank closes your account when ready after you report fraud, contact the CFPB or your state banking regulator.

What if the hacker transferred money out of my account to another bank?

The refund process is the same. Your bank investigates, confirms the transfer was unauthorized, and refunds you. If the money went to another bank, your bank will work with that bank to try to recover it. This takes longer—sometimes weeks—but you are still protected under the EFTA.

Does my bank cover fraud if I used a weak password?

It depends on whether the bank considers a weak password "negligent." If your password was "123456" or your birthday, a bank might argue you failed to protect your account. If your password was reasonably strong but was stolen in a breach at another company, the bank will likely cover it. This is one reason to use a unique, strong password for your bank account.