What happens when your bank account is hacked

When someone gains unauthorized access to your bank account and takes money, your bank has a legal responsibility to investigate and often to return the funds. The speed and outcome depend on how quickly you report it, what type of account was compromised, and whether the thief moved the money out of the bank entirely.

The key difference is between unauthorized transfers (someone used your account without permission) and authorized transfers you later regret (you sent money yourself, even if tricked into doing so). Banks treat these very differently. If someone else accessed your account and moved money, you have stronger protections. If you were socially engineered into sending money yourself, recovery is harder but still possible in some cases.

Your first step is always to contact your bank when ready — the same day you discover the theft if possible. The sooner you report it, the sooner the bank can freeze the account, stop further transfers, and begin tracing where the money went.

Key Takeaways

  • Report the theft to your bank the same day you discover it, either by phone or by visiting a branch in person — do not wait for online chat or email.
  • Your bank is required by federal law to investigate unauthorized transfers and often must return your money within a set timeframe, though the process can take weeks.
  • If the thief moved money to another bank, your bank will contact that bank to try to recover it, but success depends on how quickly you reported and whether the receiving bank cooperates.
  • Document everything: keep records of when you reported it, who you spoke to, what was stolen, and any suspicious activity on your account leading up to the theft.
  • If your bank denies your claim or delays unreasonably, you can file a complaint with your state banking regulator or the Consumer Financial Protection Bureau.

Report to your bank when ready

Call your bank's fraud line right away. Do not use the number on the back of your card if you suspect the card itself was compromised — look up the number on your bank's official website or a recent statement instead. Explain what happened: when you first noticed the unauthorized activity, what transactions were fraudulent, and how much money was taken.

The bank will ask you to verify your identity and may ask detailed questions about your account activity. Be honest about what you recognize and what you do not. If you cannot remember your login password or when you last changed it, say so — this information helps the bank understand how the account was breached.

Ask the bank representative to freeze your account when ready to prevent further unauthorized transfers. Request written confirmation of your report, including the date, time, the name of the person you spoke to, and a reference number for the fraud case. Write down this information yourself as well.

Understand what your bank must do

Under federal law (specifically Regulation E, which covers electronic fund transfers), your bank must investigate your claim and determine whether the transfers were truly unauthorized. If they were, the bank must return your money, usually within 10 business days, though the investigation itself can take up to 45 days.

The bank's investigation includes contacting the receiving bank if your money was sent to another institution. If the receiving bank still has the funds, it can freeze them and return them to your bank. If the money has already been withdrawn or transferred again, recovery becomes much harder — but the bank must still try and must document what happened.

If your bank concludes the transfers were unauthorized, it must credit your account for the full amount. If it concludes they were authorized (for example, if you were tricked into sending money yourself), it can deny your claim, but it must explain its reasoning in writing.

What to do if money went to another bank

When a thief transfers money from your account to another bank account — whether at the same institution or a different one — your bank will initiate what is called a clawback request or reversal. This is a formal request to the receiving bank asking it to freeze the funds and return them.

The receiving bank has a window of time to respond, usually a few business days. If the receiving account is still open and the money has not been withdrawn, the receiving bank will typically freeze it and return it to your bank. If the money has already been withdrawn in cash or transferred elsewhere, the receiving bank will document that and report it back to your bank.

This process can take two to four weeks. Your bank should keep you updated on the status. If the receiving bank does not cooperate or is slow to respond, your bank can escalate the matter, but there is a limit to what it can force another institution to do.

Protect your account while the investigation happens

While your bank investigates, keep your account frozen or heavily monitored. Many banks will issue you a new debit card and new online login credentials as a precaution. Use these new credentials, not the old ones.

Change your password to something you have never used before — a random combination of at least 12 characters, including numbers, uppercase and lowercase letters, and symbols. Do not reuse passwords across different websites or accounts.

Check your account daily for any new suspicious activity. If you see more unauthorized transfers, report them to your bank when ready and ask them to update your fraud case. Take screenshots or photos of any suspicious transactions as evidence.

What to do if your bank denies your claim

If your bank investigates and concludes the transfers were authorized — perhaps because you were tricked into sending the money yourself — it can deny your claim. This is frustrating, but it does not mean you have no options.

First, ask the bank in writing to explain exactly why it concluded the transfers were authorized. Request copies of all documentation from its investigation. Read this carefully to see if there are facts the bank got wrong or did not consider.

If you believe the bank made an error, you can file a complaint with your state's banking regulator or with the Consumer Financial Protection Bureau (CFPB). The CFPB accepts complaints online at consumerfinance.gov. Explain what happened, why you believe the transfers were unauthorized, and what the bank said when it denied your claim. The CFPB will forward your complaint to the bank, which must respond within 15 days.

A CFPB complaint does not may provide the bank will reverse its decision, but it creates a record and puts pressure on the bank to reconsider. If the bank still refuses, you can pursue a civil lawsuit, though this is expensive and time-consuming.

Recover money sent through wire transfer or peer-to-peer payment

If the thief used your account to send money via wire transfer (through services like Western Union or MoneyGram) or through peer-to-peer apps (like Venmo, PayPal, or Cash App), recovery is much harder. These services move money quickly and often irreversibly.

Still report it to your bank when ready. Your bank will investigate whether the transfer was truly unauthorized. If it was, the bank must return your money from its own funds — it cannot recover the wire or payment itself, but it is responsible for reimbursing you.

At the same time, contact the wire service or peer-to-peer app directly. Explain that the transfer was fraudulent and ask them to freeze the receiving account and reverse the transaction if possible. This rarely works once the money has been withdrawn, but it is worth trying when ready.

Frequently Asked Questions

How long does it take to get my money back?

Your bank must investigate within 45 days and usually returns money within 10 business days if it determines the transfer was unauthorized. If the money went to another bank, add two to four weeks for the receiving bank to respond. In total, expect four to eight weeks in most cases.

What if I cannot prove the transfer was unauthorized?

You do not need to prove it — your bank must prove it was authorized. If you did not make the transfer and did not give anyone permission to make it, tell the bank that clearly. The bank must investigate and determine whether your account was compromised or whether someone tricked you into authorizing it.

Am I responsible for the stolen money while the bank investigates?

No. Once you report the theft, your bank cannot hold you responsible for the unauthorized transfers. You are not liable for overdraft fees or other charges that result from the theft either, though you should ask the bank to reverse those as well.

What if the thief used my account to send money to themselves?

Report it the same way. Your bank will investigate and, if it determines the transfer was unauthorized, will return your money. The bank may also work with law enforcement to identify the thief, though this is not may provide.

Can I get my money back if I was tricked into sending it?

This is harder. If you were socially engineered into authorizing the transfer yourself, the bank may say you authorized it and deny your claim. However, some banks will still help if the scam was sophisticated or if you can show the recipient account was used for fraud against others. Ask your bank to investigate anyway — it costs nothing to report it.