The first hour: stop the bleeding
Call your bank's fraud line right now, not the main number. The fraud line is staffed to freeze accounts and reverse transactions, and they expect you to be panicked. Have your account number ready but do not give it over email or through a callback number you find online—use the number on your card or statement.
Tell them: your account has been compromised, you did not authorise recent transactions, and you want the account frozen when ready. They will lock it within minutes. This stops the hacker from moving money out while you are on the phone with them.
Ask them to tell you which transactions were yours and which were not. Write down the names of anyone you speak to, the time, and what they told you. You will need this for the next steps.
Key Takeaways
- Call your bank's fraud line (the number on your card, not a web search result) and freeze the account before doing anything else.
- The bank will reverse fraudulent transactions, but only if you report them within a specific window—usually 30 to 60 days from the statement date.
- File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record and a recovery plan the bank must follow.
- Change your password from a different device (not the one that may be compromised) and enable two-factor authentication on every account that matters.
- Monitor your credit reports for new accounts opened in your name, which means the breach went beyond your bank account.
Understanding what the bank will and will not reverse
Your bank is required by federal law to reverse unauthorised transactions—charges you did not make or approve. The catch is timing. You have to report the fraud within 60 days of the statement date on which the fraudulent charge appears. After 60 days, the bank can refuse to reverse it.
If the hacker transferred money out of your account to another bank, that is also reversible, but it takes longer. The receiving bank has to be contacted, and if the money has already been withdrawn in cash, recovery becomes much harder. This is why freezing the account when ready matters.
Transactions you authorised but later regret—a purchase you changed your mind about, a subscription you forgot you signed up for—are not the bank's problem. The bank only reverses things you genuinely did not do.
Filing an identity theft report with the FTC
Go to IdentityTheft.gov and file a report. This is a federal site run by the Federal Trade Commission, and it creates an official record that you are a victim of identity theft. The report includes a recovery plan specific to your situation.
You will answer questions about what happened: when you noticed the fraud, which accounts were affected, what you have already done. The FTC does not investigate individual cases, but the report gives you legal standing if the bank drags its feet on reversals or if the hacker opened new accounts in your name.
Print or save the report. Send a copy to your bank along with a written statement describing the fraud. This creates a paper trail that protects you if there is a dispute later about whether you reported the fraud on time.
Changing passwords and enabling two-factor authentication
Do this from a different device—a phone, a tablet, or a computer that was not used to access the hacked account. If your main computer is compromised, logging in from that same computer just tells the hacker your new password.
Change the password on the hacked account first. Make it long (16 characters or more), random, and completely different from any password you have used before. Do not use your name, your birthday, or anything a hacker who has already stolen your information might guess.
Then enable two-factor authentication on that account. This means the bank will send a code to your phone or email every time someone tries to log in from a new device. Even if the hacker has your password, they cannot get in without that code. Most banks offer this through their settings menu or security page.
Do the same for your email account. If a hacker controls your email, they can reset passwords on every other account you own. Email is the master key.
Checking your credit reports for new accounts
A hacked bank account sometimes means the hacker has more of your information than just your login credentials. They may have your Social Security number, your address, and your date of birth—enough to open new credit cards or loans in your name.
Get your credit reports from all three bureaus: Equifax, Experian, and TransUnion. You can order them free at AnnualCreditReport.com, which is the official site. Do not use a third-party site that offers "free" reports but asks for a credit card.
Look for accounts you did not open. If you find any, contact the bureau that reported it and dispute it as fraudulent. The bureau has to investigate and remove it if it is not yours. Also contact the creditor directly and tell them the account was opened without your permission.
What happens if money was transferred to another bank
If the hacker moved money to a different bank, your bank will file what is called a Regulation E claim. This is a formal request to the other bank to reverse the transfer and return the money. The receiving bank has ten business days to respond.
If the money is still there, the receiving bank will freeze it and send it back. If it has already been withdrawn, the receiving bank will tell your bank that, and the case becomes harder. Your bank may still reverse the charge to your account (crediting you back), but the money may be gone.
This is why speed matters. The first hour after you notice the fraud is the window when the money is most likely still in the receiving account and recoverable.
Protecting yourself from the same thing happening again
The hacker got in somehow. They may have used a password you reused across multiple sites, or they may have bought your credentials from a data breach at another company. Find out which by checking HaveIBeenPwned.com, a site that tracks public data breaches.
If your email address appears in a breach, change the password on that account and on any other account that uses the same password. This is tedious, but it is the only way to stop a hacker who has your credentials from accessing everything you own.
Consider using a password manager like Bitwarden, 1Password, or KeePass. These tools generate random passwords for every site and remember them for you. You only have to remember one master password. This makes it nearly impossible for a hacker to access multiple accounts even if they crack one password.
Frequently Asked Questions
How long does it take to get my money back?
Unauthorised transactions are usually reversed within 10 business days if they were made with your debit card. Transfers to another bank take longer—up to 30 days for a full investigation. Your bank must credit your account while they investigate, so you should see the money back within a few days even if the investigation is still ongoing.
What if the bank says the transaction was authorised?
Dispute it in writing. Send a letter to the bank's fraud department stating that you did not authorise the transaction and requesting a reversal under Regulation E (for debit cards) or the Fair Credit Billing Act (for credit cards). Keep a copy. The bank then has to investigate and respond within 30 days.
Can the hacker get back in after I change my password?
Not if you change it from a different device and enable two-factor authentication. Two-factor authentication means they need both your password and a code sent to your phone. Even if they somehow get the new password, they cannot log in without that code.
Do I have to pay for credit monitoring?
No. You can check your credit reports free once a year at AnnualCreditReport.com. If you want to monitor them more often, some banks offer free monitoring to customers, and the FTC's recovery plan may include free monitoring for a set period. Paid services are optional.
What if the hacker opened a credit card in my name?
Contact the creditor when ready and tell them the account was opened fraudulently. Then dispute it with the credit bureau. You may also want to place a fraud alert on your credit file by contacting one of the three bureaus—they will notify the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name.