What happens when money is stolen from your account

When someone gains unauthorized access to your bank account and moves money out, your bank has a legal obligation to investigate and often to return the funds—but only if you report it within a specific window. The speed of recovery depends on how the money left your account: a wire transfer to another bank is harder to reverse than a debit card charge, and money sent through a payment app may be gone for good. Your first step is to contact your bank when ready, not by email but by phone to the number on the back of your card or on your statement.

The bank will freeze your account to stop further unauthorized transactions, then open an investigation. During this time, you cannot access the stolen funds, but you can usually still receive deposits and make transfers from any remaining balance. The investigation itself takes 10 business days at minimum under federal rules, though complex cases can stretch to 45 days. You will need to provide a written statement of the unauthorized transactions within a few days of your call.

Key Takeaways

  • Call your bank when ready using the number on your card—do not email—and report the specific transactions that were not yours.
  • Your bank must investigate within 10 business days and return your money if the transactions were truly unauthorized, with some exceptions for wire transfers and ACH payments.
  • You are protected under the Electronic Funds Transfer Act for debit card fraud and most ACH transfers, but wire transfers sent by someone with access to your account are harder to recover.
  • File a police report and an identity theft report with the Federal Trade Commission if the theft involved account takeover, not just card fraud.
  • Change your password, enable two-factor authentication, and review your account settings for any changes to your contact information or linked accounts.

The difference between account takeover and card fraud

If someone used your debit card number without having your password or access to your online banking, that is card fraud. Your bank will likely refund the charge within a few days, and you are protected under the Electronic Funds Transfer Act for up to $50 of liability if you report it within two business days. If you report it later, your liability can rise to $500.

Account takeover is different and more serious. Someone has your username and password, or has changed your password and locked you out. They may have set up a new payee in your bill pay system, changed your mailing address, or linked a new external account to transfer money out. This is treated as a potential identity theft case, not just fraud, because the attacker has control of your account itself. Recovery is slower and less certain, especially if the money was sent by ACH transfer or wire to another bank.

What your bank will and will not recover

Under the Electronic Funds Transfer Act, your bank must return money stolen through debit card fraud, ATM withdrawals, and most ACH transfers—as long as you report within the required window. The bank's liability is clear: if the transaction was unauthorized, they pay you back. This covers most everyday theft scenarios.

Wire transfers are the exception. Once money leaves your bank via wire, it is in another bank's system, and reversing it requires cooperation from that bank and the receiving account holder. If the wire was sent by someone who had your online banking credentials, your bank may argue you were negligent in protecting your password, which can reduce or eliminate their obligation to refund. Some banks will still pursue recovery on your behalf, but there is no may provide. Money sent through payment apps like Venmo, PayPal, or Cash App is even harder to recover because these are not covered by the same federal protections—the app company decides whether to reverse the transaction.

If your bank finds that you were negligent—for example, you wrote your password on a sticky note or shared it with someone—they may deny the claim. This is rare, but it happens. Document everything you did to protect your account so you can show you took reasonable precautions.

Steps to take when ready after discovering the theft

Call your bank's fraud line right now. Do not wait until business hours if it is after hours; most banks have 24-hour fraud lines. Have your account number and a list of the unauthorized transactions ready. Tell the representative the exact dates and amounts of each fraudulent transaction. The bank will place a fraud alert on your account and freeze it to prevent further unauthorized activity.

Ask the bank to send you a written summary of the investigation. This is not automatic; you have to request it. The bank will send this within 10 business days of your report. Keep this document—you will need it if you file a police report or dispute anything later.

Change your password when ready from a different device. If someone has your current password, changing it from your phone or computer might not help if they also have access to your email. If possible, use a different computer or phone than the one you normally use. Make the new password at least 16 characters, with numbers, uppercase letters, and symbols. Do not reuse a password you have used before.

Enable two-factor authentication on your account. This means the bank will send a code to your phone or email every time someone tries to log in from a new device. Even if someone has your password, they cannot access your account without this code. Check your bank's website for the option—it is usually under security settings.

Reporting to law enforcement and the Federal Trade Commission

If the theft involved account takeover or identity theft—meaning someone changed your password, address, or contact information—file a report with your local police department. You do not need to go in person; most departments allow online reporting. Get the report number and keep it. This creates an official record that can help if the thief opens other accounts in your name.

File an identity theft report with the Federal Trade Commission at IdentityTheft.gov. This is free and takes about 10 minutes. The FTC will create a recovery plan and send you a letter you can use to dispute fraudulent accounts with credit bureaus and other companies. If the thief opened credit cards or loans in your name, this letter is essential.

Place a fraud alert with the three credit bureaus—Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts. You can place this alert for free by contacting any one of the three bureaus; they will notify the other two. The alert lasts one year and can be renewed.

What to do while the investigation is underway

Your bank's investigation takes 10 business days minimum. During this time, your account is frozen, meaning you cannot withdraw the stolen funds, but you can still receive direct deposits and make transfers from any remaining balance. If you need access to money, ask your bank about opening a temporary account or getting a replacement debit card linked to a different account.

Do not spend time trying to contact the receiving bank or the person who received your money. Your bank will do this as part of the investigation. If you contact them directly, you may complicate the recovery process or tip off the thief that you have discovered the theft.

Monitor your credit report for new accounts opened in your name. You can check your credit report free once per year at AnnualCreditReport.com. If you see accounts you did not open, dispute them when ready with the credit bureau and the company that opened the account.

Why some money cannot be recovered

If the thief moved money through multiple accounts or converted it to cryptocurrency, recovery becomes nearly impossible. Once money enters the cryptocurrency system, it is outside the banking system and beyond your bank's reach. If the money was sent to a cash-out service or used to buy gift cards, it is likely gone.

If you delayed reporting the theft—more than 60 days after your statement was sent—your bank may deny the claim. This is why the first call should happen the day you discover the theft, even if you are not sure yet whether it was fraud. The bank can investigate retroactively, but your window of protection shrinks with time.

If your bank determines you were grossly negligent—for example, you gave your password to someone or left your computer unlocked in a public place—they may refuse to refund the money. This is rare, but it is a risk if your security practices were very poor.

Frequently Asked Questions

How long does it take to get my money back?

Your bank must complete the investigation within 10 business days. If they find the transactions were unauthorized, they must return the money within one business day of that finding. In practice, most refunds appear within 3 to 5 business days. Wire transfers and ACH transfers to other banks can take longer because the receiving bank must cooperate.

What if my bank says I was negligent and refuses to refund me?

You can dispute the bank's decision. Send a written letter to the bank's fraud department explaining why you believe you took reasonable precautions. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. These agencies can force the bank to reconsider.

Can I get my money back if it was sent through Venmo or PayPal?

These apps are not covered by the Electronic Funds Transfer Act, so recovery depends on the app's policies. Contact the app's support team when ready and report the transaction as unauthorized. Some apps will reverse the payment if the receiving account has not withdrawn the money yet. If the money has been withdrawn, recovery is unlikely.

Do I need to close my account and open a new one?

Not necessarily. Once you have changed your password and enabled two-factor authentication, your account is find again. Closing the account can actually complicate things if the bank is still investigating. Keep the account open until the investigation is complete and the money has been returned, then decide whether to close it based on your comfort level.

Will this affect my credit score?

Unauthorized transactions on your existing account should not affect your credit score because the bank is investigating and refunding the money. However, if the thief opened new credit accounts in your name, those will show up on your credit report and will hurt your score. Dispute these accounts when ready with the credit bureaus.