Your bank is responsible for most fraudulent charges, but only if you report them quickly
If someone gains access to your bank account without permission, federal law limits what you owe. Under the Electronic Funds Transfer Act, your liability depends on how fast you report the theft. If you catch it within two business days, you lose at most $50. If you wait longer than 60 days after your statement arrives, you could lose everything taken after the 60-day mark — but your bank may cover it anyway, depending on their policy.
The first step is to call your bank's fraud line when ready. Do not use the number on the back of your card if you think the card itself was compromised — look up the number on your bank's website or your statement instead. Tell them which transactions are not yours. They will freeze your account to stop further theft and start an investigation.
Your bank will issue you a new card and new account number within a few business days. Transfers and direct deposits linked to your old account number will fail, so you will need to update those with your employer, benefits programs, and any services you pay automatically.
Key Takeaways
- Report unauthorized transactions to your bank within two business days to limit your loss to $50; waiting longer can cost you thousands.
- Call your bank's fraud line directly using the number from their website, not the card itself, because the card may be compromised.
- Your bank will freeze the account and issue a new card and account number, which means updating any automatic payments or direct deposits.
- Keep records of every fraudulent transaction and the date you reported it, because your bank will ask for proof during their investigation.
- If your bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau or your state banking regulator.
What happens during the bank's investigation
Once you report the fraud, your bank has up to 10 business days to investigate. During this time, they will review the transactions you flagged and check whether they match your usual spending patterns. They will also look at how the account was accessed — whether someone used your debit card number, your online login, or a check.
The bank may ask you questions: Did you share your PIN? Did you use public WiFi? Did you receive any suspicious emails or texts? Answer honestly. They are not blaming you; they are trying to understand whether this was a data breach, a phishing attack, or something else. The answer affects whether other customers are at risk and whether the bank needs to notify law enforcement.
Most banks will credit your account temporarily while they investigate, so you are not without money. If they find the transactions were fraudulent, the credit becomes permanent. If they find you authorized them or were negligent (for example, you wrote your PIN on your card), they may reverse the credit — but this is rare.
How the fraud likely happened
Understanding how your account was breached helps you prevent it again. The most common routes are: someone stole your debit card or card number; you entered your login information on a fake website (phishing); malware on your computer or phone captured your password; a data breach at a store or website exposed your information; or someone you know had access to your account.
If your physical card was stolen, the thief can use it when ready. If your card number was stolen, they can make online purchases or set up recurring charges. If your login credentials were stolen, they can transfer money out, change your password, or add a new recipient to your bill pay.
Ask your bank how they think the breach happened. If it was a data breach at a retailer or website, they will tell you. If it was phishing or malware, they may not know for certain, but they can tell you which transactions were made and from where — that often reveals the method.
Protecting yourself while the investigation is open
Until your new card arrives, you will not be able to use your debit card in stores. You can still withdraw cash at your bank's ATM using your PIN, and you can still access your account online. If you need cash before the new card arrives, visit a branch in person with your ID.
Check your account daily for new unauthorized transactions. If more appear after you reported the fraud, tell your bank when ready — it means the thief still has access. This can happen if they changed your password or added themselves as an authorized user.
If the thief transferred money to another account, your bank may be able to recover it if they act quickly. Some banks can contact the receiving bank and freeze the funds before they are withdrawn. This works best if you report within hours, not days.
What to do if your bank denies your claim
Most fraud claims are approved, but occasionally a bank will say you authorized the transactions or were negligent. If this happens, ask the bank in writing to explain their decision. Request copies of the evidence they used — the IP address, the device, the location, the transaction details.
If you disagree with their decision, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. You can also contact your state's banking regulator — usually called the Department of Financial Services or Division of Banking. These agencies can pressure the bank to reconsider.
You can also dispute the charges with your credit card company if you used a credit card instead of a debit card. Credit card fraud protection is even stronger than debit card protection — you owe $0 in most cases. If your bank account was hacked through your debit card, you have fewer protections, which is one reason many people prefer credit cards for everyday purchases.
Checking for ongoing access after the fraud stops
Once the fraudulent transactions stop, do not assume the thief is locked out. They may have changed your password, added a backup email address, or set up a second login method. Log into your account and check the security settings.
Look for: a different password than you remember setting; an email address you do not recognize listed as a contact; a phone number you do not recognize linked to account recovery; or a new authorized user or signer on the account. If you see any of these, change your password when ready and contact your bank.
Enable two-factor authentication if your bank offers it. This means you need both your password and a code sent to your phone to log in. It makes it much harder for someone to access your account even if they have your password.
Protecting your other accounts
If your bank account was hacked, assume your other accounts are at risk too. Change your password on any website where you used the same password as your bank account. If you used your bank email address to sign up for other accounts, change the password on that email account first — it is the master key to everything else.
Check your credit report for accounts you did not open. You can get a free report once a year from annualcreditreport.com. If you see accounts you do not recognize, contact the creditor and tell them it was fraud.
Consider placing a fraud alert or credit freeze on your credit file. A fraud alert tells creditors to verify your identity before opening new accounts. A credit freeze blocks creditors from seeing your credit report entirely. Both are free and take a few minutes to set up online.
Frequently Asked Questions
How long does a bank fraud investigation take?
Your bank has up to 10 business days to investigate and decide whether to credit your account. Most decisions come within 5 to 7 days. If they need more time, they must credit your account temporarily while they continue investigating, so you are not without money.
Will I get my money back if the thief already spent it?
Yes, your bank is responsible for refunding you, not for recovering the money from the thief. The bank's job is to determine whether the transactions were fraudulent; if they were, you get your money back regardless of whether the thief is caught or the funds are recovered.
Can the thief access my account again with the new card and account number?
Not with the old card number — that is why the bank issues a new one. But if the thief still has your password or other login information, they can access your account online. Change your password when ready and check your security settings for unauthorized access methods.
What if I recognized one of the fraudulent transactions but authorized the others?
Tell your bank exactly which transactions you authorized and which you did not. They will only refund the ones you dispute. Be honest — if you authorized a transaction and later regret it, that is not fraud, and the bank will not refund it.
Do I need to file a police report?
You do not need a police report to get your money back from the bank. However, if the theft was large or part of a pattern, filing a report creates an official record. Some banks ask for a police report number if the fraud was substantial, so ask your bank whether they need one.