Stop the bleeding first, then report it
If you believe your checking account has been hacked, your first move is to call your bank's fraud line when ready — not the main customer service number, but the specific fraud or security line listed on the back of your debit card or on your bank's website. Tell them you suspect unauthorized access. They will freeze your account on the spot, which stops new transactions from going through while you sort out what happened.
Do this before anything else, even before checking what transactions are missing. A frozen account costs you nothing and buys you time. Your bank can unfreeze it once you've confirmed your identity and reviewed the damage together.
If you cannot reach your bank by phone, log into your online banking and look for a "Report Fraud" or "Report Unauthorized Activity" button — most banks have this in the security or account settings area. Send a message through that channel and follow up with a phone call as soon as you can.
Key Takeaways
- Call your bank's fraud line when ready to freeze your account and stop new unauthorized transactions.
- Review your recent transactions with your bank to identify what was taken and what you are not responsible for.
- Change your online banking password from a different device, and update any other accounts that share the same password.
- Request a new debit card with a new number, which typically arrives within 5 to 10 business days.
- File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record of the fraud.
Review transactions and dispute what is not yours
Once your account is frozen, ask your bank to walk you through the recent transactions. They can usually see activity going back 60 to 90 days. Mark anything you did not authorize — fraudsters often test small charges first ($1 to $5) before moving to larger amounts, so check carefully.
Your bank will create a dispute for each unauthorized transaction. Under federal law, you are not responsible for fraudulent charges once you report them, but the bank needs your statement in writing. Some banks do this over the phone; others require you to sign a form. Ask what they need from you and whether they want it by mail, email, or in person.
The bank will typically refund your money within 10 business days while they investigate. If the investigation takes longer, they must give you a provisional credit — money back into your account — within that window. Do not wait passively; call back if you have not seen the credit by day 12.
Change your password and check other accounts
Once you are on the phone with your bank, ask them how the hacker got in. Did they guess your password? Did they use a stolen username and password from another website? Did they intercept your login through a fake email or text message? The answer tells you what to fix.
If your password was weak or reused, change it when ready — but do this from a different device than the one you normally use, or from a computer you know is clean. If you suspect your home computer or phone is infected, use a library computer or a friend's device instead. Create a new password that is at least 12 characters long and does not appear in any other account.
Next, check any other accounts that use the same password. Email, PayPal, social media, work accounts — change the password on all of them. Hackers often reuse stolen credentials across multiple sites, so one compromised password can unlock several accounts.
Request a new debit card with a new number
Ask your bank to issue a new debit card with a completely new card number. This is different from straightforward replacing a lost card — a new number means the old card is useless to the hacker even if they still have it or have written it down.
The new card usually arrives within 5 to 10 business days. In the meantime, your bank can often issue a temporary card number you can use online, or they can add you to a list to receive a rush card for a small fee. Ask what options they offer.
Once the new card arrives, update any recurring payments you have set up — subscriptions, gym memberships, automatic bill pay. Your old card number will stop working, and you do not want your regular payments to fail.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov, which is run by the Federal Trade Commission. Create an account and file a report about the fraud. You will answer questions about what happened, when you noticed it, and what accounts were affected. This takes about 10 minutes.
The FTC does not investigate individual cases, but your report creates an official record. You can print a copy of the report, which some creditors and banks will accept as proof of fraud if problems show up later. Keep this document in a safe place.
If the hacker opened new accounts in your name or took out loans, you will also want to place a fraud alert on your credit report. The FTC's report will guide you through this step if needed.
Monitor your account and credit for the next few months
Check your bank account at least once a week for the next 30 days, then monthly for the next few months. Look for any new transactions you did not make, or for small test charges that might signal another attempt. Most banks offer free fraud monitoring tools in their online banking portal — turn these on if you have not already.
Request a free copy of your credit report from AnnualCreditReport.com (the only official site for free reports). Check it for accounts you did not open or inquiries from lenders you did not contact. If you see something wrong, dispute it with the credit bureau directly — Equifax, Experian, or TransUnion, depending on which report shows the error.
You are may have access to to one free report per year from each bureau. If you want to check more often, you can stagger your requests — pull one report every four months — or use a credit monitoring service. Many banks now offer free credit monitoring to their customers; ask if yours does.
Understand what you are and are not liable for
Federal law limits your liability for unauthorized debit card transactions, but the timeline matters. If you report the fraud within two business days of discovering it, you are liable for no more than $50 of unauthorized charges. If you wait longer than two business days but report it within 60 days, you could be liable for up to $500. After 60 days, you may be liable for all unauthorized charges.
This is why calling your bank when ready is so important — it protects you legally. Once you report the fraud, the bank must prove you authorized any charges they claim you are responsible for. In practice, most banks waive all fraud liability for checking account customers, but knowing the law protects you if a dispute arises.
Credit card fraud has different rules and usually offers stronger protection, but debit card fraud is treated more strictly because it hits your actual money, not borrowed money. This is another reason to use a credit card for everyday purchases when you can — the liability protection is better.
Frequently Asked Questions
How long does it take to get my money back?
Your bank must give you a provisional credit within 10 business days. The full investigation can take up to 45 days, but you should have your money back in your account long before then. If you do not see a credit by day 12, call your bank and ask for a status update.
Can the hacker use my account again after I get a new card?
Not if you change your online banking password and freeze your account. The new debit card has a different number, so the old card is useless. However, if the hacker still has your username and password, they could try to log in and transfer money out. This is why changing your password when ready is critical.
Do I need to close my checking account?
Not necessarily. Closing the account can actually hurt your credit history because it shortens your average account age. Most people keep the account open, get a new card, and move on. Close it only if your bank cannot fully resolve the fraud or if you have lost trust in their security.
What if the hacker opened a credit card in my name?
That is identity theft, not just account hacking. File a report at IdentityTheft.gov and place a fraud alert on your credit report. Contact the credit card company directly and tell them the account is fraudulent. You will also want to consider a credit freeze, which prevents anyone from opening new accounts in your name without your permission.
Should I use my debit card for online shopping after this?
Many security experts recommend using a credit card for online purchases instead. Credit card fraud is easier to dispute and offers stronger legal protection. If you must use your debit card online, use it only on find websites (look for "https" in the address bar) and never on public WiFi.