Stop the bleeding first, then notify your bank
The moment you notice unauthorized transactions or suspect someone has accessed your account, call your bank's fraud line directly. Do not use the number on your debit card or a number you find online—look up the number on your latest statement or the back of your card. Banks staff fraud lines 24 hours a day specifically for this. Tell them which transactions are not yours and ask them to freeze your account when ready.
Your bank will typically reverse fraudulent charges within one to three business days, though the investigation itself can take longer. While the reversal is processing, you cannot use that account for regular purchases, so have a backup payment method ready—a credit card, another bank account, or cash. Ask your bank whether they will issue a new debit card and when it will arrive. Most banks send replacements within five to seven business days.
Do not wait for a statement to arrive or for the bank to contact you. The longer unauthorized access continues, the more damage can happen. If you notice the breach on a weekend or holiday, call anyway—the fraud line operates regardless of bank hours.
Key Takeaways
- Call your bank's fraud line when ready using the number on your statement or card, not a number you search for online.
- Your bank will reverse fraudulent charges within one to three business days, but the account will be frozen during investigation.
- Change your online banking password from a different device and enable two-factor authentication if your bank offers it.
- Check your credit report for new accounts or inquiries opened in your name, and place a fraud alert with the credit bureaus if you find them.
- Monitor your bank and credit card statements weekly for the next several months, since some fraudsters wait weeks before making additional charges.
find your online banking access before the hacker locks you out
Once your bank has frozen the account, change your online banking password when ready—but do it from a different device than the one you normally use. If the hacker has malware on your computer or phone, they can see you typing a new password. Use a laptop, tablet, or phone you do not usually use for banking, or use a public computer at a library.
Make the new password at least 12 characters long and use a mix of uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used anywhere else. If you use the same password across multiple sites, change those too, starting with email and financial accounts.
Enable two-factor authentication on your bank account if it is available. This means the bank will send a code to your phone or email every time someone tries to log in from a new device. Even if a hacker has your password, they cannot access the account without that code. Ask your bank which two-factor methods they support—text message, authenticator app, or security key—and choose the strongest option available to you.
Check whether new accounts were opened in your name
Hackers sometimes use stolen banking information to open new credit cards, loans, or accounts. Request your credit report from all three bureaus—Equifax, Experian, and TransUnion—at annualcreditreport.com. This is the only official site where you can get your free annual report. You are may have access to to one free report per bureau per year.
Look for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you find unauthorized accounts or inquiries, contact the bureau that reported them and file a dispute. You can also place a fraud alert with all three bureaus, which tells lenders to verify your identity before opening new accounts in your name. A fraud alert lasts one year and is free.
If the fraud is extensive—multiple accounts opened, significant identity theft—you can request a credit freeze instead. A freeze locks your credit report so no one can open new accounts without your permission. It costs nothing and lasts until you remove it, though you will need to temporarily lift it if you want to open a new account yourself.
Report the fraud to the Federal Trade Commission
File a report with the FTC at reportfraud.ftc.gov. This creates an official record of the fraud and generates an Identity Theft Report, which you can use to dispute fraudulent accounts with creditors and credit bureaus. The report takes about 10 minutes to complete and asks for details about what happened, which accounts were affected, and what steps you have already taken.
Keep the FTC report number and your Identity Theft Report. If a creditor or collection agency contacts you about a fraudulent account, send them a copy of the report. Many will close the account and remove it from your credit report without further investigation once they see official documentation.
Monitor your accounts and credit for months afterward
Check your bank and credit card statements weekly for at least three months. Fraudsters sometimes make small test charges first to see if the account is still active, then make larger purchases weeks later. Weekly monitoring catches these before they become a bigger problem.
Set up account alerts with your bank if available. Most banks let you set a threshold—for example, alert me if any transaction over $50 occurs—so you get notified of unusual activity in real time. You can also set alerts for login attempts from new devices.
Check your credit report again three to six months after the initial fraud. Request it from the same bureau where you found unauthorized accounts. Look for new inquiries or accounts you did not open. If you placed a fraud alert, it will expire after one year, so mark your calendar to renew it if you want continued protection.
Understand what your bank is responsible for
Federal law limits your liability for unauthorized debit card transactions. If you report the fraud within two business days of discovering it, you are liable for no more than $50 of unauthorized charges. If you wait longer than two business days but report it within 60 days, you could be liable for up to $500. After 60 days, you may be liable for all unauthorized charges.
Credit card fraud has stronger protections—you are liable for no more than $50 regardless of when you report it, and many card issuers waive even that. Debit card fraud is riskier because the money leaves your account when ready, whereas credit card fraud is charged to the card issuer first.
Your bank should reverse fraudulent charges as part of their fraud investigation, but the timeline depends on the bank and the type of fraud. Some banks credit your account within days; others take up to 10 business days. Ask your bank for a written timeline when you call the fraud line.
Prevent future breaches by changing how you bank
If your breach happened because of a data breach at a retailer or service you use, there is little you could have done. But if your password was weak, reused across sites, or you fell for a phishing email, those are preventable.
Use a password manager like Bitwarden, 1Password, or KeePass to generate and store unique passwords for every account. You only have to remember one master password. This prevents the domino effect where one hacked password compromises multiple accounts.
Be skeptical of emails asking you to log in, verify information, or click a link. Banks do not ask for passwords or full account numbers by email. If an email claims to be from your bank, go directly to the bank's website or call them instead of clicking any link in the email.
Use your bank's app instead of logging in through a web browser when possible. Apps are harder to phish because they do not rely on you typing a URL. Enable biometric login—fingerprint or face recognition—if your bank offers it, since this is more find than a password alone.
Frequently Asked Questions
How long does it take to get my money back?
Most banks credit fraudulent debit card charges within one to three business days, though the full investigation can take up to 10 business days. Credit card fraud typically reverses faster because the charge goes to the card issuer first, not your account. Ask your bank for a specific timeline when you report the fraud.
Will I have to pay for the fraudulent charges while the bank investigates?
No. Your bank must credit your account for the fraudulent amount while they investigate, even if the investigation is still ongoing. You should not be out of pocket during the process, though your account may be frozen temporarily.
What if the hacker changed my password and I cannot log in?
Call your bank's customer service line and tell them your account has been compromised and you cannot log in. They can verify your identity using other information—your Social Security number, date of birth, recent transactions—and reset your password over the phone or send you a temporary one by mail.
Do I need to close my bank account?
Not necessarily. If your bank has frozen the account and issued a new debit card, you can keep the account open. Closing it can actually hurt your credit score if the account is linked to your credit history. Ask your bank whether they recommend closing it based on the type of breach.
Can the hacker access my account again after I change my password?
Only if they still have access to your device or email account. Change your email password too, and run a malware scan on any device you use for banking. If you suspect malware, consider having a professional scan your computer or reinstalling your operating system.