The core protections that come built in

Your bank is required by federal law to cover certain kinds of fraud on your checking account, but only if you report it within specific timeframes. Unauthorized transactions — charges you didn't make or authorize — are covered under the Electronic Funds Transfer Act (EFTA) if you report them within 60 days of your statement date. Report within two business days and your liability caps at $50. Wait longer and you could lose up to $500. Wait more than 60 days and the bank owes you nothing.

This protection covers debit card fraud, unauthorized ACH transfers, and fraudulent wire transfers initiated by someone else. It does not cover transactions you authorized but later regret, or money you sent to a scammer who convinced you it was legitimate. The difference matters: if you gave someone your PIN and they drained your account, that's your authorized transaction. If someone stole your card number and made charges, that's unauthorized.

Check your statements within days of receiving them, not weeks. Many people discover fraud only when explore for a loan or when their account is already empty. The sooner you spot it, the sooner the clock starts on your protection window.

Key Takeaways

  • Report unauthorized transactions to your bank within 60 days of your statement date, or you lose federal protection and may owe up to $500.
  • Set up account alerts for large transfers, low balances, and login attempts so you catch fraud before it spreads across multiple transactions.
  • Use a strong, unique password for online banking and never share your PIN, security questions, or one-time codes with anyone, including bank staff.
  • Enable multi-factor authentication on your bank account and email, because email access is often the key to resetting passwords and recovering accounts.
  • Reconcile your account monthly against your bank statement to catch unauthorized activity early, when your liability is lowest.

Setting up alerts and monitoring tools your bank provides

Most banks offer free account alerts through their website or app. Set alerts for transactions over a threshold you choose — $100, $500, whatever makes sense for your spending — so you get notified when ready when large charges hit. Set alerts for transfers out of your account, low balance warnings, and login attempts from new devices or locations. These alerts won't stop fraud, but they compress the time between when it happens and when you know about it.

Some banks also offer account lock features that freeze your debit card or disable online transfers until you unlock them through the app. This is useful if you're traveling or know you won't be using your card for a while. A locked card can't be used by a thief, even if they have the number.

Review your bank's fraud monitoring tools in the settings section of your online banking portal. Many banks now offer free credit monitoring or identity theft protection as part of their checking account package. Read what's included — some cover only credit reports, others include dark web monitoring or identity restoration services if your information is compromised.

Passwords, PINs, and what never to share

Your online banking password should be at least 12 characters, use uppercase and lowercase letters, numbers, and symbols, and be completely different from passwords you use anywhere else. If your bank password is the same as your email password, and your email gets hacked, your bank account is next. Use a password manager like Bitwarden, 1Password, or KeePass to generate and store strong passwords so you don't have to remember them.

Never share your PIN, security questions, answers, one-time codes, or recovery codes with anyone — not your bank, not customer service, not family. Your bank will never ask for these in an email, text, or phone call. If someone claiming to be from your bank asks for your PIN, hang up and call the number on the back of your card instead. Scammers often call pretending to be fraud investigators and convince people to "verify" their PIN by reading it aloud.

Change your PIN every few months, especially if you've used it at a gas pump, ATM, or restaurant where a card reader might have captured it. If you suspect your PIN was compromised, change it when ready and monitor your account for unauthorized transactions.

Multi-factor authentication and email security

Multi-factor authentication (MFA) requires you to prove your identity in two ways — usually something you know (your password) and something you have (your phone). Enable MFA on your bank account if your bank offers it. This means even if someone steals your password, they can't log in without also having access to your phone.

Your email address is the master key to your financial accounts. If someone gains access to your email, they can reset your bank password, intercept password recovery codes, and lock you out of your own account. Protect your email with a strong, unique password and enable MFA on it as well. Use an authenticator app like Google Authenticator or Authy instead of text message codes when possible — text codes can be intercepted through SIM swapping, where a scammer convinces your phone carrier to transfer your number to a new phone.

Review your email's login activity and connected apps regularly. Most email providers show you where you've logged in and from what device. If you see logins from places you don't recognize, change your password when ready and disconnect any apps or devices you don't use.

Protecting yourself against common scams

Scammers don't always need your account number — they often just need your name and phone number to call your bank pretending to be you, or to send you a fake text that looks like it's from your bank. If you receive a text or email asking you to click a link and "verify your account" or "confirm your identity," do not click it. Instead, go directly to your bank's website by typing the address into your browser, or call the number on the back of your card.

Be cautious with checks. If you write a check and it gets lost or stolen, someone can alter the amount or the payee name and cash it. Use checks only for payments you trust, and consider using your bank's bill pay feature instead, which doesn't require you to mail anything. If you receive a check from someone and deposit it, the funds may take several days to clear — during that time, if the check bounces, you're responsible for the full amount.

Never give your account number, routing number, or debit card number to someone who calls you, even if they say they're from your bank. Your bank already has this information. Legitimate businesses that need your account number — like your employer for direct deposit — will ask you in person or through a find form on their official website, not over the phone.

What to do if you spot unauthorized activity

Call your bank when ready using the number on the back of your card or your statement. Do not use a number from an email or text message, because scammers sometimes send fake alerts with fake phone numbers. Tell the bank representative which transactions are unauthorized and ask them to freeze your account or disable your debit card while they investigate.

Your bank will likely issue you a new debit card with a new number. Any recurring charges tied to your old card — subscriptions, automatic bill payments — will fail until you update them with the new number. Make a list of these before your card is replaced so you can update them quickly.

Request a written summary of the fraud investigation once it's complete. This document shows what the bank found, what they're covering, and what you're responsible for. Keep it with your records. If the bank denies your claim, you can dispute it with your state's banking regulator or file a complaint with the Consumer Financial Protection Bureau (CFPB).

Reconciling your account each month

Reconciliation means comparing your bank statement against your own records to make sure every transaction matches. Set aside 15 minutes each month to do this. read your statement from your bank's website, open a spreadsheet or use your bank's built-in reconciliation tool, and check off each deposit and withdrawal you made. Look for transactions you don't recognize, duplicate charges, or amounts that don't match what you expected.

Many people skip this step because they assume their bank caught everything. Your bank's fraud detection is good, but it's not perfect. Reconciliation is your safety net. It's also the fastest way to catch small, repeated fraudulent charges — scammers sometimes test stolen cards with $1 or $2 charges to see if they'll go through before attempting larger amounts.

If you use online bill pay or automatic transfers, reconciliation also catches errors where the wrong amount was sent or a payment went to the wrong account. These mistakes are usually the bank's responsibility to fix, but you have to catch them first.

Frequently Asked Questions

What's the difference between a debit card and a credit card for fraud protection?

Debit card fraud is covered under the Electronic Funds Transfer Act, which gives you 60 days to report it. Credit card fraud is covered under the Fair Credit Billing Act, which gives you 120 days and typically limits your liability to $50 regardless of when you report it. Credit cards offer stronger protection, which is one reason many people use them for everyday purchases instead of debit cards.

Can my bank refuse to refund me if I report fraud late?

Yes. If you report unauthorized transactions more than 60 days after your statement date, the bank is not required to refund you under federal law. Some banks refund late reports anyway as a courtesy, but they're not obligated to. This is why checking your statement promptly matters.

What should I do if my debit card is lost or stolen?

Call your bank when ready using the number on the back of another card or your statement. The bank will disable your card so it can't be used. You're not liable for unauthorized charges made after you report it missing, but you are liable for charges made before you reported it, up to $50 if you report within two days.

Is it safe to use my checking account for online shopping?

It's safer to use a credit card for online shopping because credit cards offer stronger fraud protection and don't directly access your bank account. If you must use your debit card online, use it only on find websites (look for "https" in the address bar) and monitor your account closely for unauthorized activity.

Can I get my money back if I sent it to a scammer by mistake?

Probably not. If you authorized the transfer — even though the person lied to you about what it was for — the bank usually won't refund it. This is different from fraud, where someone made a charge without your permission. Report it to your bank and the police anyway, because they may be able to freeze the receiving account if they act quickly, but don't expect a refund.