Yes, bank accounts can be hacked, but the path in matters more than you might think
Your bank account can be compromised, but not usually the way movies show it. A hacker does not break into your bank's servers and steal your password. Instead, they get your login credentials through you—phishing emails, malware on your computer, a data breach at a company where you reused your password, or social engineering a bank employee. Once they have your username and password, they log in like a normal user. Your bank's security then becomes your second line of defense.
The good news: banks are required by federal law to cover unauthorized transactions under the Electronic Funds Transfer Act (EFTA), and most do so without argument if you report the fraud quickly. The bad news: the speed of your report and the method the hacker used to get in determine how much you lose and how long recovery takes.
Key Takeaways
- Hackers usually obtain your login credentials through phishing, malware, password reuse, or social engineering—not by breaking into the bank itself.
- Federal law requires banks to refund unauthorized transfers if you report them within 60 days, though faster reporting limits your liability.
- If you report fraud within two business days, you are liable for no more than $50 of unauthorized transfers; after 60 days, you may lose everything.
- Two-factor authentication, strong unique passwords, and monitoring your account regularly are the most effective ways to prevent unauthorized access.
- If your account is hacked, contact your bank when ready by phone using the number on your card or statement—not a number from an email or search result.
The most common ways hackers get your bank login information
Phishing emails remain the most effective method. You receive an email that looks like it came from your bank, asking you to "verify your account" or "confirm your identity." The link goes to a fake website that looks identical to your real bank's site. You enter your username and password, and the hacker now has them. Banks never ask for passwords via email.
Malware on your computer or phone captures your keystrokes or takes screenshots as you log in. You may not know it is there. This happens through infected email attachments, fake software downloads, or compromised websites. Once installed, the malware sends your credentials to the attacker in real time.
Password reuse across multiple sites creates a domino effect. If you use the same password on your bank account and on a shopping site, and that shopping site gets breached, hackers will try your email and password combination on your bank. This is why a breach at a retailer you barely remember can compromise your bank account months later.
Social engineering targets bank employees directly. A hacker calls your bank's customer service line, claims to be you, and convinces the employee to reset your password or transfer money. This works because the hacker often has your real personal information from a previous data breach.
What happens when ready after your account is compromised
Once a hacker has your login credentials, they move fast. They may transfer money out, change your password to lock you out, add themselves as an authorized user, or set up bill pay to send money to accounts they control. Some hackers drain the account in hours. Others move slowly to avoid triggering fraud alerts.
Your bank's fraud detection system may catch unusual activity—a transfer to a new recipient, a large withdrawal, activity from a new device or location. If it does, the bank may freeze the transaction, lock your account, or contact you to confirm. This is a good sign. If it does not catch the fraud, you will discover it when you check your balance or receive a statement.
The moment you notice unauthorized activity, your next action determines your financial protection. The Electronic Funds Transfer Act sets three liability windows: within two business days, within 60 days, and after 60 days. Each has different consequences.
Your liability depends on how fast you report the fraud
| When You Report | Your Maximum Liability | What This Means |
|---|---|---|
| Within 2 business days of discovering the fraud | $50 | You lose at most $50; the bank covers the rest of unauthorized transfers. |
| Between 2 and 60 days after discovering the fraud | $500 | You may lose up to $500; the bank covers anything beyond that. |
| After 60 days from when the fraudulent statement was sent to you | Unlimited | You may lose everything; the bank has no obligation to refund you. |
The clock starts when you discover the fraud, not when it happened. If a hacker drained your account on January 5 but you did not check your statement until February 20, your 60-day window runs from February 20, not January 5. This is why monitoring your account regularly matters.
Most banks will refund you even if you miss the 60-day window, especially if you can show you were not negligent. But they are not required to, and some will not. The safest approach is to report within two business days and get everything in writing.
How to report the fraud to your bank
Call your bank when ready using the phone number on your debit card or a recent statement. Do not use a number from an email, text, or search result—scammers create fake bank numbers to intercept your call. When you reach the bank, explain what happened and which transactions were not yours.
The bank will ask you to describe the unauthorized activity, confirm your identity, and may ask whether you shared your password or left your card unattended. Answer honestly. They will then freeze your account, cancel your debit card, and issue a new one. They may also reset your online banking password.
Ask the bank to send you a written confirmation of the fraud report. This document is important if there are disputes later. Request it by email or mail, and keep it with your records. The bank will also file a report with its fraud department and may contact law enforcement, though criminal prosecution of hackers is rare unless the amount is very large.
After you report the fraud, the bank will investigate. This usually takes 10 business days, though they may extend it to 45 days if they need more information. During this time, your account may be frozen. Once the investigation closes, the bank will refund the unauthorized amount (up to your liability limit) and reopen your account.
Preventing your account from being hacked in the first place
Use a unique, strong password for your bank account. A strong password has at least 12 characters and mixes uppercase letters, lowercase letters, numbers, and symbols. Never use your birthday, address, or pet's name. Never reuse a password from another site. A password manager like Bitwarden or 1Password generates and stores unique passwords so you only have to remember one master password.
Turn on two-factor authentication (2FA). This requires a second form of identification—usually a code sent to your phone or generated by an authenticator app—when you log in from a new device. Even if a hacker has your password, they cannot log in without this second code. Most banks offer 2FA through their online banking portal. Use an authenticator app like Google Authenticator or Authy rather than SMS if your bank supports it, because SMS can be intercepted.
Monitor your account regularly. Check your balance and recent transactions at least weekly. Set up account alerts through your bank's app or website to notify you of large transfers, new bill pay recipients, or logins from new devices. These alerts often catch fraud before significant damage occurs.
Do not click links in emails or texts claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser or opening the official mobile app. If your bank sent a legitimate message, you can log in and see it there.
Keep your devices updated. Install security patches for your operating system, browser, and apps as soon as they become available. Malware often exploits known vulnerabilities that patches fix.
What to do if your bank will not refund the fraud
If your bank denies your fraud claim, you have options. First, ask the bank to explain their decision in writing. They must provide this under the EFTA. Review the explanation carefully—sometimes banks deny claims because they misunderstood what you reported.
If you believe the bank made an error, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can pressure banks to reconsider. You can also file a complaint with your state's banking regulator or attorney general's office.
If the amount is small enough, you might pursue a chargeback through your credit card company if you used a credit card to fund the account (though this is rare for bank accounts). For larger amounts, you may need to consult a lawyer, though most banks settle before litigation.
Frequently Asked Questions
Can a hacker drain my entire bank account without my password?
Not through normal online banking. They need your username and password, or they need to convince a bank employee to transfer money on your behalf. However, if someone has physical access to your debit card and knows your PIN, they can withdraw cash at an ATM. If someone has your account number and routing number (which are printed on your checks), they can set up unauthorized bill pay or ACH transfers, though these usually take a day or two to process.
Will my bank refund me if I gave my password to someone who turned out to be a scammer?
Probably not. If you voluntarily shared your password or authorized a transfer, the bank may classify this as your own negligence rather than fraud. However, if someone impersonated your bank or a trusted company to trick you into sharing your password, many banks will still refund you. The distinction is whether you were deceived or straightforward careless. Report it anyway and let the bank decide.
What if the hacker changed my password and I cannot log in?
Call your bank's customer service line when ready. Explain that your account has been compromised and you cannot log in. The bank can verify your identity through other means (security questions, recent transactions, personal information) and reset your password. They will also review your account for unauthorized activity while you are on the phone.
Does my bank account have insurance like my savings account does?
Your checking and savings accounts are covered by FDIC insurance up to $250,000 per account type per bank, but this protects you only if the bank fails—not if your account is hacked. Fraud protection comes from the EFTA, not FDIC insurance. These are two separate protections that work in different situations.
Can I get my money back if I sent it to a scammer's account myself?
This is harder than fraud where a hacker accessed your account without permission. If you sent money willingly, even though you were tricked, the EFTA may not cover it. However, if you sent the money through bill pay or a transfer service, you can ask the bank to reverse it within a short window (usually 24 hours). After that, the money is in another person's account and recovery requires the receiving bank's cooperation, law enforcement, or a civil lawsuit. Report it to your bank and the FBI's Internet Crime Complaint Center (IC3) at ic3.gov anyway.