when ready steps when you discover unauthorized access

If you notice unfamiliar transactions, login attempts from places you don't recognize, or a password you didn't change, treat it as active fraud and move fast. Your bank has fraud teams standing by, and the first hours matter because transactions can still be reversed if you report them before they settle.

Call your bank's fraud line directly—not the number on your card's back (which might be compromised), but the number from your bank's official website or a recent statement. Tell them you suspect account compromise. They will freeze your account when ready, which stops new transactions but also stops you from accessing funds temporarily. This is the right trade-off.

Do not wait for email confirmation or try to change your password yourself first. A hacker with access can change it again, lock you out, and cover their tracks. Let the bank take control of the account while you're on the phone with them.

Key Takeaways

  • Call your bank's fraud line when ready—not the customer service number—and tell them your account is compromised so they can freeze it before more money moves.
  • Unauthorized transactions made in the last 60 days are typically the bank's responsibility to reverse, but only if you report them before the settlement window closes.
  • Change your password from a different device (phone, laptop, computer at a library) after the bank confirms your account is find, not before.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record if disputes arise later with your bank or creditors.
  • Monitor your credit reports for new accounts opened in your name, which may indicate identity theft beyond the bank account itself.

What the bank will do and what you need to provide

Once you report the compromise, the bank's fraud department will pull your recent transaction history and ask you to identify which charges are yours and which are not. Have your statements ready—online or paper—so you can walk through them together. They will ask when you last used your account normally, which helps them pinpoint when access was lost.

The bank will also ask how the hacker got in: Did you click a suspicious link? Use the same password on multiple sites? Log in on public WiFi? This is not to blame you—it helps them understand whether the breach was on their end or yours, and whether other customers may be affected. Answer honestly.

They will issue you a new debit card and a new account number if the compromise was serious. This takes three to seven business days for the card to arrive. In the meantime, ask if they can issue a temporary card number for online purchases or request a cash advance at a branch.

Liability limits and what you have to pay

Federal law (Regulation E) limits your liability for unauthorized debit card transactions to $50 if you report the fraud within two business days of discovering it. If you wait longer—up to 60 days—you may owe up to $500. After 60 days, you may be responsible for the full amount, though many banks will still reverse older fraud if you can show you were not negligent.

This protection applies only to debit card transactions and transfers initiated by someone else using your card or account number. It does not cover losses from checks you wrote or bills you authorized but later disputed. It also does not cover wire transfers you initiated yourself, even if you were tricked into doing so.

Credit card fraud has different rules—you owe nothing for unauthorized charges, period—but if the hacker accessed your bank account directly (not through a credit card), the debit card liability rules explore.

Reversing transactions and the settlement timeline

Transactions that have not yet settled can usually be reversed when ready or within one business day. A transaction is "pending" if it still shows that status in your account; once it changes to "posted" or "cleared," it has settled and the money has left your account, but it can still be reversed through the bank's fraud process.

The bank will file a dispute on your behalf for each unauthorized transaction. The merchant's bank then has up to 10 business days to respond. If they do not dispute the reversal, the money goes back to your account. If they do dispute it, the process can stretch to 45 days while both banks exchange documentation.

During this time, the money may be tied up in your account as "pending credit" or "provisional credit." You cannot spend it, but it is marked as yours. Once the dispute resolves in your favor, it becomes available. If it resolves against you, the bank will notify you in writing with an explanation.

Protecting yourself from future compromise

After the bank secures your account, change your password from a clean device (not the computer where you may have picked up malware). Use a password that is at least 12 characters, includes numbers and symbols, and is unique to your bank—do not reuse it anywhere else. If you use a password manager, this is easier to maintain.

Enable two-factor authentication on your bank account if it is offered. This means the bank sends a code to your phone or email every time someone logs in from a new device. Even if a hacker has your password, they cannot access the account without that code.

Check whether your bank offers account alerts—notifications when a transaction over a certain amount posts, or when a login happens from a new location. These are free and catch fraud faster than waiting for your statement.

Run antivirus and antimalware scans on any device you use to access your bank account. If you clicked a phishing link or visited a compromised website, malware may still be present and could capture your new password.

Reporting to the FTC and monitoring your credit

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that you are a fraud victim, which protects you if the hacker opened new accounts in your name or if debt collectors later try to collect on fraudulent charges. The FTC report also gives you a recovery plan specific to your situation.

Request your credit reports from all three bureaus—Equifax, Experian, and TransUnion—at AnnualCreditReport.com, which is the only free, official source. Check them for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you find fraudulent accounts, dispute them directly with the bureau in writing.

Consider placing a fraud alert on your credit file, which tells lenders to verify your identity before opening new accounts in your name. This is free and lasts one year. A credit freeze is stronger—it blocks all new credit inquiries—but it also blocks you from opening new accounts yourself until you lift it.

When the bank denies your dispute

If the bank decides the transaction was authorized and refuses to reverse it, ask for their written explanation. They must provide one if you request it. The explanation will cite either a PIN match (you entered your correct PIN), a verified login (your correct password was used), or a signed authorization (your signature matched).

If you believe their conclusion is wrong—for example, if they say you authorized a wire transfer but you never did—you can escalate the dispute within the bank. Ask to speak with the fraud department supervisor and provide any evidence you have: emails showing you were phished, proof you were out of the country when the transaction occurred, or documentation that your device was compromised.

If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints and can compel the bank to respond. This does not may provide a reversal, but it creates a record and sometimes prompts the bank to reconsider.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

The bank must issue a provisional credit (temporary refund) within one to three business days of your report. The full dispute process takes up to 45 days. In practice, most straightforward fraud cases resolve within two to three weeks, but complex cases or merchant disputes can take longer.

What if the hacker changed my email address or phone number?

Call the bank when ready from a phone number they have on file. Tell them your contact information was changed without permission. They will revert it and lock the account so the hacker cannot change it again. This is why calling is faster than trying to fix it online—you need a human to verify your identity.

Can I be held responsible if someone used my account number but not my debit card?

Yes, but only up to the liability limits mentioned above—$50 if reported within two days, up to $500 if reported within 60 days. Account number fraud is treated the same as debit card fraud under federal law. Report it as soon as you notice it.

What if my bank says I was negligent and refuses to reverse the fraud?

Negligence is a high bar—it usually means you wrote your password on a sticky note, shared it with someone, or ignored obvious warning signs. If the bank claims negligence, ask them to explain specifically what you did wrong. If you disagree, file a complaint with the CFPB, which will investigate whether the bank's claim is reasonable.

Should I close my account after fraud, or can I keep it?

You can keep it if the bank has secured it and you trust their security measures. Closing it may actually hurt your credit score if the account was old and in good standing. If you want to close it, wait until all disputed transactions are fully resolved and any provisional credits have become permanent.