What happens when someone hacks your bank account

A hacked bank account means someone has gained unauthorized access to your login credentials, your account itself, or both—and has either moved money out, changed your contact information, or set up fraudulent transactions in your name. This is different from identity theft, where someone uses your personal information to open new accounts. A hack targets an account that already exists and is already yours.

The most common entry points are phishing emails that look like they come from your bank, malware on your computer or phone that captures your password, or credential stuffing—where hackers use passwords leaked from other companies to try your email address across multiple banks. Once inside, a hacker can drain your account within hours, change your password and recovery email, or use your account to send fraudulent wire transfers.

The speed matters because your bank's fraud detection systems may not catch the activity when ready, and once money leaves your account through a wire transfer or ACH payment, it is much harder to recover than a credit card charge.

Key Takeaways

  • Contact your bank when ready by phone using the number on your statement or card—not a number from an email or search result—and tell them your account has been compromised.
  • Your bank will freeze the account, reverse unauthorized transactions within a window (usually 10 business days for wire transfers, longer for other methods), and issue you a new debit card and online login credentials.
  • File a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record that helps with disputes and may unlock additional protections.
  • Change passwords on all accounts that share the same or similar passwords, and enable two-factor authentication on your bank account and email once the account is secured.
  • Monitor your account statements and credit reports for 12 months, because a hacker with your information may attempt fraud again or sell your data to others.

The when ready steps: first 24 hours

Call your bank's fraud line directly. Do not use a phone number from an email, text, or search result—use the number on the back of your debit card or on your most recent statement. Tell them your account has been compromised and you did not authorize recent transactions. Have your account number ready, and be prepared to answer security questions to prove you are the account holder.

Your bank will freeze the account to stop further unauthorized activity. They will also begin investigating the transactions and will likely reverse any that are clearly fraudulent. For wire transfers and ACH payments, banks have a window to reverse them—typically 10 business days for wires, though this varies by bank and the type of transfer. Money sent through other methods may take longer to recover or may not be recoverable at all.

Ask your bank for a new debit card, a new PIN, and a new online password. Do not reuse a password you have used before, and do not create it based on information someone could guess (birthdate, pet name, address). Your bank will mail the new card, which usually arrives within 5 to 10 business days. In the meantime, ask if they can issue a temporary card or provide emergency cash access.

Reporting to the Federal Trade Commission

Go to IdentityTheft.gov and file a report. This is a free, official record that documents the fraud and creates what the FTC calls an "Identity Theft Report." You will answer questions about what happened, when you discovered it, and what accounts were affected. The report takes about 10 minutes to complete.

This report matters because it gives you legal standing in disputes with your bank, creditors, and credit bureaus. If your bank initially denies a refund, you can reference your FTC report. If fraudsters open new accounts in your name, you can use the report to show creditors that you reported the fraud before those accounts were opened. Some creditors will not negotiate without it.

You do not need a police report to file with the FTC, though you can file one with your local police if you want an additional record. The FTC report alone is usually sufficient for bank disputes.

What your bank will and will not refund

Your bank's liability depends on what type of transaction was made and how quickly you reported it. If someone used your debit card number without your PIN (a card-not-present transaction), you are protected under federal law—your liability is zero if you report it within 60 days of the statement date. If someone used your PIN or accessed your online account, the rules are more complex.

For unauthorized transfers from your account (ACH payments, wire transfers, or transfers to another bank), your bank must refund you if you report the fraud within a certain window. That window is typically 10 business days for wire transfers and longer for ACH payments, though some banks offer extended windows. The key is reporting quickly—waiting weeks makes a refund much less likely.

If the hacker changed your contact information (phone number, email, mailing address) and your bank sent you statements to the new address, your bank may argue you should have noticed sooner. This is why checking your account online frequently matters. If you can show you checked your account regularly and the fraud occurred between checks, your case is stronger.

Protecting your accounts after the hack

Change your password on every account that uses the same password as your bank account, or a similar variation. If you used "BankPassword123" for your bank and "BankPassword123email" for your email, change both when ready. Hackers often try variations of passwords across multiple sites.

Enable two-factor authentication on your bank account and your email account. Two-factor authentication means you need both your password and a second form of verification—usually a code sent to your phone or generated by an authenticator app—to log in. This stops a hacker from accessing your account even if they have your password. Most banks offer this in their online settings; some require you to call to set it up.

Consider a credit freeze with the three major credit bureaus: Equifax, Experian, and TransUnion. A freeze prevents anyone from opening new accounts in your name without unfreezing first. You can place a freeze for free at each bureau's website. A freeze does not affect your existing accounts or your credit score, but it does make it harder for you to open new accounts yourself—you will need to unfreeze temporarily when you explore for a loan or credit card.

Monitoring for ongoing fraud

Check your bank account and credit card statements weekly for the next three months, then monthly for the rest of the year. Look for transactions you do not recognize, changes to your contact information, or new accounts you did not open. The sooner you spot fraud, the sooner you can report it and the more likely you are to recover the money.

Order your credit reports from AnnualCreditReport.com, which is the only free, official source for credit reports. You are may have access to to one free report from each bureau per year. Check them for accounts you did not open, inquiries from lenders you did not contact, or incorrect personal information. If you see fraud, dispute it with the bureau in writing and include a copy of your FTC Identity Theft Report.

If the hacker had access to your email account, they may have reset passwords on other accounts (streaming services, social media, shopping sites). You do not need to change all of them when ready, but do change any that are connected to financial accounts or that store payment information. A hacker with access to your email can reset passwords on almost any account, so securing your email is the highest priority after securing your bank account.

What to do if your bank denies your refund claim

If your bank refuses to refund unauthorized transactions, ask them in writing why they denied the claim. They must provide a specific reason—usually that you reported too late, that you were negligent with your password, or that you authorized the transaction. Get this in writing; do not accept a verbal explanation.

If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints against banks and can order them to refund you if they violated federal law. Include your FTC Identity Theft Report, your bank's denial letter, and a timeline of when you discovered the fraud and when you reported it.

You can also dispute the charge through your bank's formal dispute process, which is separate from the initial fraud claim. Ask your bank how to file a formal dispute and what documents they need. This process typically takes 30 to 60 days.

Frequently Asked Questions

How long does it take to get my money back?

For debit card fraud, your bank must refund you within 10 business days if you report within 60 days of the statement date. For unauthorized transfers, the timeline depends on the type of transfer and your bank's policies—typically 10 business days for wires, longer for ACH. If your bank is investigating, they may take up to 45 days. Wire transfers that have already been received by another bank are harder to recover and may take weeks or months.

Can the hacker access my account again after I change my password?

Not if you change your password to something strong and unique, and enable two-factor authentication. A strong password is at least 12 characters and includes uppercase, lowercase, numbers, and symbols. If the hacker is still using malware on your computer, they could capture your new password when you type it—so consider running a malware scan on your computer and phone after the hack.

Do I need to close my bank account?

Not necessarily. Closing the account does not erase the fraud from your record, and it may make disputes harder because the account will be closed when your bank investigates. Keep the account open for at least 60 days so your bank can process refunds. After that, you can close it if you want, but it is not required.

Will this affect my credit score?

Unauthorized transactions on your existing bank account do not directly affect your credit score because they are not credit activity. However, if a hacker opens new credit accounts in your name, those will appear on your credit report and will lower your score. That is why monitoring your credit report is important—you can dispute fraudulent accounts before they damage your score significantly.

What if I think someone hacked my bank account but I am not sure?

Call your bank and describe what you noticed—unusual transactions, a password you do not remember changing, or contact information that is not yours. Your bank can review your account activity and tell you whether fraud occurred. If they find unauthorized activity, they will freeze the account and begin the refund process. There is no penalty for reporting a suspected hack that turns out to be a mistake.