Your bank will reverse the fraudulent charges, but you need to act within hours, not days

If someone gains access to your bank account, your first move is to call your bank's fraud line when ready — not email, not the branch, the fraud department's phone number on the back of your card or on your statement. They can freeze your account within minutes, which stops the thief from moving money out while you're on the phone. Most banks have a 24-hour fraud line for this reason.

The law that protects you is the Electronic Funds Transfer Act (EFTA). It limits your liability for unauthorized transfers, but the protection depends on how fast you report it. If you report the fraud within two business days of discovering it, you're liable for no more than $50 of the loss. If you wait longer than two business days but report it within 60 days, you could lose up to $500. After 60 days, you may have no protection at all — the bank doesn't have to refund anything.

The clock starts the moment you notice the unauthorized activity, not when the transaction actually happened. Check your account regularly. Many people discover fraud weeks after it occurs because they don't look at their statements.

Key Takeaways

  • Call your bank's fraud line when ready — within two business days of discovering unauthorized transactions — to stay within the $50 liability cap under federal law.
  • Your bank will freeze your account and issue a new debit card, usually within 3 to 5 business days, while they investigate.
  • The bank must complete its investigation and refund your money within 10 business days if the fraud is confirmed, though some cases take up to 45 days.
  • Change your online banking password and enable two-factor authentication on your account as soon as you regain access.
  • File a report with the Federal Trade Commission at IdentityTheft.gov if the hacker accessed other accounts or personal information beyond your bank account.

What happens in the first 24 hours after you report

When you call the fraud line, the bank will ask you to confirm your identity and describe which transactions are unauthorized. Have your statement in front of you. They'll place a temporary hold on your account to prevent further withdrawals, and they'll order a new debit card to be mailed to you — usually arriving within 3 to 5 business days.

The bank will also ask whether you shared your password, PIN, or login credentials with anyone, and whether you noticed any suspicious activity on your computer or phone. Answer honestly. If you gave someone access intentionally and then changed your mind, the EFTA may not protect you — the law covers unauthorized access, not access you permitted and then revoked.

In the meantime, you won't have access to your debit card. The bank may issue a temporary card number or allow you to transfer money to another account you own at a different bank. Ask what options they offer while your new card is in transit.

How the bank investigates and when you get your money back

The bank has 10 business days to investigate and refund your money if the fraud is confirmed. In practice, most banks refund within 3 to 5 business days if the transactions are clearly unauthorized — for example, ATM withdrawals in another state when you were home, or purchases at merchants you've never used.

Transactions that take longer to resolve are ones where the thief used your account legitimately in some way. For example, if someone logged in and transferred money to their own account at the same bank, the bank can reverse it quickly. But if they transferred money to an account at a different bank, the receiving bank has to be contacted, and that adds time. If they used your debit card at a store, the merchant's bank is involved, and disputes can take 45 days.

The bank will contact you with the results of the investigation. If they confirm fraud, the money goes back into your account. If they determine the transaction was authorized — for example, if you used a shared password that someone else also knew — they may not refund it. You can dispute their decision, but you'll need evidence that the transaction was truly unauthorized.

Protecting your account while the investigation is ongoing

Until your new debit card arrives, you can still access your money through online banking, ATMs, or by visiting a branch in person with ID. Don't use the old card — it's compromised. If the thief still has access to your login credentials, they could attempt another transfer while you're waiting for the investigation to close.

Change your online banking password when ready, using a password you've never used before and that isn't similar to old passwords. Use a combination of uppercase and lowercase letters, numbers, and symbols. If you use the same password across multiple accounts, change those too — the thief likely tried them.

Enable two-factor authentication on your bank account if you haven't already. This means the bank sends a code to your phone or email every time someone logs in from a new device. Even if the thief has your password, they can't access your account without that code. Most banks offer this for free through their website settings.

What to do if the hacker accessed other accounts or stole personal information

If the hacker also accessed your email, social media, or other financial accounts, or if they obtained personal information like your Social Security number, you're dealing with identity theft, not just account fraud. Report this to the Federal Trade Commission at IdentityTheft.gov. The FTC will create an identity theft report that you can use with creditors and banks if the thief opens new accounts in your name.

Place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts. You can place one for free by calling any of the three bureaus; they'll notify the others. The alert lasts one year and can be renewed.

If you're concerned about long-term identity theft, consider a credit freeze. This prevents anyone, including you, from opening new accounts in your name without unfreezing the credit file first. It's free and more protective than a fraud alert, but it's also more inconvenient if you want to open a new credit card or loan yourself.

Why your bank account was vulnerable and how to prevent it happening again

Most bank account hacks happen through one of three routes: phishing emails that trick you into entering your login credentials on a fake website, malware on your computer that records your keystrokes, or password reuse — you used the same password on your bank account and another website that was breached.

Check whether your email address or password appeared in a known data breach by visiting HaveIBeenPwned.com. This site lets you search for your email address against a database of millions of breached accounts. If your email appears, change the password on that account and any other accounts where you used the same password.

Going forward, use a unique password for your bank account that you don't use anywhere else. Use a password manager like Bitwarden, 1Password, or KeePass to generate and store complex passwords. Enable two-factor authentication on any account that holds money or personal information. Be skeptical of emails asking you to "verify your account" or "confirm your identity" — banks don't ask for login credentials by email. When in doubt, hang up and call the bank's main number yourself.

What happens if the bank denies your fraud claim

If the bank investigates and concludes the transaction was authorized, they'll send you a written explanation. You have the right to dispute their decision. Request a copy of the investigation file, which will include transaction details, IP addresses, and device information the bank used to make their information.

If you believe the bank made an error, file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB can compel the bank to review the case again. Include copies of your dispute letter to the bank, the bank's response, and any evidence that the transaction was unauthorized — for example, proof you were in a different location when the transaction occurred, or documentation that you never authorized the transfer.

You can also contact your state's banking regulator or attorney general's office. Most states have a consumer protection division that investigates complaints against banks. These agencies can't force a refund, but they can pressure the bank to reconsider.

Frequently Asked Questions

How long does it take to get my money back?

Most banks refund within 3 to 5 business days if the fraud is clear. The law requires a decision within 10 business days, but complex cases involving transfers to other banks can take up to 45 days. Ask your bank for a timeline when you report the fraud.

Can I use my account while the investigation is happening?

Yes. You can still access your money through online banking, ATMs, and in-person withdrawals. Don't use the old debit card. The bank may place a temporary hold on large transfers while they investigate, but routine access is usually available.

What if the hacker transferred money to another bank account?

Your bank will contact the receiving bank and request the money be returned. If the receiving bank cooperates, the refund can happen within a few days. If the receiving bank is uncooperative or the account has already been emptied, the process takes longer — sometimes 30 to 45 days. Your bank is still liable to refund you under the EFTA.

Do I have to pay for a new debit card?

No. Banks issue replacement cards for free when fraud is confirmed. Some banks also offer expedited shipping for a fee, usually $10 to $25, if you need the card faster than standard mail.

What if I missed the 60-day reporting window?

You lose the EFTA protection, and the bank has no legal obligation to refund you. However, many banks will still investigate and refund as a customer service gesture, especially if the fraud is obvious. Contact the bank and explain the situation. If they refuse, file a complaint with the CFPB or your state's banking regulator.