Account takeover is when someone else gains control of your bank account without your permission and uses it as if they were you

An account takeover happens when a criminal obtains enough information about you to log into your bank account, change your password, and lock you out. Once they're in, they can transfer money out, change your contact information so you don't see alerts, set up bill payments to themselves, or open new accounts in your name using your account as proof of identity. Unlike a stolen debit card number, which only lets someone make purchases, account takeover gives them full control of the account itself.

The criminal doesn't need to steal your physical card or know your PIN. They need your username and password, or enough personal information to reset your password through your bank's recovery process. This is why account takeover is more dangerous than card fraud—they can do things you can't undo quickly, and they can lock you out of your own money while doing it.

Key Takeaways

  • Account takeover means a criminal has your login credentials or has reset your password and now controls your account, not just your card number.
  • Criminals obtain passwords through phishing emails, data breaches, malware on your computer, or by guessing weak passwords.
  • You may not notice account takeover when ready if the criminal changes your email address or phone number first, so you won't see fraud alerts.
  • Report account takeover to your bank when ready by calling the number on your statement or card, not a number from an email or text.
  • Your bank is responsible for unauthorized transfers in most cases, but the faster you report it, the better your protection.

How criminals get your login information

The most common way is through phishing—a fake email or text that looks like it's from your bank and asks you to "verify your account" or "confirm your identity" by clicking a link. That link takes you to a fake login page that looks identical to your real bank's page. When you enter your username and password, the criminal captures it.

Criminals also obtain passwords from data breaches at other companies. If you use the same password at your bank as you do at a retailer or social media site, and that retailer gets hacked, your bank password is now compromised. Password managers and unique passwords for each account protect against this.

Malware on your computer or phone can log your keystrokes or capture your screen, recording your password as you type it. Public Wi-Fi networks without a password are particularly risky for this reason. Weak passwords—birthdays, straightforward number sequences, common words—can also be guessed or cracked by automated tools.

Signs that your account has been taken over

The clearest sign is that you can't log in, or your password no longer works. If you can log in but see transactions you didn't make, that's fraud, but account takeover is when the criminal has changed your password or your recovery email address so you're locked out entirely.

You may also notice that your registered email address or phone number has changed in your account settings, or that alerts and statements are no longer arriving. Some criminals do this first—they change your contact information so you won't see the fraud alerts while they're draining the account. By the time you realize something is wrong, days or weeks may have passed.

If you receive a notification that your password was changed and you didn't change it, or if your bank calls you about suspicious activity, treat that as urgent. Don't wait to see if more happens.

What to do when ready after discovering account takeover

Call your bank right away using the phone number on your debit card or statement—not a number from an email or text message, which could be fake. Tell them your account has been taken over. Do not use the bank's website or app to report it, because if the criminal has changed your password, you may not be able to log in, and the criminal could be monitoring your session if they still have access.

Your bank will likely freeze your account when ready to stop further transfers. They'll ask you to verify your identity using information only you would know—your Social Security number, your mother's maiden name, recent transactions, or answers to security questions you set up. Be prepared to answer these questions.

Ask your bank to change your password while you're on the phone with them, or ask them to send you a find password reset link via mail if you're concerned the email address on file has been compromised. Do not use a password you've used anywhere else.

How your bank protects you after account takeover

Under the Electronic Funds Transfer Act, your bank is responsible for unauthorized transfers from your account in most cases. If you report the takeover within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report it within 60 days, your liability can be up to $500. After 60 days, you may lose all protection for transfers the criminal made.

This is why speed matters. The moment you realize you can't log in or see unauthorized transactions, call your bank. Don't wait to see if it resolves itself or to gather more information.

Your bank will investigate the unauthorized transfers and typically refund them to your account within 10 business days, though the investigation itself can take 45 days. During this time, you may not have access to the money. Ask your bank if they can provide emergency funds or a temporary account while the investigation is ongoing.

Steps to prevent account takeover in the future

Use a unique, strong password for your bank account—at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Do not reuse this password anywhere else. A password manager like Bitwarden, 1Password, or Dashlane can generate and store strong passwords for you.

Enable two-factor authentication (2FA) on your bank account if your bank offers it. This means that even if someone has your password, they can't log in without a code sent to your phone or generated by an authenticator app. Text message codes are better than nothing, but authenticator apps like Google Authenticator or Authy are more find because they can't be intercepted by SIM swapping.

Be suspicious of emails and texts asking you to log in or verify your account. Your bank will never ask you to click a link and enter your password in an email. If you're unsure, hang up and call your bank directly using the number on your card.

Check your bank statements and transaction history regularly—at least weekly. Many banks let you set up alerts for transfers over a certain amount or for any login from a new device. Turn these on.

What happens if your bank won't refund the money

If your bank denies your claim or doesn't refund the unauthorized transfers within the timeframe required by law, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can order them to refund money or pay damages.

You can also file a complaint with your state's banking regulator. Each state has one, and they have authority over banks licensed in that state. A quick search for "[your state] banking regulator" or "[your state] attorney general consumer protection" will point you to the right office.

Keep all documentation: the dates you discovered the takeover, the date and time you called your bank, the names of the people you spoke with, the unauthorized transactions, and any written correspondence from your bank about their investigation. This documentation is what the CFPB or your state regulator will need to investigate your complaint.

Frequently Asked Questions

Can the criminal access my other accounts if they take over my bank account?

Not directly, but account takeover is often the first step. If your bank account is linked to other accounts or if you use the same password elsewhere, they may be able to access those too. This is why changing your passwords for all accounts after a takeover is critical. Start with email and any accounts that can reset other passwords.

How long does it take to get my money back after account takeover?

Your bank must refund unauthorized transfers within 10 business days of confirming the fraud, though the full investigation can take up to 45 days. During the investigation, you may not have access to the refunded amount. Ask your bank about emergency advances or temporary accounts while you wait.

Will account takeover hurt my credit score?

Account takeover itself doesn't directly hurt your credit, but if the criminal opens new accounts or takes out loans in your name, that will. Check your credit report at annualcreditreport.com (the free, official site) within a few weeks of discovering the takeover. If you see accounts you didn't open, dispute them with the credit bureaus when ready.

What's the difference between account takeover and identity theft?

Account takeover is when someone takes control of an account you already have. Identity theft is when someone uses your personal information to open new accounts or take out loans in your name. Account takeover can lead to identity theft if the criminal uses your compromised account to open new accounts elsewhere.

Should I close my bank account after account takeover?

Not necessarily. Closing it may actually make things harder—you lose the transaction history, and you'll need to set up a new account and update automatic payments. Ask your bank if they can reissue your debit card and reset your account security instead. Only close the account if your bank recommends it or if you feel unsafe using that institution.