Signs that show up in your account activity
The clearest sign of a hacked bank account is a transaction you did not make. Log into your account and look at the past 30 days of activity. Check for withdrawals, transfers, or purchases you do not recognize. Hackers often test access with a small charge first — sometimes $1 or a few dollars — before moving larger amounts. If you see even one unfamiliar transaction, treat it as a breach.
Other signs appear in your account settings rather than your transaction history. Check whether your registered phone number or email address has changed. Look at your linked accounts and payment methods — if a new card, bank account, or digital wallet is connected that you did not add, someone else has access. Some banks show a list of devices that have logged in recently; unfamiliar devices or locations are a red flag.
Watch for account lockouts or password reset attempts. If you try to log in and your password no longer works, or if you receive a password reset email you did not request, your account may be compromised. Banks sometimes lock accounts automatically when they detect unusual activity, which is a protective measure but still means something triggered their fraud detection.
Key Takeaways
- Any transaction you do not recognize — even a small test charge — means your account has been accessed without your permission.
- Check your account settings for changes to your phone number, email, linked cards, or recent login locations that you did not authorize.
- A password that no longer works or unexpected password reset emails indicate someone has control of your login credentials.
- Contact your bank when ready by phone using the number on your card or statement, not a number from an email or text message.
- Your bank can freeze the account, reverse fraudulent transactions, and issue a new card or account number within hours.
What happens when you call your bank
Call your bank's fraud line when ready. The phone number is on the back of your debit or credit card, or on your most recent statement. Do not use a number from an email or text message, even if it looks official — call the number you already have on file. Have your account number and a form of identification ready.
Tell the bank representative which transactions are fraudulent and when you first noticed them. The bank will ask whether you recognize the merchant names and whether you authorized the charges. Be specific: "I did not make a purchase at this store on this date" is clearer than "some of these are wrong." The bank records this conversation and uses it to investigate.
The bank will typically freeze your account or the specific card within minutes. This stops further unauthorized charges. They will issue a new card or account number and may reverse the fraudulent transactions when ready, though the investigation can take up to 10 business days. Ask the representative for a case number and when you should expect the reversal to post.
The difference between debit and credit card fraud
If the hacked account is a credit card, your liability is capped at $50 under federal law, and most card issuers waive even that. The fraudulent charges are not your money — they are the card issuer's money. Once you report the fraud, the card issuer investigates and removes the charges from your bill. You do not pay for unauthorized credit card use.
If the hacked account is a debit card or a direct bank account, the liability depends on how quickly you report it. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report it within 60 days, your liability can be up to $500. After 60 days, you may lose all protection and be responsible for the full amount. This is why speed matters for debit accounts.
For both types, contact your bank as soon as you notice the fraud. The clock starts when you discover the unauthorized activity, not when it occurred. If you find a fraudulent charge from three weeks ago but report it today, you are still within the two-day window for debit card protection.
Steps to take after your bank confirms the breach
Once your bank has frozen the account and issued a new card or account number, change your online banking password. Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you used the same password for other accounts — email, social media, shopping sites — change those passwords too.
Check your credit report for accounts you did not open. You can view your credit report for free once per year at annualcreditreport.com, which is the official site run by the three major credit bureaus. Look for new credit cards, loans, or accounts in your name. If you find fraudulent accounts, contact the credit bureau and the company that issued the account.
Consider placing a fraud alert or credit freeze on your credit file. A fraud alert tells lenders to verify your identity before opening new accounts in your name. A credit freeze prevents anyone, including you, from opening new accounts without your permission. Both are free and take a few minutes to set up through any of the three credit bureaus: Equifax, Experian, or TransUnion.
How hackers get into bank accounts
The most common route is a phishing email or text message that looks like it came from your bank. The message asks you to "verify your account" or "confirm your information" and includes a link. That link takes you to a fake website that looks identical to your bank's site. When you enter your username and password, the hacker captures it. This is why your bank will never ask you to click a link in an email or text to log in.
Hackers also buy stolen login credentials from data breaches at other companies. If you used the same password at multiple sites and one of those sites was breached, a hacker can try that password at your bank. This is why using a unique password for each account matters — if one site is breached, your other accounts stay protected.
Malware on your computer or phone can capture your keystrokes or take screenshots of your login screen. Public Wi-Fi networks without passwords are particularly vulnerable — a hacker on the same network can intercept your data. Avoid logging into your bank account on public Wi-Fi. If you must, use a VPN (virtual private network) to encrypt your connection.
Preventing future breaches
Enable two-factor authentication on your bank account if your bank offers it. Two-factor authentication requires a second form of verification — usually a code sent to your phone or generated by an authenticator app — in addition to your password. Even if a hacker has your password, they cannot log in without this second code. Most banks offer this as an option in your account settings.
Set up account alerts for transactions above a certain amount. Many banks let you choose a threshold — for example, you receive a text or email whenever a charge over $100 posts to your account. This means you will know about large fraudulent charges within minutes rather than days. The alert does not prevent the charge, but it lets you report it quickly.
Review your account activity regularly — at least once a week. The sooner you spot a fraudulent transaction, the sooner you can report it and the more protection you have. Set a calendar reminder if that helps you stay consistent. Many banks also offer a mobile app that shows transactions in real time, which makes spotting fraud easier.
What to do if your bank denies your fraud claim
If your bank investigates and concludes the transaction was authorized, you have the right to dispute that decision. Ask the bank for a written explanation of why they denied your claim. Request the evidence they reviewed — this might include the merchant's records, the IP address used to log in, or the device information.
If you believe the bank made an error, file a complaint with the Consumer Financial Protection Bureau (CFPB). The CFPB is a federal agency that handles complaints about banks and financial institutions. You can file a complaint online at consumerfinance.gov. Include copies of your bank statements, the fraud report you filed, and the bank's denial letter. The CFPB will forward your complaint to the bank and track their response.
You can also contact your state's banking regulator or attorney general's office. Each state has an office that oversees banks operating in that state. They can investigate whether the bank followed proper procedures when handling your fraud claim. Having multiple complaints on file strengthens your case if the bank continues to deny legitimate fraud.
Frequently Asked Questions
How long does it take for the bank to reverse fraudulent charges?
Credit card charges are usually removed from your bill within one or two billing cycles. Debit card and bank account reversals can take up to 10 business days, though many banks process them faster. Ask your bank for a specific timeline when you report the fraud. In the meantime, you are not responsible for paying the fraudulent amount.
Can I get my money back if I wait a week to report the fraud?
For credit cards, yes — there is no time limit on reporting fraud, though you should report it as soon as you notice it. For debit cards, you have two business days to report and keep your liability at $50. After two days, your liability increases to $500. After 60 days, you may lose all protection. Report debit card fraud when ready.
What if the hacker changed my password and I cannot log in?
Call your bank directly using the number on your card. Tell them you cannot access your account and suspect fraud. The bank can verify your identity over the phone and reset your password or lock the account. Do not try to reset the password online if you suspect a breach — call the bank instead to may support you are talking to the real bank, not a fake site.
Do I need to close my account after it has been hacked?
Not necessarily. Your bank can issue a new card or account number, which stops the hacker from using the old one. Closing the account and opening a new one takes longer and can affect your credit history. Ask your bank whether they recommend closing the account or straightforward issuing new credentials. Most of the time, a new card or account number is sufficient.
Should I report the fraud to the police?
You can file a report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. The police report creates an official record that may help if the fraud is part of a larger scheme. However, local police rarely investigate individual account fraud cases. The bank's investigation and the CFPB complaint are usually more effective for recovering your money.