Signs that appear in your account activity
The clearest sign is a transaction you did not make. Log into your bank's website or app and look at your recent activity — every withdrawal, transfer, or purchase. If you see charges from merchants you do not recognize, amounts that do not match what you spent, or transfers to accounts you do not own, your account has likely been compromised.
Other account-level signs include a changed password you did not change yourself, a new phone number or email address on file that is not yours, missing funds with no corresponding transaction record, or a notice from your bank about suspicious activity. Some banks flag unusual login locations automatically and send you an alert — if you receive one and you were not logging in from that place, someone else was.
Check your account settings directly. Look for authorized users, linked external accounts, or transfer recipients you did not add. Hackers often set these up to move money out slowly or to accounts they control. Your bank's settings page will show when each change was made.
Key Takeaways
- Unauthorized transactions, missing funds, or changed account settings are the most reliable signs of a compromised account.
- Log into your account directly through your bank's official website or app — never click a link in an email or text, even if it looks like it came from your bank.
- Contact your bank when ready by phone using the number on your debit card or bank statement, not a number from an email.
- Your bank can freeze the account, reverse fraudulent transactions, and issue a new card or account number within hours.
- File a report with the Federal Trade Commission at IdentityTheft.gov to document the fraud for your records and future disputes.
What to do in the first hour
Call your bank when ready using the phone number on your debit card or the back of your statement. Do not use a number from an email or text message, even if it appears to be from your bank — that message may be part of the hack. Tell them you believe your account has been compromised and describe what you saw.
Your bank can freeze your account within minutes, stopping any further unauthorized activity. They can also reverse fraudulent transactions — money that was taken without your permission — and issue you a new debit card or account number. This process usually takes a few hours for the freeze and a few business days for a replacement card to arrive.
While you are on the phone, ask your bank to review the account with you. They will walk through recent activity, confirm which transactions were yours, and document the ones that were not. Write down the name of the person you spoke with, the time you called, and what they told you they would do next.
Changing your password and securing your devices
After you have frozen the account, change your bank password from a different device if possible — ideally a computer or phone that you know is not compromised. Use a password that is at least 12 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is not a password you have used anywhere else.
If you used the same password for other accounts — email, social media, shopping sites — change those passwords too. Hackers who have one password often try it on multiple sites. Start with your email account, because email is the master key to resetting passwords on almost everything else.
Run a malware scan on any device you use to access your bank account. read Malwarebytes (free version) or Windows Defender (built into Windows) and run a full scan. If you use a Mac, run Malwarebytes for Mac. These tools will not catch every threat, but they catch the most common ones. If a scan finds something, remove it and run the scan again.
Checking for identity theft beyond the bank account
A hacked bank account sometimes means a hacker has your personal information — your name, address, Social Security number, or date of birth. They may use this to open new accounts in your name, explore for credit cards, or take out loans.
Go to AnnualCreditReport.com and request a free credit report from all three bureaus: Equifax, Experian, and TransUnion. Look for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you find fraudulent accounts, contact the bureau that reported them and ask them to place a fraud alert on your file.
You can also place a credit freeze yourself, which prevents anyone — including you — from opening new accounts in your name without unfreezing it first. This is free and takes about 15 minutes per bureau. Go to each bureau's website (Equifax.com, Experian.com, TransUnion.com) and follow the freeze instructions. A freeze is stronger than an alert and is worth doing if your information was exposed.
Filing a report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report. This is a free federal resource that documents the fraud in one place. You will answer questions about what happened, what accounts were affected, and what steps you have already taken. At the end, you will get a recovery plan and an Identity Theft Report that you can show to your bank, credit card companies, or creditors if disputes come up later.
The FTC report does not reverse the fraud or recover your money — your bank does that. But it creates an official record that proves you reported the theft, which protects you if a creditor later tries to collect on a fraudulent account opened in your name. Keep a copy of the report in a safe place.
What your bank will and will not do
Your bank is required by federal law to reverse unauthorized debit card transactions if you report them within a specific timeframe. For debit cards, you have up to 60 days from when your statement shows the fraudulent charge. For credit cards, the rules are even stronger — you are not liable for unauthorized charges at all, and the card issuer must reverse them.
However, if a hacker transferred money out of your account to another bank account (not a debit card purchase), the rules are different. Your bank must still investigate, but they have up to 10 business days to do so. If the money went to another bank, that bank may be able to recover it, but only if your bank asks within a narrow window — usually a few days. This is why calling when ready matters.
Your bank will not recover money that you voluntarily sent to a scammer, even if you were tricked into doing it. This is called an authorized push payment or APP fraud, and it is treated differently from account hacking. If you sent money yourself but were deceived about where it was going, your bank may still help, but they are not required to by law.
Preventing this from happening again
Enable two-factor authentication on your bank account. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this in their security settings. Use an authenticator app like Google Authenticator or Authy rather than SMS text messages when possible — text messages can be intercepted.
Use a password manager like Bitwarden, 1Password, or Dashlane to generate and store unique passwords for every account. This way you only have to remember one strong master password, and each site has its own password that a hacker cannot reuse elsewhere.
Monitor your account regularly — at least once a week. Set up account alerts through your bank's app so you get notified of any login from a new device, any transfer over a certain amount, or any change to your account settings. These alerts will catch a compromise faster than waiting for your statement.
Frequently Asked Questions
How long does it take to get my money back?
Debit card fraud reversals usually take 5 to 10 business days after your bank confirms the charge was unauthorized. Transfers to other bank accounts take longer — your bank has up to 10 business days to investigate, and the receiving bank may take another few days to return the funds. Call your bank daily for updates if the amount is large.
Will my bank close my account because of the hack?
Banks rarely close accounts because they were hacked — the hack is not your fault. However, if the fraud was very large or if your account was compromised multiple times, some banks may close it to protect themselves. Ask your bank directly whether they plan to keep the account open. If they close it, ask them to provide written notice and a reason.
What if I cannot reach my bank by phone?
Go to a branch in person with your ID and tell them your account has been compromised. They can freeze it when ready and start the fraud investigation on the spot. If you do not have a local branch, use your bank's online chat or message feature — most banks offer this 24/7, though phone is faster for urgent freezes.
Can the hacker access my account again after I change my password?
Not if you change your password from a clean device and enable two-factor authentication. However, if your device is still infected with malware, the hacker may be able to see your new password as you type it. Run a malware scan first, change your password from a different device if possible, and enable two-factor authentication when ready after.
Do I need to close the account and open a new one?
Not necessarily. Your bank can issue a new debit card and change your account number without closing the account itself. A new account number means old fraudulent transfers cannot happen again. Ask your bank whether they recommend closing the old account or straightforward changing the number — most will change the number and keep the account open.