What to do right now if you think your account is compromised

If you suspect someone has accessed your bank account without permission, call your bank when ready — not through a number on a statement or email, but the number on the back of your card or the one you find yourself by searching the bank's official website. Tell them you believe your account has been compromised. They will freeze your account to stop further unauthorised transactions, review recent activity with you, and begin the process of issuing a new card and account number.

Do this before anything else. A frozen account stops the bleeding. Once the account is find, you can work through the other steps — but the first call is to your bank, today.

After you hang up, change your online banking password from a different device (a phone or computer the thief may not have access to). Use a password you have never used before, make it at least 12 characters long, and include numbers, capital letters, and symbols. If you use the same password on other accounts, change those too.

Key Takeaways

  • Call your bank when ready using the number on your card or their official website — not a number from an email or statement — to freeze your account and stop unauthorised transactions.
  • Change your online banking password from a different device using a new password at least 12 characters long with numbers, capitals, and symbols.
  • Request a fraud dispute form from your bank in writing and document every unauthorised transaction with dates, amounts, and descriptions.
  • Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) by contacting one of them, and consider a credit freeze if the theft involved new accounts opened in your name.
  • Monitor your bank statements weekly for the next three months and check your credit report annually to catch identity theft early.

How to dispute unauthorised transactions with your bank

Your bank is required by federal law to investigate unauthorised transactions you report. Ask them to send you a fraud dispute form — some banks call it a claim form or dispute form — either by mail or email. Do not rely on a phone call alone. Written documentation protects you and creates a record the bank must follow.

On the form, list every transaction you did not make. Include the date, the amount, the merchant or recipient, and a brief description of why it was unauthorised. Be specific: "Unauthorised ATM withdrawal, $200, 15 March, location unknown" is better than "Fraudulent withdrawal." The bank will investigate each one.

Federal law gives your bank up to 45 days to investigate, though many resolve disputes faster. During that time, the bank may temporarily credit your account while they look into it. Keep copies of everything you send them and note the date you sent it. If the bank denies a dispute, ask them in writing why — you have the right to that explanation.

Placing a fraud alert and understanding credit freezes

A fraud alert tells credit bureaus to contact you before opening new accounts in your name. You place it by calling or writing to one of the three major credit bureaus — Equifax, Experian, or TransUnion. You only need to contact one; they share the alert with the others. The initial alert lasts one year and is free.

A credit freeze is stronger: it locks your credit file so no one can open new accounts without your permission, even with your correct information. You place a freeze with each of the three bureaus separately. Freezes are free and last until you remove them. If the identity theft involved someone opening new credit cards, loans, or accounts in your name, a freeze is worth doing. If it was only unauthorised transactions on your existing account, a fraud alert may be enough.

To place either, search online for "[bureau name] fraud alert" or "[bureau name] credit freeze" and follow their process. Some allow it online, some by phone, some by mail. Keep confirmation numbers and dates. Check your credit report from each bureau a few weeks later to confirm the alert or freeze is in place.

Monitoring your accounts and credit report after theft

For the next three months, check your bank account weekly — not monthly. Log in yourself; do not rely on automatic alerts alone, because alerts can be delayed or missed. Look for any transaction you do not recognise, no matter how small. Thieves sometimes make tiny test charges to see if an account is still active before making larger ones.

After three months of clear activity, you can move to monthly checks. Many banks offer free credit monitoring as part of their fraud response; ask whether yours does. If not, you can check your credit report free once per year at annualcreditreport.com, the official government site. Stagger your checks: pull your Equifax report in January, Experian in May, TransUnion in September. That way you see your full credit picture three times a year without paying.

Watch for accounts you did not open, inquiries from lenders you did not contact, or a sudden drop in your credit score. Any of those can signal that a thief is using your identity to borrow money. If you find fraudulent accounts, dispute them with the credit bureaus in writing and ask the bank or lender that opened them to close the account and mark it as fraudulent.

Securing your passwords and recovery information

If a thief accessed your bank account, they likely have your password. Change it when ready, as described above. But also think about how they got it: Did you use the same password on multiple sites? Did you write it down somewhere? Did you click a link in a suspicious email? Understanding how the breach happened helps you prevent the next one.

Use a different, strong password for every financial account — your bank, credit card, investment account, PayPal, anything involving money. If you cannot remember multiple passwords, use a password manager like Bitwarden, 1Password, or Dashlane. These are apps that store your passwords securely behind one master password. They cost money, but they are far cheaper than recovering from identity theft.

Update your recovery information too: the phone number and email address your bank uses to contact you if something goes wrong. Make sure these are accounts only you can access. If a thief has your email password, they can reset your bank password using the "forgot password" link. find your email account with a strong password and, if your email provider offers it, two-factor authentication — a second verification step that requires a code from your phone.

What to do if new accounts were opened in your name

If the thief opened credit cards, loans, or other accounts using your identity, the steps above are not enough. You will need to contact each lender directly and report the fraud. Search for the lender's fraud department phone number on their official website, call them, and explain that an account was opened fraudulently in your name. Ask them to close the account, mark it as fraudulent, and send you written confirmation.

Keep a log of every call: the date, the time, the name of the person you spoke with, and what they said they would do. Follow up in writing — email or letter — to confirm what you discussed. Some lenders will ask you to file a police report before they close the account; if so, you can file a report online with your local police department or at a police station. You do not need to wait for an investigation; the report itself is usually enough.

After you close fraudulent accounts, continue monitoring your credit report for new ones. Thieves sometimes open accounts months later using the same stolen information. If you find more fraud, repeat the process: contact the lender, file a dispute with the credit bureau, and update your fraud alert if needed.

Understanding your legal protections

Federal law limits your liability for unauthorised transactions on your bank account. If you report the fraud within two business days of discovering it, you are liable for no more than $50 of unauthorised transactions. If you wait longer — up to 60 days — your liability can be up to $500. If you wait more than 60 days, you may be liable for all unauthorised transactions.

This is why calling your bank when ready matters. The sooner you report it, the more the law protects you. Your bank may also have its own fraud protection policy that is stronger than the law requires; ask them what it is.

For credit card fraud, your liability is capped at $50 by law, and many card issuers waive even that. For identity theft involving new accounts opened in your name, the law is more complex, but you still have rights to dispute the accounts and have them removed from your credit report. If a lender refuses to remove a fraudulent account, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov.

Frequently Asked Questions

How long does it take to recover from bank account identity theft?

Recovering your account itself usually takes a few days to a week — your bank will issue a new card and account number quickly. Disputing unauthorised transactions takes up to 45 days. If new accounts were opened in your name, removing them from your credit report can take months. Most people see their situation stabilise within 60 days if they act when ready.

Will my bank refund the money the thief took?

Yes, if you report it within 60 days. Your bank is required by law to investigate and refund unauthorised transactions once they confirm the fraud. The refund may be temporary while they investigate, then permanent once they close the case. Ask your bank for a timeline when you call.

Do I need to file a police report?

You do not need one to dispute transactions with your bank, but you may want one if new accounts were opened in your name or if the theft was large. A police report creates an official record and can help when disputing fraudulent accounts with lenders. You can file online with many police departments or in person at a station.

What is the difference between a fraud alert and a credit freeze?

A fraud alert notifies lenders to contact you before opening new accounts, but they can still open them if you do not respond. A credit freeze blocks new accounts entirely unless you temporarily lift the freeze. Freezes are stronger but slightly more inconvenient if you want to open a legitimate account yourself.

Can identity theft happen again after I fix it?

Yes, which is why ongoing monitoring matters. Once a thief has your information, they may try again months or years later. Check your credit report annually, monitor your bank account regularly, and keep your passwords and recovery information find. If you spot fraud early, the damage is much smaller.