The first hours matter, but your money is usually protected

When someone gains access to your bank account without permission, the bank's fraud department takes over the investigation, not you. Your liability for unauthorized transfers depends on how quickly you report it and what type of account was compromised. Federal law caps your loss at $50 if you report the fraud within two business days of discovering it; after that, you could lose up to $500. If you wait more than 60 days to report it, you have no federal protection for transfers that occurred during that gap.

The bank will freeze your account to stop further unauthorized activity, which means you cannot withdraw money either. This freeze typically lasts while the investigation runs, usually 10 business days but sometimes longer. During this time, your direct deposits may still post, but you will not be able to access them until the freeze lifts. Checks you wrote before the hack may bounce if the account is frozen, so contact anyone you recently paid by check and let them know what happened.

Your bank will assign a case number and a fraud investigator. This person will pull the transaction history, compare the unauthorized transfers to your normal spending patterns, and contact merchants or receiving banks to trace where your money went. Some banks move faster than others; large national banks often have dedicated fraud teams that work within days, while smaller banks or credit unions may take longer.

Key Takeaways

  • Federal law limits your loss to $50 if you report unauthorized transfers within two business days of discovering them.
  • Your bank will freeze the account during the investigation, which typically lasts 10 business days but can extend longer.
  • You must report the fraud in writing (not just by phone) to set up your federal protections and start the formal investigation.
  • Money that was transferred out may be recovered from the receiving bank or merchant, but recovery is not may provide and can take weeks.
  • Your debit card will be cancelled and reissued; your account number may change depending on the bank's policy.

How the bank traces your money and what happens next

Once the fraudster moved your money out of your account, it went to another bank, a payment app, a wire transfer service, or a merchant. The receiving institution is legally required to hold the money while your bank's fraud team investigates. This hold period is typically 10 business days, though it can extend if the receiving bank needs more time to gather information.

If the money went to another bank account, your bank will contact that bank and ask them to freeze the funds pending your claim. If it went to a payment app like PayPal, Venmo, or Cash App, those companies have their own fraud procedures and will cooperate with the investigation. If it was a wire transfer to another country, recovery becomes much harder because international wire transfers are generally irreversible once sent.

The receiving bank or service will investigate on their end to determine whether the recipient was knowingly part of the fraud or an unwitting participant. If the recipient was a mule (someone who received stolen money and sent it elsewhere), the funds may be recoverable. If the recipient spent the money or it has already moved multiple times, recovery becomes unlikely. Your bank will update you on the status of the investigation, though they cannot always may provide the money will come back.

What you need to do in writing and by when

Call your bank when ready when you discover the fraud, but understand that the phone call does not start your federal protection period. You must send a written notice to your bank within two business days of discovering the unauthorized transfer. This can be an email to the fraud department, a letter mailed to the address on your statement, or a form submitted through your online banking portal—check your bank's website for their preferred method.

Your written notice should include your account number, the date you discovered the fraud, the date of the unauthorized transfer (if you know it), the amount, and a brief description of what happened. Keep a copy of everything you send and note the date and time you sent it. If you send it by email, request a read receipt. If you mail it, use certified mail with return receipt so you have proof of delivery.

The two-business-day clock starts from the moment you discover the fraud, not from when it happened. If you discover unauthorized transfers on a Friday evening, you have until the end of business on Monday to send your written notice. Weekends and bank holidays do not count as business days. If you miss the two-day window, you still have up to 60 days to report it, but your liability increases to $500 for any transfers made after the two-day period.

Your account will be closed and reopened with new numbers

Most banks will cancel your debit card when ready and issue a new one, which arrives in 7 to 10 business days. Some banks also change your account number as part of the fraud resolution process, though not all do. If your account number changes, you will need to update any automatic payments or direct deposits that were linked to the old number. Your bank should provide a list of what needs updating, but it is your responsibility to contact your employer, creditors, and service providers.

If automatic payments bounce because you did not update the account number in time, you could face late fees or service interruptions. Contact your payroll department, mortgage lender, utility companies, and subscription services as soon as you know your account number has changed. Most will update it within one business day if you call or use their online portal.

Your old debit card will no longer work at ATMs or merchants. If you have pending transactions that have not yet posted, they may be rejected because the card is no longer active. Check your recent transactions carefully during the first week after the fraud is reported to see which charges are still pending and which have posted.

How hackers get into bank accounts in the first place

The most common entry point is your email or password. If a hacker has your email address and password, they can log into your bank account directly. Passwords are often stolen from data breaches at other websites—if you reused the same password across multiple sites, a breach at one site gives the hacker access to all of them. The second most common method is phishing: a fake email or text that looks like it came from your bank, asking you to "verify" your login information or click a link to "confirm" your account.

Hackers also use malware or keyloggers installed on your computer or phone, which record everything you type, including your login credentials. Public Wi-Fi networks are a common infection vector because traffic is unencrypted. If you log into your bank account on public Wi-Fi without a VPN, someone on the same network can intercept your credentials.

Social engineering is another route: a hacker calls your bank pretending to be you, answers security questions using information from your social media or public records, and convinces the bank to reset your password or add a new authorized user to your account. This is why banks ask security questions—but those questions are often answerable from your public information.

What to do after the investigation closes

Once your bank completes the investigation, they will send you a written statement of their findings. This statement will say whether the transfers were confirmed as unauthorized, whether the money was recovered, and what your final liability is. If the bank determined that you were responsible for the transfers (because you shared your password or authorized the transaction), they will explain their reasoning. You have the right to dispute their conclusion in writing, though reversing a bank's information is difficult.

If money was recovered, it will be credited back to your account. This can take several weeks after the investigation closes because the receiving bank has to process the reversal. Check your account balance regularly and contact your bank if the credit does not appear within 30 days of the investigation closing.

After the investigation, change your password to something unique and strong—at least 12 characters with uppercase, lowercase, numbers, and symbols. Enable two-factor authentication on your bank account if it is available. Check your credit report at annualcreditreport.com to see if the hacker opened new accounts in your name. If they did, you will need to file a report with the Federal Trade Commission at reportidentitytheft.ftc.gov and place a fraud alert on your credit file.

Frequently Asked Questions

Can the bank refuse to refund me if I shared my password with someone?

Yes. If you voluntarily shared your password or login information with someone who then stole your money, the bank may classify it as authorized and deny your fraud claim. However, if someone obtained your password through phishing, malware, or a data breach, that is unauthorized fraud regardless of whether they had your credentials. The bank must prove you knowingly shared access.

What if the hacker transferred money to a cryptocurrency exchange?

Cryptocurrency exchanges are much harder to recover from than traditional banks because transactions are often irreversible and exchanges have fewer regulatory requirements to cooperate with investigations. Your bank will still investigate and contact the exchange, but recovery is unlikely once the money has been converted to cryptocurrency. Report the fraud to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov so it is on record.

Will I have to pay overdraft fees if my account goes negative during the fraud?

Many banks will waive overdraft fees related to fraudulent activity, but you have to ask. Contact your bank's customer service and explain that overdrafts occurred as a result of the unauthorized transfers. Some banks automatically reverse these fees; others require you to request it. Get the decision in writing.

How long does it take to get my money back?

The investigation itself takes 10 business days to 60 days depending on the bank and the complexity of the case. If money is recovered, the credit back to your account can take an additional 5 to 10 business days. If the money was transferred internationally or spent by the recipient, recovery may not happen at all. Your bank should give you a timeline when they open the investigation.

Do I need to file a police report?

You are not required to file a police report for the bank to investigate, but filing one creates an official record that can help if the hacker targeted multiple people. Contact your local police department's non-emergency line and ask how to file a report for online fraud. Provide them with your bank's case number and the details of the unauthorized transfers.