Stop the bleeding first, then document everything

Call your bank's fraud line right now—not the main customer service number, but the specific fraud or security line listed on the back of your card or on your statement. Tell them your account has been compromised. They will freeze your account when ready, which stops new transactions but also stops you from accessing your money temporarily. This is the trade-off you need to make.

While you're on the phone, ask the bank to tell you which transactions were unauthorized. Write down the date, time, amount, and merchant for each one. The bank will document this on their end, but having your own record matters because you'll need it for dispute forms and potentially for police reports. Ask specifically whether the hacker accessed your online banking, your debit card number, or both—this changes what happens next.

After you hang up, change your online banking password from a different device (a phone or computer the hacker hasn't touched). Use something long and random that you've never used before. If you used the same password anywhere else, change those accounts too.

Key Takeaways

  • Call your bank's fraud line when ready to freeze the account and stop new unauthorized charges.
  • Unauthorized debit card charges have a 60-day dispute window, but reporting within 2 days limits your liability to $50 instead of potentially $500.
  • File a dispute claim in writing with your bank within 10 days of discovering the fraud, even if you reported it by phone first.
  • Check your credit report at annualcreditreport.com for signs the hacker opened new accounts in your name, which requires a separate fraud alert or credit freeze.
  • If the hacker transferred money out of your account, the bank's liability is limited and recovery depends on how quickly you reported it.

Understanding your bank's liability and your window to report

Your liability for unauthorized charges depends entirely on how fast you report the fraud. If you report it within 2 business days of discovering the hack, your maximum loss is $50. If you wait longer than 2 business days but report within 60 days, your liability jumps to $500. After 60 days, you may not recover anything.

This 60-day window is federal law under Regulation E, and it applies to debit card fraud and unauthorized transfers from your checking account. Credit card fraud has different rules—you're liable for $0 on credit cards under federal law—but this article is about bank accounts, where the liability is yours unless you report quickly.

The bank's liability is also limited. If a hacker transferred money out of your account to another bank, the receiving bank has a duty to freeze those funds if you report the fraud within a few days. But if the money was already withdrawn as cash or sent to a third party, recovery becomes much harder. The bank will investigate, but they are not required to refund you if you were negligent—for example, if you wrote your PIN on your debit card or shared your password.

File a written dispute claim, not just a phone report

Calling the bank starts the process, but it does not create a formal dispute. You need to file a written claim. The bank should send you a dispute form after your phone call, or you can request one. Some banks let you file disputes through their online portal; others require a paper form mailed or faxed back.

On the form, list each unauthorized transaction separately with the date, amount, and merchant. Write a brief explanation: "I did not authorize this transaction" or "I did not make this purchase." Do not write a long story—banks process these forms quickly and they need the facts. Keep a copy for yourself and send the form via a method that gives you proof of delivery, like certified mail or email with read receipt.

The bank has 10 business days to acknowledge your dispute and 45 days to investigate and respond. During this time, they must credit your account provisionally—meaning you get the money back while they investigate, though they can take it back if they determine the transaction was actually authorized. Most disputes resolve in your favor within 30 days if the transaction was genuinely unauthorized.

Check whether the hacker opened new accounts in your name

Hackers who have your bank login often have your Social Security number too, either from the same breach or from a separate one. This means they may have opened credit cards, loans, or other accounts in your name. You need to know this happened before the damage spreads.

Go to annualcreditreport.com and order your free credit report from all three bureaus (Equifax, Experian, and TransUnion). You get one free report per bureau per year. Look for accounts you did not open, especially recent ones. If you find fraudulent accounts, you have two options: place a fraud alert or freeze your credit.

A fraud alert tells creditors to call you before opening new accounts in your name. It lasts one year and is free. A credit freeze locks your credit file entirely—creditors cannot see it, so they cannot open accounts. A freeze lasts until you lift it, and it is also free. Most people who have been hacked should freeze their credit, because a fraud alert only works if the creditor actually calls, and many do not.

To place a fraud alert or freeze, contact one bureau and they will notify the other two. You can do this online, by phone, or by mail. Keep the confirmation numbers they give you.

Recover money that was transferred out of your account

If the hacker transferred money to another bank account, the receiving bank has a legal duty to freeze those funds if you report the fraud quickly—usually within 3 to 5 business days. Your bank will send a "Reg E" notice to the receiving bank demanding the funds be held. The receiving bank then has 10 days to freeze the account and 20 days to return the money.

This works only if the receiving account is at a U.S. bank and the money is still there. If the hacker withdrew it as cash, transferred it to a cryptocurrency exchange, or sent it to an international bank, recovery is much harder. Your bank will still investigate, but they cannot force a foreign bank to return money, and they cannot recover cash that has already been withdrawn.

If the transfer went to a money transfer service like Western Union or MoneyGram, report it to that service when ready. They can sometimes stop the pickup if the money has not been collected yet. Get a case number and follow up weekly.

Report the fraud to law enforcement if the amount is significant

If the total unauthorized charges or transfers exceed $500, file a report with your local police department. You do not need to go in person—many departments let you file online. You will get a report number, which you should keep. The police are unlikely to investigate unless the amount is very large, but the report creates an official record that helps if you need to dispute something later or if the hacker targets you again.

You can also file a complaint with the Federal Trade Commission at reportfraud.ftc.gov. This does not recover your money, but it creates a record that helps the FTC track fraud patterns and warn other consumers. If identity theft is involved—meaning the hacker opened accounts in your name—file an identity theft report on the same site. This report gives you legal standing to dispute fraudulent accounts with creditors and bureaus.

Prevent it from happening again

Once your account is unfrozen and your disputes are resolved, take steps to make sure this does not happen again. Enable two-factor authentication on your online banking if your bank offers it. This means you need a code from your phone or email to log in, even if someone has your password.

Use a password manager to create and store unique passwords for every account. Do not reuse passwords. Do not write passwords down or share them with anyone. If you use public Wi-Fi, use a VPN (virtual private network) before logging into your bank account—public Wi-Fi is a common way hackers intercept login credentials.

Monitor your bank and credit card statements every week, not just once a month. The faster you spot fraud, the faster you can report it and the more money you will recover. Set up account alerts if your bank offers them—many banks can text or email you when a large transaction occurs or when your balance drops below a certain amount.

Frequently Asked Questions

How long does it take to get my money back after I file a dispute?

The bank must credit your account provisionally within 10 business days of receiving your written dispute. The full investigation takes up to 45 days. Most disputes resolve within 30 days if the transaction was genuinely unauthorized. If the bank determines the transaction was authorized, they can remove the provisional credit.

What if my bank says I was negligent and refuses to refund me?

Banks can deny a dispute if they prove you were negligent—for example, if you shared your password or wrote your PIN down. If your bank denies your dispute, you can escalate to your bank's complaint department or file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can force banks to reconsider.

Do I need to close my bank account after it gets hacked?

Not necessarily. Once the fraud is resolved and your account is unfrozen, you can keep it open if you want. However, some people prefer to close the old account and open a new one to get a fresh start. If you close it, make sure all your direct deposits and automatic payments are switched to the new account first, or they will fail.

Will the hacker be prosecuted?

Prosecution depends on whether law enforcement can identify and locate the hacker. Most small-scale account hacks are never prosecuted because the hacker is in another country or uses tools that hide their identity. Filing a police report creates a record, but it does not may provide prosecution. Focus on recovering your money rather than expecting criminal charges.

Should I freeze my credit if only my bank account was hacked?

If only your debit card number was stolen and used for purchases, a credit freeze is not necessary. But if the hacker also had access to your online banking or if you suspect they have your Social Security number, freeze your credit. It is free and takes 10 minutes, and it prevents them from opening new accounts in your name.