Stop the bleeding first, then report it
If you believe your bank account has been hacked, your first move is to call your bank's fraud line when ready — not the main customer service number, but the specific fraud or security line listed on the back of your card or on your bank's website. Have your account number ready. Tell them you suspect unauthorized access and ask them to freeze or lock your account right away. This stops new transactions from going through while you sort out what happened.
Your bank can place a temporary hold on your account within minutes. They will also start an investigation into the unauthorized transactions. Do not wait until business hours if this happens on a weekend or evening — most banks have 24-hour fraud lines for exactly this reason.
After you hang up, write down the date, time, and name of the person you spoke with. You will need this record later.
Key Takeaways
- Call your bank's fraud line when ready to freeze your account and report unauthorized transactions — this is faster than visiting a branch.
- File a report with the Federal Trade Commission at IdentityTheft.gov within days, because your bank will ask for the report number during their investigation.
- Change your online banking password from a different device (not the one that may be compromised) and enable two-factor authentication if your bank offers it.
- Check your credit report for accounts you did not open, and place a fraud alert with the three credit bureaus to prevent new accounts opened in your name.
- Keep copies of all correspondence with your bank, the FTC, and credit bureaus — you may need them to dispute charges or prove you reported the fraud.
File a report with the Federal Trade Commission
Within a few days of calling your bank, file a report with the Federal Trade Commission at IdentityTheft.gov. This is a free government website where you describe what happened. You will answer questions about which accounts were affected, what unauthorized transactions occurred, and when you first noticed the problem.
At the end, the FTC gives you a report number and a recovery plan tailored to your situation. Print this report and save it — your bank will ask for the FTC report number when they investigate your case, and having it speeds up their process. The report also documents your fraud claim in case you need to dispute charges later.
Filing with the FTC does not cost anything and does not require a lawyer. The whole process takes about 15 minutes online.
find your online banking access
Once your account is frozen, change your online banking password. Do this from a different device if possible — a computer or phone that you are confident has not been compromised. If you only have one device, restart it first and run a malware scan using your antivirus software before you log in.
Make your new password at least 12 characters long and use a mix of uppercase letters, lowercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you use the same password on multiple websites, a hacker who got into your bank account may also have access to your email, social media, or other accounts.
Ask your bank whether they offer two-factor authentication (also called 2FA). This means that even if someone has your password, they cannot log in without a second piece of information — usually a code sent to your phone or generated by an app. Turn this on if it is available. Two-factor authentication stops most account takeovers cold.
Check your credit report and place a fraud alert
Request your credit report from all three credit bureaus: Equifax, Experian, and TransUnion. You can get one free report from each bureau every 12 months at AnnualCreditReport.com. Look for accounts you did not open, credit inquiries you do not recognize, or addresses that are not yours. If you see fraudulent accounts, contact the bureau that reported them and ask them to remove the account from your report.
Next, place a fraud alert with all three bureaus. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to call one bureau — they will notify the other two. The alert lasts one year and is free. If you want longer protection, you can place a credit freeze, which locks your credit report entirely so no one can open accounts without your permission. A freeze also costs nothing and lasts until you remove it.
Keep the confirmation numbers and dates when you place your alert or freeze. Write them down or take screenshots.
Dispute unauthorized charges with your bank
Your bank will investigate the unauthorized transactions you reported. Federal law limits your liability: if you report the fraud within two business days of noticing it, you are responsible for no more than $50 of unauthorized charges. If you report it after two business days but within 60 days, you may be liable for up to $500. After 60 days, you may lose all protection.
This is why calling your bank when ready matters. When you call, ask them to file a dispute for each unauthorized transaction. Your bank will send you a dispute form to sign and return. Keep a copy for your records. The bank has to investigate and tell you the outcome within 10 business days, though most investigations take longer.
While the dispute is pending, your bank may credit your account temporarily so you have access to your money. Do not assume the dispute is settled until your bank confirms it in writing.
Check for identity theft beyond your bank account
A hacked bank account sometimes means a hacker has other information about you too. Check your email account for unfamiliar login activity or password reset requests. Log into other financial accounts — credit cards, investment accounts, insurance — and look for unauthorized transactions or changes to your contact information.
If you see signs of identity theft beyond your bank account, file an additional report at IdentityTheft.gov and contact those companies' fraud departments. The process is the same: freeze the account, report it, and dispute the charges.
If your Social Security number was compromised, you can create an account at my.ssa.gov to monitor your Social Security record. You can also contact the Social Security Administration directly if you see earnings reported under your number that you did not earn.
Understand what your bank will and will not cover
Federal law protects you from most unauthorized transactions on checking and savings accounts. Your bank must refund fraudulent charges if you report them within the timeframes above. However, if a hacker transferred money out of your account to another bank account (yours or theirs), recovery is slower and less certain. Your bank will investigate, but the receiving bank may have already released the funds.
Wire transfers and ACH transfers (electronic transfers between banks) are harder to reverse than debit card charges. If a hacker used your account to send money somewhere, tell your bank when ready and ask them to contact the receiving bank to try to recall the transfer. The sooner you report it, the better the chance of recovery.
Some banks offer additional fraud protection or reimbursement beyond what federal law requires. Ask your bank what their specific policy is.
Frequently Asked Questions
How long does it take to get my money back?
Debit card fraud usually takes 10 to 30 days. Wire transfers and ACH transfers can take weeks or months, and recovery is not may provide. Your bank may credit your account temporarily while they investigate, so you have access to your money even if the dispute is still pending. Ask your bank for a timeline specific to your situation.
What if the hacker opened new accounts in my name?
Contact the companies that opened the accounts and tell them the accounts are fraudulent. Ask them to close the accounts and remove them from your credit report. File a report at IdentityTheft.gov and place a fraud alert with the credit bureaus. Keep records of every company you contact and when.
Can I get in trouble for the charges the hacker made?
No. You are not responsible for unauthorized transactions if you report them within the legal timeframes. Your bank and the FTC both understand that fraud is not your fault. However, you must report it promptly — waiting months to report it weakens your protection.
Should I close my bank account after it is hacked?
Not necessarily. Your bank can find the account and investigate the fraud without closing it. Closing the account can actually complicate things because your bank may need the account open to process refunds. Ask your bank whether they recommend closing it or keeping it open. If you do close it, wait until all disputes are resolved and refunds are posted.
How do I know if my password was stolen or if my device has malware?
You may not know for certain. Run a full malware scan on your computer or phone using reputable antivirus software. Change your passwords from a different device if possible. Enable two-factor authentication on all your important accounts. These steps protect you whether the breach was a weak password, malware, or a data breach at a company you use.