Stop the bleeding first, then document what happened

Call your bank when ready—not the number on your card, but the number on your most recent statement or the one listed on the bank's official website. Tell them your account has been compromised. They will freeze the account or cancel your debit card on the spot. This takes minutes and stops most unauthorized transactions from going through.

While you're on the phone, ask the bank to review recent transactions with you and flag anything you didn't make. Write down the date, time, amount, and merchant name for each fraudulent charge. The bank will create an incident report with a reference number—keep this number. You'll need it for disputes, fraud claims, and your own records.

Change your password when ready after the call, using a device you trust (not the one that may have been compromised). Make it long and unique—at least 16 characters, mixing letters, numbers, and symbols. Do not reuse a password you've used anywhere else.

Key Takeaways

  • Call your bank directly using the number on your statement or their official website, not a number from an email or text, to report the hack and freeze your account.
  • Unauthorized charges made with a debit card are usually refunded within 10 business days if you report them before the bank's important date, which is typically 60 days from the statement date.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record in case the hacker opens new accounts in your name.
  • Check your credit reports from all three bureaus (Equifax, Experian, TransUnion) for accounts you didn't open, and place a fraud alert or credit freeze if you find suspicious activity.
  • Monitor your bank account and credit for at least six months, because some hackers sell stolen information and credentials to other criminals who act weeks or months later.

How debit card fraud refunds actually work

If the hacker used your debit card number to make purchases, the bank will refund those charges—but the timeline depends on when you report it. Report within two business days of discovering the fraud, and your liability is capped at $50 under federal law. Report between two and 60 days, and you could be liable for up to $500. Report after 60 days, and you may lose the entire amount.

The refund itself usually takes 10 business days once the bank confirms the charge was fraudulent. During that time, the money is gone from your account. If those charges were rent, utilities, or groceries, you're short. This is why calling when ready matters—the sooner the bank freezes the account, the fewer new charges can post.

If the hacker transferred money out of your account directly (not through a card transaction), the rules are different. You have the same reporting windows, but the bank may take longer to investigate because it's treated as an unauthorized transfer rather than a card dispute. Ask your bank specifically how they handle ACH transfers and wire transfers, because the process varies.

File a fraud report with the FTC and your state

Go to IdentityTheft.gov and file a report. This is a free federal service run by the Federal Trade Commission. You'll answer questions about what happened, what accounts were affected, and what steps you've already taken. At the end, you'll get an Identity Theft Report—a document that proves to creditors, banks, and other institutions that you reported the fraud officially.

The Identity Theft Report is your shield against being held responsible for accounts a hacker opens in your name later. When you dispute a fraudulent account, you can send this report to show you reported the original hack. Without it, creditors may assume you opened the account yourself and forgot.

You can also file a report with your state's attorney general office, though the FTC report is usually sufficient. Some states have their own fraud hotlines or online portals. A quick search for "[your state] attorney general identity theft" will show you what's available in your area.

Check your credit reports and place a fraud alert

Request your free credit reports from all three bureaus—Equifax, Experian, and TransUnion—at AnnualCreditReport.com. This is the only official site authorized by federal law. You get one free report per bureau per year. Check each one for accounts you didn't open, inquiries from creditors you didn't contact, or addresses that aren't yours.

If you find fraudulent accounts on your credit report, place a fraud alert with all three bureaus. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It's free and lasts one year. You only need to contact one bureau—they're required to notify the other two. Call Equifax at 1-800-525-6285, Experian at 1-888-397-3742, or TransUnion at 1-800-680-7289.

If you find multiple fraudulent accounts or believe the hacker has your Social Security number, consider a credit freeze instead. A freeze locks your credit file so no one can open new accounts without your permission. It's also free and lasts until you remove it. You place it with each bureau separately through their websites.

Monitor your accounts and credit for the next six months

Check your bank account and credit card statements weekly for the next month, then monthly for at least six months. Hackers sometimes sell stolen credentials to other criminals, who may try to use them weeks or months after the original breach. Early detection stops them before they cause real damage.

Set up account alerts with your bank if you haven't already. Most banks let you set alerts for transactions over a certain amount, out-of-state purchases, or any login from a new device. These alerts go to your phone or email and take seconds to set up.

If you discover new fraudulent charges after the initial hack, report them to your bank when ready. Each unauthorized transaction resets your reporting window. Document everything—dates, amounts, merchants—and keep copies of all correspondence with the bank.

What to do if the hacker opened new accounts in your name

If you find credit accounts, loans, or utility accounts you didn't open, contact the creditor directly and tell them the account is fraudulent. Ask for the fraud department. Provide your Identity Theft Report from the FTC as proof. The creditor should close the account and remove it from your credit report, though this can take 30 to 60 days.

Send written disputes to the credit bureaus as well. Include a copy of your Identity Theft Report and a letter explaining which accounts are fraudulent. Send it certified mail with return receipt so you have proof of delivery. The bureaus have 30 days to investigate and remove fraudulent accounts from your report.

If a fraudulent account resulted in a collection account or judgment against you, you may need to work with the original creditor to have it removed. This is more complex and sometimes requires a lawyer, especially if the amount is large. Many consumer protection attorneys work on contingency for identity theft cases.

Protect your accounts from the next breach

Use a password manager like Bitwarden, 1Password, or KeePass to generate and store unique passwords for every account. This way, if one password is compromised, the hacker can't use it to access your email, social media, or other financial accounts.

Enable two-factor authentication (2FA) on your bank account and email. Two-factor means the bank sends a code to your phone or email when someone tries to log in from a new device. Even if a hacker has your password, they can't get in without that code. Most banks offer this through their app or website settings.

Consider a password-protected credit freeze if you're not planning to open new credit accounts soon. It's free and stops most identity theft cold. You'll need to temporarily lift it when you do want to explore for credit, but that takes five minutes online.

Frequently Asked Questions

How long does it take to get my money back?

Debit card fraud refunds usually post within 10 business days of the bank confirming the charge was unauthorized. Unauthorized transfers (ACH or wire) can take longer—sometimes 20 to 30 days—because the bank investigates more thoroughly. Ask your bank for a specific timeline when you report the fraud.

Can the hacker get back in if I just change my password?

Changing your password stops them from logging in with the old one, but only if they don't have access to your email or phone. If they have your email password, they can reset your bank password. Change your email password first, enable two-factor on your email, then change your bank password. If you think your email is compromised, contact your email provider when ready.

Do I have to pay for a credit freeze?

No. Federal law requires the three credit bureaus to place and remove freezes for free. Anyone charging you for a freeze is running a scam. Go directly to Equifax.com, Experian.com, or TransUnion.com to place a freeze yourself.

What if my bank says it's my fault for not protecting my password?

That's not how the law works. Under the Electronic Funds Transfer Act, you're only liable for unauthorized charges if you were negligent—and even then, your liability is capped at $50 if you report within two days. If the bank refuses to refund charges, file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. Include your incident report number and timeline.

Should I close the hacked account?

Not when ready. Keep it open for at least 30 days so the bank can process refunds and disputes. Once all fraudulent charges are resolved and refunded, you can close it. Closing it too early can delay refunds or make it harder to dispute charges that post after closure.