Stop the damage first, then notify your bank

If you believe your bank account has been hacked, your first move is to call your bank's fraud line when ready — not the main customer service number, but the specific fraud or security line listed on the back of your card or on your bank's website. Have your account number ready. Tell them you suspect unauthorized access and ask them to freeze or lock your account right away. This stops new transactions from going through while you sort out what happened.

Your bank can place a fraud hold on your account within minutes. This prevents the hacker from moving money out while you and the bank investigate. Do not wait for business hours or try to handle this online — call when ready, even at night or on weekends. Most banks have 24-hour fraud lines for this reason.

After you hang up, change your online banking password from a different device — ideally a computer or phone that was never used to access that account. Use a password you have never used before, at least 12 characters long, mixing letters, numbers, and symbols. If you used the same password anywhere else, change those accounts too.

Key Takeaways

  • Call your bank's fraud line when ready to freeze your account; do not wait for business hours or try to report it online first.
  • Your bank will investigate unauthorized transactions and typically refund fraudulent charges within 10 business days if you reported them promptly.
  • Check your account statements for the past 60 days and dispute each fraudulent transaction in writing, keeping copies of all correspondence.
  • Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) to prevent the hacker from opening new accounts in your name.
  • Monitor your credit report for the next year and consider a credit freeze if you believe your Social Security number was also compromised.

Document every fraudulent transaction in writing

Once your account is frozen, log in and review your statements for the past 60 days. Write down every transaction you did not make — the date, amount, merchant name, and transaction ID if visible. Your bank will ask for this list, and having it organized saves time.

Send a written dispute to your bank for each fraudulent charge. You can do this by mail, email, or through your online banking portal, depending on what your bank offers. Include your account number, the transaction details, and a clear statement that you did not authorize the charge. Keep a copy of everything you send and note the date you sent it. Your bank must investigate and respond within 10 business days, though they often take longer.

Under federal law, your liability for unauthorized transactions is limited. If you report the fraud before money leaves your account, you owe nothing. If you report it within two business days of discovering it, you are liable for no more than $50. If you wait longer than two business days but report it within 60 days of your statement, your liability can be higher — sometimes up to $500 — depending on your bank's policy. After 60 days, you may have no protection at all, which is why speed matters.

Place a fraud alert with the credit bureaus

Contact the three major credit reporting agencies — Equifax, Experian, and TransUnion — and ask each one to place a fraud alert on your credit file. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You only need to contact one bureau; by law, that bureau must notify the other two.

Equifax's fraud alert line is 1-800-525-6285. Experian is 1-888-397-3742. TransUnion is 1-800-680-7289. You can also place an alert online through each bureau's website. The alert lasts one year and is free. If you believe your identity has been stolen — not just your bank account hacked — you can request an extended alert that lasts seven years, though this requires additional documentation.

After placing the alert, order a free copy of your credit report from each bureau through AnnualCreditReport.com. This is the only official site for free reports; do not use other sites that claim to be free but ask for a credit card. Review each report for accounts you did not open. If you find fraudulent accounts, dispute them directly with the credit bureau and the creditor.

Understand what your bank will and will not cover

Banks are required by federal law to refund unauthorized transactions if you report them within a reasonable time. For debit card fraud, "reasonable" usually means within 60 days of your statement. For online banking fraud, the timeline is similar. Your bank will investigate by contacting the merchant or the receiving bank and asking for proof that you authorized the transaction.

However, banks sometimes deny refunds if they believe you were negligent — for example, if you wrote your PIN on your card, shared your password with someone, or ignored obvious signs of compromise. If your bank denies your dispute, you can escalate it to your bank's complaint department or file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB does not resolve individual disputes but tracks complaints and can pressure banks to change practices.

Wire transfers and transfers to other banks are harder to recover. If a hacker transferred money out of your account to another bank account, your bank can sometimes reverse the transfer if it is caught quickly — within 24 hours in many cases. After that, the money is usually gone, and you would need to work with the receiving bank to recover it. This is why freezing your account when ready is so important.

Check for signs the hacker accessed other accounts

If your bank account was hacked, the hacker may have also accessed your email, social media, or other financial accounts. Check your email's login history and recent activity. Most email providers show you where and when your account was accessed. If you see logins from unfamiliar locations or devices, change your email password when ready and enable two-factor authentication.

Review your other bank accounts, credit card accounts, and investment accounts for unauthorized activity. If you use the same password across multiple sites, change all of them. If you use a password manager, check that it has not been compromised — some password managers have had security breaches in the past. If you are unsure, change your passwords manually rather than relying on the manager until you know it is safe.

Check your phone bill and any accounts linked to your phone number. Hackers sometimes use account recovery features to take over accounts by redirecting text messages to their own phone. If you see charges you did not make or notice your phone service was briefly interrupted, contact your phone provider when ready.

Monitor your accounts and credit for the next year

Set a calendar reminder to check your bank and credit card statements every week for the next three months, then monthly for the rest of the year. Fraudsters sometimes make small test charges first to see if the account is being monitored, then make larger charges later. Catching these early stops the pattern.

Check your credit report again at three months and six months after the hack. You are may have access to to one free report per year from each bureau through AnnualCreditReport.com. Space them out so you have coverage throughout the year — order from Equifax in January, Experian in May, and TransUnion in September, for example. Look for new accounts, inquiries, or negative marks you did not authorize.

Consider enabling two-factor authentication on all your financial accounts. This requires a second form of verification — usually a code sent to your phone or generated by an app — before anyone can log in. It is not foolproof, but it makes it much harder for a hacker to access your account even if they have your password.

Know the difference between a fraud alert and a credit freeze

A fraud alert is free and lasts one year. It tells lenders to call you before opening new accounts, but lenders can still open accounts if they cannot reach you. A credit freeze is also free and locks your credit file entirely — no one can open new accounts without your permission, period. You can place a freeze through each of the three credit bureaus' websites.

A freeze is stronger protection but more inconvenient. If you want to open a new credit card, car loan, or mortgage, you have to temporarily lift the freeze, which takes a few hours. A fraud alert is a good middle ground if you want protection without the hassle. If you believe your Social Security number was stolen — not just your bank account hacked — a freeze is worth the inconvenience.

You can also place a freeze on your child's credit file if you have minor children. This prevents someone from opening accounts in their name. The process is the same: contact each bureau and request a freeze.

Frequently Asked Questions

How long does it take to get my money back?

Your bank must investigate within 10 business days and either refund you or explain why they will not. In practice, most banks take two to four weeks. Wire transfers and transfers to other banks are harder to recover and may take longer or not be recoverable at all if more than 24 hours have passed.

What if the hacker opened new credit accounts in my name?

Dispute each account directly with the creditor and with the credit bureau that is reporting it. Send written disputes to both, keeping copies. You can also file an identity theft report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record you can use when disputing fraudulent accounts.

Can the hacker be prosecuted?

Yes, unauthorized access to a bank account is a federal crime. However, prosecution depends on whether law enforcement can identify and locate the hacker. If the hacker is in another country, prosecution is unlikely. Report the fraud to your bank and the FBI's Internet Crime Complaint Center (IC3) at IC3.gov, but do not expect criminal charges in most cases.

Should I close my hacked account?

Not when ready. Keep the account open while you and your bank investigate, because closing it can complicate the dispute process. Once all disputes are resolved and you have recovered the money, you can close it. Ask your bank to issue you a new debit card and account number if you want to keep banking with them.

What if my bank refuses to refund the fraudulent charges?

Ask your bank to explain their decision in writing. If you disagree, file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov or with your state's banking regulator. You can also consult a consumer law attorney, though most banks will refund legitimate fraud claims if you follow the reporting process correctly.