The most common threats to your checking account

Your checking account can be compromised in three main ways: someone uses your debit card or card number without permission, someone gains access to your online banking login, or someone steals checks from your mailbox or trash and forges your signature. Each route leaves different traces and requires different responses, but all of them can drain your account in hours.

Debit card fraud happens fastest. A thief with your card number can make online purchases or withdraw cash at an ATM before you notice the card is missing. Online banking theft is slower but more damaging—once someone has your username and password, they can transfer money out of your account and change your contact information so you don't see the alerts. Check fraud is the slowest but still dangerous, especially if the thief writes large checks against your account before you catch on.

The good news is that federal law limits your liability for unauthorized transactions, but only if you report them within specific timeframes. The faster you catch a problem, the less of your own money you lose while the bank investigates.

Key Takeaways

  • Federal law caps your liability at $50 for unauthorized debit card charges if you report them within two business days, and $500 if you report within 60 days.
  • Monitor your account at least weekly by logging into your bank's website or app, or by setting up text or email alerts for every transaction.
  • Use a strong password with at least 12 characters mixing uppercase, lowercase, numbers, and symbols, and never reuse the same password across multiple accounts.
  • Shred paper statements and checks, collect mail promptly, and consider a locked mailbox or a P.O. box if your neighborhood has mail theft problems.
  • Report suspected fraud to your bank immediately by phone—do not wait for a statement or email confirmation.

How to monitor your account so you catch fraud early

The single most effective protection is checking your account regularly. Most people who catch fraud within days lose little or nothing; those who discover it weeks later often lose hundreds. You do not need to check daily, but weekly is the standard that protects you under federal law.

Log into your bank's website or mobile app and review the transaction list. Look for charges you do not recognize, withdrawals from ATMs you did not visit, or transfers to accounts you did not set up. Many banks now show the merchant name and location, which makes it easier to spot a fraudulent charge immediately.

If you prefer not to log in manually, set up alerts. Most banks offer free text or email notifications when a transaction exceeds a certain amount, when a withdrawal happens at an ATM, or when a transfer is initiated. Some banks let you set alerts as low as $1, which means you will see every single transaction in real time. This is the fastest way to catch fraud, because you can call the bank within minutes instead of days.

Protecting your debit card and card number

Keep your physical card in a secure place and check your wallet regularly to make sure it is still there. If your card goes missing, call your bank immediately—do not wait to see if it shows up. Your bank can freeze the card within minutes, and a new one will arrive in five to ten business days.

For online shopping, use your card only on websites with a secure connection. Look for "https://" at the start of the web address and a padlock icon in the browser bar. Never type your card number into an email, text message, or pop-up window, even if it claims to be from your bank. Your bank will never ask for your full card number by email or text.

Consider using a virtual card number if your bank offers one. This is a temporary card number tied to your real account that you can use for online purchases. If the virtual number is compromised, the thief cannot use it again, and your real card number stays safe. Some banks generate a new virtual number for each purchase automatically.

When you receive a new card in the mail, activate it immediately and destroy the old one by cutting it in half. Do not throw an active card in the trash whole—a thief can fish it out and use it before you notice.

Creating and protecting your online banking password

Your password is the key to your account. A weak password—something like your birth year, a pet's name, or a simple word—can be guessed or cracked in seconds. A strong password is at least 12 characters long and includes uppercase letters, lowercase letters, numbers, and symbols.

An example of a strong password is "BlueMoon#2024!Waves". An example of a weak password is "password123". Do not use personal information like your address, phone number, or family member names, because these are easy to find online or guess.

Never reuse the same password across multiple accounts. If one website is hacked and your password is stolen, a thief can use that same password to try to log into your bank, email, and other accounts. Use a different password for each financial account you have.

If you cannot remember multiple strong passwords, use a password manager. This is software that stores your passwords in an encrypted vault and fills them in automatically when you log in. Popular password managers include Bitwarden, 1Password, and Dashlane. You only have to remember one strong master password to unlock the vault.

Protecting your checks and mail

Checks are still a common target for fraud because they contain your account number, routing number, and signature. A thief who steals a check can forge your signature and cash it, or alter the amount and payee name.

Collect your mail promptly, especially if you receive checks or bank statements. Do not leave mail in your mailbox overnight or over a weekend. If you are away from home for more than a few days, ask the post office to hold your mail or have a trusted neighbor collect it.

If your neighborhood has a problem with mail theft, consider a locked mailbox or a P.O. box. A locked mailbox costs $20 to $50 and mounts on your front door or side of your house. A P.O. box costs $100 to $200 per year and gives you a secure location to receive mail. Both options make it much harder for a thief to steal your checks or statements.

When you receive statements or old checks, shred them before throwing them away. A standard paper shredder costs $20 to $40 and takes a few seconds per document. Do not just tear checks by hand—a determined thief can tape them back together.

What to do if you spot unauthorized activity

Call your bank immediately if you see a charge you did not make, a withdrawal from an ATM you did not visit, or a transfer to an unknown account. Do not email or use the bank's website chat—call the phone number on the back of your debit card or on your bank statement. This creates a record of the time you reported the fraud.

Tell the bank representative exactly what transaction is unauthorized and when you first noticed it. The bank will ask you to confirm your identity by answering security questions or providing your Social Security number. Then the bank will freeze your account or cancel your card to stop further fraud.

The bank will open an investigation, which usually takes 10 business days. During this time, the bank will contact the merchant or the other bank involved and ask for evidence of the transaction. If the bank determines the charge was unauthorized, it will refund your money. If the bank determines you authorized it, you are responsible for the charge.

Federal law protects you during this process. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you report it between three and 60 days, your liability is capped at $500. If you wait more than 60 days, you could lose the entire amount, depending on your bank's policy.

Setting up additional security features your bank may offer

Many banks now offer two-factor authentication, which requires a second step to log in. After you enter your password, the bank sends a code to your phone via text or email, or generates a code in an app. You have to enter this code before you can access your account. This means a thief who steals your password still cannot log in without your phone.

Some banks offer biometric login, which means you can log in with your fingerprint or face instead of typing a password. This is faster and more secure, because your fingerprint or face cannot be stolen the way a password can.

Ask your bank whether it offers these features and turn them on. They take a few minutes to set up and add a significant layer of protection to your account.

Frequently Asked Questions

What should I do if my debit card is lost or stolen?

Call your bank immediately using the number on the back of your card or on your statement. The bank can freeze the card within minutes, stopping any further charges. A new card will arrive in five to ten business days. If fraudulent charges appear before you report it, your liability is capped at $50 if you report within two business days.

Can my bank refund money if someone forged my signature on a check?

Yes, but you have to report it quickly. Call your bank as soon as you discover the forged check and provide the check number and amount. The bank will investigate and typically refund your money within 10 business days. After that, the liability shifts depending on how long you waited to report it.

Is it safe to use my debit card for online shopping?

Yes, if you use secure websites and monitor your account regularly. Look for "https://" and a padlock icon before entering your card number. Many banks also offer virtual card numbers for online purchases, which adds extra protection because the temporary number cannot be reused if it is compromised.

What is the difference between a password manager and writing my passwords down?

A password manager encrypts your passwords and stores them in a secure vault that only you can unlock with your master password. Writing passwords down on paper or in a document leaves them visible to anyone who finds the paper or accesses your computer. A password manager is much more secure.

How often should I check my account for fraud?

At least once a week. Weekly monitoring is the standard that protects you under federal law and gives you the best chance of catching fraud within the two-business-day window that caps your liability at $50. If you set up transaction alerts, you can catch fraud even faster.