The core steps to keep your account safe

Protecting your checking account means controlling who can access it, watching for unauthorized transactions, and knowing what to do the moment something looks wrong. The main threats are online fraud (someone using your login), card theft (someone using your debit card number), and account takeover (someone changing your password and locking you out). Each requires a different defense, and the fastest recovery happens when you catch the problem early.

Start with a password only you know—not your birthday, not a word from your name, not something you have posted online. Use a mix of uppercase letters, lowercase letters, numbers, and symbols. If you use the same password across multiple websites, change that now; a breach at one site gives a thief access to all of them. A password manager (like Bitwarden, 1Password, or KeePass) stores strong passwords so you do not have to remember them.

Turn on two-factor authentication if your bank offers it. This means that even if someone has your password, they cannot log in without a second piece of information—usually a code sent to your phone or generated by an app. Your bank may call this "two-step verification" or "multifactor authentication." Ask your bank how to turn it on; it takes five minutes and blocks most account takeovers.

Key Takeaways

  • Use a unique, strong password for your checking account and turn on two-factor authentication so a stolen password alone cannot unlock your account.
  • Check your account and statements weekly for transactions you do not recognize, because federal law gives you only 60 days to report fraud.
  • If your debit card is lost or stolen, call your bank immediately—not email, not the next business day—because liability shifts after two business days.
  • Avoid public Wi-Fi for banking; use your phone's cellular data or a home network instead, because public networks let thieves intercept your login information.
  • If someone gains access to your account, contact your bank first, then place a fraud alert with the three credit bureaus and consider a credit freeze.

Watching for fraud on your statements

Check your account online at least once a week, not once a month. Most banks let you log in anytime and see transactions within hours of posting. Look for charges you do not remember making, transfers to accounts you do not recognize, or small test charges (thieves often make a tiny purchase first to see if the card works). If you see something wrong, take a screenshot or write down the date, amount, and merchant name.

When your bank sends a statement—whether by mail or email—read it carefully. Do not assume that because you did not report something immediately, you cannot dispute it. Federal law (Regulation E) gives you 60 days from the date the statement was sent to report unauthorized transactions. After 60 days, your bank may not refund you. If you spot fraud on day 59, report it that day.

Set up account alerts if your bank offers them. You can ask the bank to text or email you when a transaction over a certain amount posts, when a transfer is made, or when someone tries to log in from a new device. These alerts cost nothing and give you hours or days to stop a thief before they drain your account.

What to do if your debit card is lost or stolen

Call your bank immediately—the same day you notice the card is gone. Do not wait until morning or the next business day. Your bank can freeze the card within minutes, blocking any new charges. If you call within two business days of noticing the loss, your liability for fraudulent charges is capped at $50 under federal law. If you wait longer, you may be liable for up to $500 or more, depending on your bank's policy.

Your bank will cancel the old card and mail a new one, which usually arrives within 5 to 10 business days. Ask if they can expedite it or if you can pick one up at a branch. In the meantime, ask for a temporary card number you can use online, or request that they waive fees if you need cash from an ATM.

After you report the card stolen, monitor your account closely for the next 30 days. Thieves sometimes make small charges weeks after stealing a card, hoping you will not notice. If you see unauthorized charges, report them to your bank in writing (email or through your online account) so there is a record of when you reported it.

Protecting yourself online and on public networks

Never bank on public Wi-Fi—not at a coffee shop, airport, library, or hotel. Public networks are easy for thieves to monitor, and they can intercept your login information or redirect you to a fake bank website. Use your phone's cellular data instead, or wait until you are home on your own network. If you must use public Wi-Fi, use a VPN (virtual private network) like ProtonVPN or Mullvad, which encrypts your traffic so others cannot see it.

Do not click links in emails or texts claiming to be from your bank. Thieves send fake emails that look identical to real bank messages, asking you to "verify your account" or "confirm your password." Your bank will never ask you to click a link and log in. If you get a suspicious message, go directly to your bank's website by typing the address into your browser, or call the number on the back of your card.

Keep your computer and phone updated. Banks and payment apps release security patches regularly to fix vulnerabilities that thieves exploit. Turn on automatic updates so you do not have to remember to do it manually. If you use a shared computer, log out completely when you are done and clear your browser history.

Recovering from account takeover

If someone changes your password and locks you out of your account, call your bank immediately. Do this from a phone, not email or chat. Explain that your account has been compromised and you cannot log in. Your bank can reset your password over the phone and lock the account while they investigate. Ask them to review recent transactions and transfers to see what the thief did.

After you regain access, change your password to something completely new—not a variation of the old one. Turn on two-factor authentication if you have not already. Check that your phone number and email address on file are still yours; thieves sometimes change these to lock you out permanently.

Contact the three credit bureaus (Equifax, Experian, and TransUnion) and place a fraud alert on your credit file. This tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert by calling one bureau; they will notify the other two. A fraud alert lasts one year and is free. If the theft is serious, consider a credit freeze, which blocks lenders from accessing your credit report entirely until you unfreeze it.

What your bank is responsible for

Your bank is liable for most unauthorized transactions on your debit card or checking account, but only if you report them within the time limits. For debit card fraud, you have two business days to report the loss of the card itself; after that, your liability increases. For unauthorized transactions on your account (even if your card was not physically stolen), you have 60 days from the date your statement was sent.

Your bank must investigate your claim and refund you within 10 business days if the transaction was clearly unauthorized. If they need more time, they can take up to 45 days, but they must give you provisional credit (a temporary refund) within 10 days so you can access your money while they investigate.

Keep records of everything: screenshots of unauthorized transactions, the date and time you called your bank, the name of the person you spoke to, and any confirmation numbers they gave you. If your bank refuses to refund you, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator.

Frequently Asked Questions

Can my bank hold me responsible for fraud if I did not notice it for months?

It depends on the type of fraud. For debit card theft, you are liable for up to $500 if you wait more than two business days to report it. For unauthorized transactions on your account, you have 60 days from the statement date. After that, your bank may not refund you, though some banks refund fraud as a courtesy even after the deadline.

What if I gave my password to someone I trusted and they stole money?

If you voluntarily shared your password, your bank may not refund you, because you authorized access to the account. However, if the person took more money than you authorized, you can dispute the excess. Report it to your bank in writing with details of what you authorized and what was taken.

Is it safe to use my debit card online?

Debit cards are less protected than credit cards online. If fraud occurs, money leaves your account immediately, and you have to wait for the bank to refund you. Credit cards offer stronger fraud protection. If you must use your debit card online, use it only on secure websites (look for "https" in the address) and monitor your account closely.

What should I do if my bank says I am liable for fraud I did not commit?

Ask the bank to explain in writing why they believe you are liable. If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. You can also contact your state's banking regulator or attorney general's office. Keep all documentation of your dispute.

Do I need to freeze my credit if my checking account was hacked?

A fraud alert is usually enough if only your checking account was compromised. A credit freeze is stronger but more inconvenient; it blocks all new credit applications until you unfreeze it. Use a freeze if the thief also opened new accounts in your name or if you have serious identity theft concerns.