You cannot and should not try to hack into a bank account, including your own

If you are locked out of your own account, contact your bank directly by phone using the number on your card or statement. Do not use a phone number from a search result. Your bank can verify your identity, reset your password, unlock a frozen account, or walk you through recovery steps in minutes.

If someone else has hacked your account, the recovery process is different and involves your bank's fraud department, not you trying to regain access on your own. Attempting to hack—even into an account you own—can trigger criminal charges under the Computer Fraud and Abuse Act, regardless of your intent.

This guide explains what actually happens when an account is compromised, what your bank will do, and the concrete steps to take if you suspect fraud.

Key Takeaways

  • If you are locked out of your own account, call your bank's customer service line directly; they can restore access without you needing to bypass security.
  • If your account has been hacked, report it to your bank immediately and then to the Federal Trade Commission at IdentityTheft.gov to create an official record.
  • Your bank is required by law to reverse fraudulent charges within specific timeframes, usually 10 business days for debit card fraud.
  • Changing your password, enabling two-factor authentication, and monitoring your statements weekly are the most effective ways to prevent future compromise.
  • If you suspect identity theft beyond the bank account, place a fraud alert or credit freeze with the three major credit bureaus: Equifax, Experian, and TransUnion.

How bank account hacking actually works

Most account compromises happen through one of three routes: phishing emails or texts that trick you into entering your login credentials on a fake website, malware on your computer or phone that captures keystrokes or screenshots, or credential stuffing, where attackers use passwords leaked from other breaches to try your email address across multiple banks.

Once someone has access, they typically move money out within hours—either transferring it to another account they control, using your debit card to make purchases, or setting up bill pay to send funds elsewhere. The longer you wait to report it, the harder it becomes to recover the money, because the attacker has more time to move it across multiple accounts or convert it to untraceable forms.

Banks have fraud detection systems that flag unusual activity, but these systems are not perfect. A large transfer to a new recipient, a purchase in a different state, or a sudden spike in spending can trigger a hold or a call to you—but only if the bank's algorithm catches it. Smaller, slower drains often go unnoticed until you check your statement.

What to do immediately if your account is hacked

Call your bank's fraud line right away. The number is on your card or your most recent statement. Do not use a number from a Google search, because scammers sometimes buy ads that rank above the real bank's contact page. When you call, tell them you suspect unauthorized access and ask them to freeze your account immediately.

Your bank will review recent transactions with you and reverse any that you did not make. For debit card fraud, federal law (Regulation E) requires your bank to refund you within 10 business days if you report it within 60 days of the statement date. If you wait longer, your protection shrinks or disappears entirely. For credit card fraud, the protection is even stronger—you are typically liable for no more than $50, and most issuers waive that.

After you hang up with the bank, go to IdentityTheft.gov and file a report with the Federal Trade Commission. This creates an official record that you can show to creditors, and it gives you access to a recovery plan tailored to your situation. The FTC does not investigate individual cases, but the report itself is a legal document that helps you dispute fraudulent accounts opened in your name.

Protecting yourself from future compromise

Change your password to something long and random—at least 16 characters, mixing uppercase, lowercase, numbers, and symbols. Do not reuse passwords across different banks or email accounts. If you use the same password on your email and your bank, and a hacker gets one, they have both.

Enable two-factor authentication on your bank account and your email. Two-factor means the bank sends you a code via text or an authenticator app (like Google Authenticator or Authy) that you have to enter after you type your password. Even if someone has your password, they cannot log in without that second code. Text-based codes are better than nothing, but an authenticator app is stronger because text messages can be intercepted.

Check your bank statement weekly, not monthly. The sooner you spot fraud, the sooner you can report it and the more money you can recover. Set up account alerts through your bank's app—most banks let you get a text or email whenever a transaction over a certain amount goes through, or whenever your balance drops below a threshold.

Do not click links in emails or texts that claim to be from your bank. Instead, open your browser, type the bank's web address directly, and log in from there. Phishing emails look convincing—they use the bank's logo, official language, and urgent language like "verify your account" or "confirm your identity"—but they are designed to steal your credentials.

If you are locked out of your own account

Forgotten passwords, locked accounts after too many wrong attempts, and accounts frozen for security reasons are all handled by your bank's customer service team. Call the number on your card or statement and have your ID ready. They will ask you security questions (your mother's maiden name, the last four digits of your Social Security number, or recent transactions) to confirm you are the account holder.

If you cannot remember the answers to security questions, tell the bank. They have other ways to verify you: a recent deposit, a photo ID, or a video call where you show your ID. The process usually takes 10 to 20 minutes on the phone. Some banks also let you reset your password through your email address if you still have access to it.

Do not try to bypass the bank's security yourself. Attempting to access an account through unauthorized means—even your own account—can trigger a fraud investigation, a temporary account freeze, or in extreme cases, criminal charges. The bank's security team exists to help you; use them.

What to do if money was transferred to another bank

If the hacker moved your money to a different bank, your bank can file a wire recall or a reversal request with the receiving bank. This works best if you report it within 24 hours. After that, the receiving bank has less obligation to freeze or return the funds.

Your bank will give you a case number and a timeline for the recall. This is not instant—it can take 5 to 10 business days. If the receiving bank finds the money still in the account, they will return it. If the hacker has already withdrawn it or moved it again, recovery becomes much harder and may require law enforcement involvement.

File a report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. These reports do not usually result in immediate action, but they create an official record and help law enforcement track patterns of fraud. If the amount is large enough, the FBI may investigate.

Checking for identity theft beyond your bank account

If your bank account was hacked, there is a chance your email, Social Security number, or other personal information was also compromised. Check your credit report for accounts you did not open. You can get a free report from each of the three major credit bureaus—Equifax, Experian, and TransUnion—once per year at AnnualCreditReport.com.

If you see fraudulent accounts on your credit report, place a fraud alert with all three bureaus. A fraud alert tells creditors to call you before opening new accounts in your name. It lasts one year and is free. If you suspect serious identity theft, you can also place a credit freeze, which blocks creditors from accessing your credit report entirely unless you temporarily lift it. A freeze is stronger but slightly more inconvenient because you have to unfreeze it when you want to apply for credit yourself.

Monitor your email for password reset requests from accounts you do not recognize. Hackers often try to take over your email first, because email is the master key to everything else—your bank, your social media, your cloud storage. If you see suspicious activity, change your email password immediately and enable two-factor authentication there as well.

Frequently Asked Questions

How long does it take to get my money back after reporting fraud?

For debit card fraud, your bank must refund you within 10 business days if you report it within 60 days of the statement date. For credit cards, the timeline is similar, though the process is slightly different because you are disputing a charge rather than reporting unauthorized access. Wire transfers and ACH transfers can take longer—5 to 10 business days—because the bank has to contact the receiving institution.

Can the bank refuse to refund me if I was careless with my password?

No. Federal law requires banks to refund unauthorized transactions regardless of whether you were careless. However, if the bank can prove you gave your password to someone else or you authorized the transaction yourself, they can refuse. The burden of proof is on the bank, not on you.

What if the hacker opened new accounts in my name?

File a report at IdentityTheft.gov immediately. The FTC will give you a recovery plan. Contact each creditor directly and tell them the account is fraudulent. You will also need to dispute the accounts on your credit report by sending a letter to each bureau. Keep copies of everything—the FTC report, your police report, and your correspondence with creditors—because you may need to prove the fraud was not your fault.

Is my bank liable if they did not catch the fraud?

Your bank is liable to refund you under federal law, regardless of whether they caught the fraud or you did. However, if you wait more than 60 days to report debit card fraud, your protection shrinks. Report it as soon as you notice it.

Should I close my account after it is hacked?

Not necessarily. Closing the account does not erase the fraud from your record, and it can actually make recovery harder because the bank needs the account to remain open to process refunds. Keep the account open until the fraud is fully resolved, then decide whether to close it based on your comfort level with that bank.