Lock down your account immediately if someone has access
If someone has your login credentials, debit card, or account number, contact your bank right now—not by email, but by calling the number on the back of your card or a number you find directly on your bank's official website. Tell them which account is compromised and ask them to freeze it temporarily while you change your password and review recent transactions. Most banks can lock an account within minutes.
If money has already left your account without your permission, report it as fraud or an unauthorized transaction. Your bank has a legal obligation to investigate and may reverse the charges, though the timeline depends on the type of transaction and your bank's fraud department. Do not wait—the sooner you report it, the stronger your case.
If someone else is a registered user or authorized signer on your account (a spouse, adult child, or business partner), removing them is different from stopping fraud. That requires going to your bank in person or calling to request removal, and the person may need to sign off depending on how the account was set up.
Key Takeaways
- Call your bank immediately using the number on your card to freeze the account and change your password before more money is taken.
- Report unauthorized transactions as fraud; your bank must investigate and may reverse charges within a set timeframe.
- If someone is an authorized user or signer, you must formally request their removal through your bank, which may require their signature.
- Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) if you suspect identity theft, not just account compromise.
- Change your password to something unique and enable two-factor authentication so the person cannot log in even if they know your old password.
Stopping someone who has your login information
Change your password immediately after you contact your bank. Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols—something the person cannot guess. Do not reuse a password you have used anywhere else.
Enable two-factor authentication (also called 2FA) if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks now offer this as an option in account settings. Turn it on the same day you change your password.
Check your account settings for linked devices or active sessions. Some banks show you which phones, computers, or tablets are currently logged in. If you see a device you do not recognize, log it out remotely. Then log out of all other sessions and log back in only on devices you trust.
Removing an authorized user or joint account holder
If the person has legal access—meaning they are listed as a joint owner, authorized user, or signer—you cannot simply lock them out. You must formally remove them through your bank. Call the number on your card or visit a branch in person and ask to remove the person's access.
Some banks require the other person's signature to remove them, especially if they are a joint owner. If they refuse to sign or you cannot reach them, ask your bank what options exist. In some cases, you may need to close the account and open a new one, which is slower but guarantees a fresh start.
If the person is an authorized user but not a joint owner, removal is usually simpler and may not require their consent. Confirm with your bank whether the person was added as a user or as a co-owner before you call.
What to do if money has already been taken
Report the unauthorized transaction to your bank in writing as well as by phone. Your bank will ask you to sign a form (often called a Regulation E dispute form or fraud claim) stating that you did not authorize the transaction. Keep a copy for your records.
Your bank has up to 10 business days to investigate and must tell you the outcome. If they find the transaction was unauthorized, they must reverse it. If they find it was authorized or cannot determine what happened, they may deny your claim, though you have the right to dispute their decision.
If the unauthorized access involved a debit card, your liability is limited: you owe nothing if you report it before any money is withdrawn, up to $50 if you report it within two business days, and up to $500 if you report it after two business days but within 60 days. After 60 days, you may owe the full amount. Report quickly.
Protecting yourself from future unauthorized access
Do not share your password, PIN, or one-time codes with anyone—not even family members or bank employees. Your bank will never ask for your password. If someone calls claiming to be from your bank and asks for it, hang up and call your bank directly using the number on your card.
Use a password manager (such as Bitwarden, 1Password, or Dashlane) to store your banking password securely. This way you can use a long, random password without having to remember it, and you can change it easily without writing it down.
Check your account regularly—at least weekly if possible—for transactions you do not recognize. Set up account alerts through your bank's app or website so you get notified of large withdrawals, transfers, or login attempts from new devices. The faster you spot fraud, the faster you can stop it.
When to file a police report or fraud alert
If you suspect identity theft (someone opened accounts in your name, not just accessed your existing account), place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. You can do this online at any of their websites or by calling. A fraud alert tells lenders to verify your identity before opening new accounts in your name.
If the person who accessed your account is someone you know and you believe they committed a crime, you can file a police report. Bring documentation of the unauthorized transactions and any evidence of who did it. The police report creates an official record, which can help if you need to pursue legal action or if the person tries to access your account again.
If the unauthorized access involved a large amount of money or happened repeatedly, contact the Federal Trade Commission (FTC) at IdentityTheft.gov. The FTC does not investigate individual cases, but your report becomes part of a national database that helps law enforcement identify patterns.
Frequently Asked Questions
Can my bank reverse a transaction if I gave someone my password but did not authorize the specific withdrawal?
Yes, if you can show that you did not authorize that particular transaction, it counts as unauthorized even if you voluntarily shared your password. Report it as fraud. However, if you gave someone permission to access your account and they took more than you agreed to, the bank may view it differently—document what you authorized and what you did not.
What if the person who accessed my account is my spouse or ex-partner?
If they are a joint owner or authorized user, removing them requires their signature in most cases. If you are in danger, contact a domestic violence hotline or local law enforcement first. If they are not authorized but have your password, report it as fraud. If you are going through a divorce, your attorney can advise you on account separation and asset protection.
How long does it take to remove someone from my account?
If they are an authorized user with no ownership stake, removal can happen the same day you call. If they are a joint owner, it may take several days to a few weeks, especially if their signature is required. Closing the account and opening a new one typically takes one to five business days.
Will my bank tell me who accessed my account?
Your bank can show you the login history and IP addresses associated with unauthorized access, which may help identify the person. If you suspect a specific person, provide their name and any details you have. If you file a police report, law enforcement can subpoena more detailed information from the bank.
What if I cannot reach my bank by phone?
Visit a branch in person with your ID. Bring any documentation of unauthorized transactions. If your bank does not have a local branch, look for a partner bank or ATM network where you can speak to someone. Many banks also offer online chat or secure messaging through their app—use that if phone lines are busy, but follow up with a call to confirm the action was taken.