What happens when someone hacks your bank account

When a hacker gains access to your bank account, they can move money out, change your password, lock you out, and drain your balance before you notice. The speed depends on the method they used: if they have your login credentials, they can transfer funds immediately; if they're using your debit card number alone, the bank's fraud detection may catch it within hours. The damage is real, but your recovery path depends on how the theft happened and how quickly you report it.

Most account takeovers happen through one of three routes: phishing emails or texts that trick you into entering your password, malware on your computer or phone that captures your keystrokes, or credential stuffing—where hackers use passwords leaked from other websites to try your email address across multiple banks. A smaller number result from someone physically stealing your debit card or a data breach at the bank itself.

Key Takeaways

  • Call your bank's fraud line immediately if you notice unauthorized transactions; most banks reverse fraudulent charges within one to three business days if you report within 60 days.
  • Change your password from a different device (not the one you think was compromised) and enable two-factor authentication on your bank account and email.
  • File a report with the Federal Trade Commission at IdentityTheft.gov if the hacker accessed personal information beyond just your account balance.
  • Check your credit report at AnnualCreditReport.com for new accounts opened in your name; if you find them, place a fraud alert with the three credit bureaus.
  • Document everything—screenshots of unauthorized transactions, the date and time you discovered the breach, and the name of the bank employee you spoke to—because you may need it to dispute charges later.

Immediate steps if your account is compromised

Stop using the device you think was compromised. If you suspect malware, do not log into your bank account from that computer or phone again until you've had it checked. Instead, use a different device—a friend's computer, a library computer, or a phone you know is clean.

Call your bank's fraud department directly. Do not use the phone number in an email or text claiming to be from your bank; instead, use the number on the back of your debit card or the number from your bank's official website. Tell them which transactions are not yours and ask them to freeze your account temporarily while they investigate. Most banks will reverse fraudulent charges within one to three business days if you report within 60 days of the transaction.

Change your password immediately, but only from a device you trust. Make it long (at least 16 characters), use a mix of uppercase, lowercase, numbers, and symbols, and do not reuse it anywhere else. If you use the same password on other accounts, change those too.

Protecting your email and credit after a breach

Your email is the master key to your bank account. If the hacker has access to your email, they can reset your bank password, intercept password recovery codes, and lock you out. Change your email password immediately using the same rules as your bank password. Then enable two-factor authentication on your email account—this means you'll need to enter a code from your phone or an authenticator app every time you log in, even if someone has your password.

Check your credit report at AnnualCreditReport.com, which is free and does not require a credit card. Look for accounts you did not open, hard inquiries you did not authorize, or changes to your address. If you find fraud, place a fraud alert with Equifax, Experian, and TransUnion by contacting one of them; they will notify the other two. A fraud alert lasts one year and tells creditors to verify your identity before opening new accounts in your name.

If the hacker opened accounts or made charges in your name, consider a credit freeze. This prevents anyone—including you—from opening new accounts in your name without unfreezing it first. You can freeze your credit for free at each of the three bureaus' websites.

Filing a report and documenting the theft

Report the theft to the Federal Trade Commission at IdentityTheft.gov. This creates an official record and generates a recovery plan tailored to what happened. You do not need to file a police report first, though you can if you want one for your records.

Keep a written log of everything: the date and time you discovered the unauthorized transactions, the exact amounts, the dates they posted, the name and employee ID of every bank representative you spoke to, what they told you, and what actions they took. Take screenshots of your account showing the fraudulent charges. Save copies of any letters or emails from your bank about the dispute. If the bank later claims you authorized a charge, this documentation is your proof that you did not.

If your bank does not reverse the charges within the timeframe they promised, file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov. Include your documentation and explain what the bank did or did not do.

How long recovery takes and what you'll pay

If you report fraud within 60 days of the transaction posting, federal law (Regulation E) requires your bank to reverse the charge and return your money. The timeline varies: some banks credit your account within one business day, others take up to three. During the investigation period, the bank may temporarily credit your account while they verify the fraud, then make it permanent once confirmed.

You should not pay anything out of pocket for fraudulent charges on your debit card or in your bank account. If your bank asks you to pay a fee to dispute the charge or to reopen your account, that is not standard practice—push back or file a complaint with the CFPB.

If the hacker also stole your identity and opened credit card accounts or took out loans in your name, recovery is longer. You will need to dispute each account with the creditor and the credit bureaus, which can take weeks or months. Some people hire a credit repair company to handle this, though you can do it yourself for free.

Preventing future hacks

Use a password manager like Bitwarden, 1Password, or KeePass to generate and store unique passwords for every account. This way, if one password leaks, hackers cannot use it to access your other accounts. Enable two-factor authentication on every account that offers it—your email, bank, social media, and any account that holds money or personal information.

Do not click links in emails or texts claiming to be from your bank. Instead, go directly to the bank's website by typing the address into your browser or calling the number on your card. Be suspicious of emails asking you to "verify your account" or "confirm your identity"—banks do not ask for this via email.

Keep your devices updated. Turn on automatic updates for your operating system, browser, and antivirus software. These patches close security holes that hackers use to install malware. If you use public Wi-Fi, use a VPN (virtual private network) to encrypt your connection, or avoid logging into sensitive accounts on public networks altogether.

What to do if your bank will not help

If your bank denies your dispute or does not reverse the charge within 60 days, you have options. File a complaint with the CFPB at ConsumerFinance.gov or by calling 1-855-411-2372. Include your documentation and explain why you believe the charge was fraudulent. The CFPB investigates and can order the bank to refund you.

You can also file a complaint with your state's banking regulator. Each state has a department of financial regulation or similar agency that oversees banks. A quick search for "[your state] banking complaint" will find the right office.

If the amount is small enough, small claims court is an option, though it requires more time and effort. You would sue the bank for the fraudulent charge plus court costs. Bring your documentation and be prepared to explain why the charge was not yours.

Frequently Asked Questions

Can the bank hold me responsible for fraudulent charges?

No, not if you report within 60 days. Federal law (Regulation E) makes the bank responsible for fraudulent debit card and ACH transactions. If you report after 60 days, your liability increases, but you can still dispute it—the bank just has more leeway to deny it. Report as soon as you notice.

What if the hacker transferred money to another bank account?

Call your bank immediately and ask them to file a wire fraud report with the receiving bank. If the money was transferred via ACH, it can sometimes be recalled within one business day. If it was a wire transfer, recovery is harder but still possible if you act fast. The receiving bank may freeze the account pending investigation.

Do I need to close my account and open a new one?

Not necessarily. If your bank reversed the charges and you changed your password and enabled two-factor authentication, your account is secure. Closing it creates new hassles—updating direct deposits, automatic payments, and so on. Keep it open unless the bank recommends closing it or you feel unsafe using that bank.

Will this affect my credit score?

Not if the fraud was limited to your bank account. Your credit score is based on credit accounts (credit cards, loans, mortgages), not bank accounts. If the hacker opened credit accounts in your name, those will hurt your score until you dispute and close them. Monitor your credit report to catch this early.

What if I think someone is currently using my account?

Call your bank immediately and ask them to lock your account. Do not wait. Most banks can freeze your account within minutes, stopping any further transactions. Then follow the steps above: change your password from a different device, enable two-factor authentication, and file a fraud report.