Your bank is liable for most unauthorized transactions, but you have to report them fast
If someone hacks your bank account and moves money without your permission, your bank must return the funds in most cases — but only if you report the fraud within a specific window. The speed of your report determines how much protection you get. Report within two business days and you lose a maximum of $50. Wait longer and your liability can climb to $500 or more, depending on how long you waited and whether the thief drained your account completely.
The law that protects you is the Electronic Funds Transfer Act (EFTA), which applies to all U.S. banks. It requires banks to investigate unauthorized transfers and restore your money while they investigate. The investigation itself takes up to 10 business days for most cases, though complex ones can stretch to 45 days. During that time, the bank may freeze your account or limit your access while they verify what happened.
What matters most right now: call your bank's fraud line immediately, not the main customer service number. Most banks have a dedicated fraud department that answers 24/7. Tell them which transactions were not yours, when you first noticed the fraud, and whether you shared your password, PIN, or card details with anyone. Write down the name of the person you spoke to, the time, and what they told you to do next.
Key Takeaways
- Report unauthorized transactions to your bank within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more.
- Your bank must return fraudulent funds while investigating, though the investigation can take 10 to 45 business days depending on complexity.
- Call your bank's fraud line directly (not general customer service) and document the name, time, and details of your report.
- Change your password, PIN, and security questions immediately after reporting, and monitor your account for new unauthorized activity.
- If your bank refuses to refund you, file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator.
How the bank's investigation works and what you need to provide
Once you report the fraud, the bank assigns an investigator who will pull your transaction history, check IP addresses and device information, and contact merchants if money left your account through transfers or purchases. They will ask you to sign an affidavit swearing that you did not authorize the transactions. This is a legal document, and lying on it is a federal crime — but telling the truth about what you did and did not do is your protection.
The bank will also ask whether you noticed any suspicious activity before the fraud occurred: unexpected password reset emails, login attempts from unfamiliar locations, or alerts you ignored. Be honest. If you ignored a security alert or failed to update your password in years, the bank may argue you were negligent, which can reduce your protection. However, negligence is a high bar — the bank has to prove you were reckless, not just careless.
Provide the bank with any evidence you have: screenshots of transactions you did not make, emails from the hacker if they contacted you, or records of when you last logged in from your own device. If you use online banking, the bank can see your login history and IP addresses. If the hacker logged in from a different state or country, that strengthens your case.
What happens to your account while the investigation is underway
Your bank may freeze your account or place a hold on funds while they investigate. This means you cannot withdraw money or make new transfers, even from your own legitimate balance. The freeze can last the entire investigation period — up to 45 days in complex cases. If you need access to your money during this time, ask the bank whether they will release a portion of the verified legitimate balance so you can pay bills or buy essentials.
Some banks will issue a temporary debit card or credit you a portion of the disputed amount while the investigation continues. This is not required by law, but many banks do it to keep customers from suffering hardship. Ask specifically: "Can you credit me a portion of my balance while you investigate?" The answer depends on the bank's policy and the strength of your fraud claim.
If the hacker transferred money out of your account to another bank, that receiving bank is also involved in the investigation. The sending bank (yours) will contact the receiving bank and ask them to freeze the funds on their end. This process is slower than a local hold and can take several additional days. If the receiving bank is uncooperative or the money has already been withdrawn in cash, recovery becomes much harder.
How the hacker got in: common entry points and how to prevent the next one
Most account hacks happen through one of four routes: phishing emails that trick you into entering your password on a fake website, malware on your computer or phone that records your keystrokes, reused passwords from data breaches at other companies, or social engineering where the hacker calls your bank pretending to be you. A smaller number result from weak security questions (birthplace, mother's maiden name) that hackers can research or guess.
Phishing is the most common. The email looks like it came from your bank and says your account is locked or suspicious activity was detected. You click a link, enter your username and password on what looks like your bank's website, and the hacker now has your credentials. Real banks never ask you to confirm your password by email or text. If you are unsure, hang up and call your bank's main number from the back of your debit card.
Malware infects your device when you download a file from an untrusted source, click a malicious ad, or visit a compromised website. Once installed, it can record everything you type, including passwords and PINs. Use antivirus software (Windows Defender is built into Windows; Mac users should run regular scans with a reputable tool), keep your operating system updated, and avoid downloading files from unfamiliar sources.
Reused passwords are a major vulnerability. If your email address and password were exposed in a breach at another company — a retailer, social media site, or streaming service — hackers will try that same password on your bank account. Use a unique, strong password for your bank account. A password manager like Bitwarden, 1Password, or Dashlane can generate and store unique passwords for each site, so you only have to remember one master password.
Protecting yourself after the hack: immediate and ongoing steps
Change your bank password immediately after reporting the fraud, even if the investigation is still underway. Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Do not use words from the dictionary or personal information like birthdays or pet names. If you used the same password anywhere else, change it on those accounts too.
Update your security questions and recovery email address. If the hacker has access to your email account, they can use the "forgot password" feature to reset your bank password. Log into your email account, change its password, and review the recovery phone number and backup email address on file. If either one is not yours, the hacker may have changed it — contact your email provider's support team immediately.
Enable two-factor authentication (2FA) on your bank account if it is not already on. This requires you to enter a code from your phone or an authenticator app every time you log in from a new device. Text message codes (SMS) are better than nothing, but authenticator apps like Google Authenticator or Authy are more secure because hackers cannot intercept them as easily. Ask your bank which 2FA methods they offer.
Monitor your account for the next several months. Set up account alerts so you receive a notification every time money leaves your account, your password is changed, or a new device logs in. Check your credit report at annualcreditreport.com (the only free, official source) to see whether the hacker opened new accounts in your name. You can place a free fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) to prevent new accounts from being opened without your consent.
What to do if your bank refuses to refund you
Banks sometimes deny fraud claims, arguing that you authorized the transaction or were negligent in protecting your password. If this happens, you have the right to dispute the bank's decision. Send a written letter to the bank's fraud department restating your claim, referencing the EFTA, and asking for a written explanation of why they denied your claim. Keep a copy for your records.
If the bank does not reverse the decision within 30 days, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will contact the bank on your behalf and require them to respond. You can also file a complaint with your state's banking regulator — search "[your state] banking regulator" or "[your state] attorney general" to find the right office. These agencies have authority to fine banks that violate the EFTA.
Document everything: the dates you reported the fraud, the names of bank employees you spoke to, the bank's written denial, and any evidence of the unauthorized transactions. If you end up in small claims court or need a lawyer, this documentation will be essential. Many consumer attorneys work on contingency (they take a percentage of what you recover) for EFTA violations, so ask whether a local attorney will review your case for free.
Liability limits: how much you could lose depending on when you report
The EFTA sets liability limits based on how quickly you report. These limits apply to unauthorized electronic transfers — debit card fraud, ACH transfers, wire transfers, and transfers through your bank's app or website. They do not apply to credit card fraud, which has its own rules under a different law.
| When You Report | Your Maximum Liability | What This Means |
|---|---|---|
| Within 2 business days | $50 | You lose at most $50; the bank covers the rest. |
| 3 to 60 calendar days after the statement | $500 | You could lose up to $500; the bank covers anything above that. |
| More than 60 calendar days after the statement | Unlimited | You could lose everything; the bank has no obligation to refund you. |
The clock starts when your bank sends you a statement showing the unauthorized transaction, not when the transaction occurred. If your statement arrives on the 15th and shows a fraudulent transfer from the 10th, you have until the 17th (two business days later, not counting weekends) to report it. If you report on the 18th, you have moved into the $500 liability zone.
This is why checking your account regularly matters. Log in at least weekly and review recent transactions. If you notice something wrong, report it immediately — do not wait for your statement to arrive. The sooner you report, the sooner the bank investigates and the more likely you are to recover the full amount.
Frequently Asked Questions
Can the hacker be prosecuted if the bank refunds my money?
Yes. The bank refunding you and criminal prosecution are separate processes. If the hacker is identified, the bank or you can report them to the FBI's Internet Crime Complaint Center (IC3) or local law enforcement. Prosecution depends on whether police can identify and locate the hacker, which is difficult if they used a VPN or operated from outside the U.S. Even if prosecution is unlikely, reporting creates a record that may help authorities identify patterns.
What if the hacker used my account to send money to someone else's account?
The receiving bank is responsible for freezing those funds if notified quickly. Your bank will contact them as part of the investigation. If the receiving bank cannot recover the money (because it was already withdrawn or transferred again), your bank still owes you a refund under the EFTA. The loss falls on the receiving bank or the hacker, not on you.
Does my bank have to tell me how the hacker got in?
No. Banks are not required to explain the method of the hack. However, you can ask, and many will tell you whether it was a phishing attack, malware, or a data breach. Knowing the method helps you prevent it from happening again. If the bank cannot explain it, that may indicate a security flaw on their end, which strengthens your case if they initially deny your claim.
Will this affect my credit score?
Not if the bank refunds you. Fraudulent transactions do not appear on your credit report because they were not authorized by you. However, if the hacker opened new accounts in your name and those accounts went unpaid, those accounts could damage your credit. Monitor your credit report and dispute any accounts you did not open. The credit bureaus must remove fraudulent accounts within 30 days of your dispute.
What if I share my account with someone who steals from it?
This is not fraud under the EFTA — it is a civil matter between you and the other person. The EFTA only protects you from unauthorized transactions by someone who does not have permission to access your account. If you gave someone access (a spouse, adult child, roommate) and they took money without your permission, you would need to pursue them through small claims court or civil court, not through your bank's fraud process. Consider whether you want to share account access with anyone, and if you do, use separate accounts for shared expenses instead.