Account takeover is when someone else gains control of your bank account without your permission and uses it to move money or make charges

An account takeover happens when a criminal obtains your login credentials, security answers, or enough personal information to convince your bank they are you. Once inside, they can transfer funds to their own account, change your contact information so you don't see the theft, set up bill pay to themselves, or drain your account before you notice anything is wrong. The takeover is complete — they control the account, not you.

Account takeover is different from credit card fraud or identity theft, though criminals often use the same stolen data for all three. With account takeover, the attacker has direct access to your actual bank account and can move money in real time. You may not discover it for days or weeks, especially if they change your email address or phone number first.

Key Takeaways

  • Account takeover means a criminal has your login credentials or has convinced your bank they are you, and can now move money from your account.
  • Signs include transactions you didn't make, contact information changes you didn't authorize, or being locked out of your own account.
  • Report suspected takeover to your bank immediately by calling the number on your card or statement, not a number from an email or text.
  • Your bank is responsible for refunding unauthorized transfers in most cases, but you must report within a specific timeframe — usually 30 to 60 days.
  • Prevention requires a strong unique password, two-factor authentication, and monitoring your account regularly for unfamiliar activity.

How criminals get your login information

Criminals obtain bank login credentials through phishing emails that look like they come from your bank, text messages with fake links, malware on your computer or phone, or data breaches at retailers or other companies where you reused your password. They may also buy stolen credentials on the dark web for a few dollars per account.

Some attackers don't need your password at all. They call your bank pretending to be you, answer security questions using information from public records or social media, and ask the bank to reset your password or add a new phone number. If your bank's verification process is weak — asking only for your name, address, and Social Security number — the takeover succeeds without ever needing your original login.

Warning signs that your account has been taken over

The most obvious sign is a transaction you did not make. Check your account statement weekly, not just monthly. Look for transfers to unfamiliar accounts, bill pay set up to new payees, or small test charges that criminals use to confirm the account works before moving larger amounts.

Other red flags include being locked out of your account when you try to log in, receiving a password reset email you didn't request, seeing a new phone number or email address on file, or getting a call from your bank asking about activity you don't recognize. Some criminals change your contact information first so you won't see alerts — if you suddenly stop receiving statements or notifications, contact your bank directly.

If you receive a notification about a login from an unfamiliar location or device, treat it seriously. Your bank's security system flagged it for a reason, even if you think it might be a false alarm.

What to do immediately if you think your account is taken over

Call your bank right now using the phone number on your debit card or a recent statement. Do not use a number from an email, text, or search result — criminals send fake notifications with fake customer service numbers. Tell the bank representative that you suspect account takeover and that you need to freeze your account immediately.

Your bank will likely lock the account, cancel your debit card, and begin an investigation. They may ask you to come into a branch to verify your identity in person, especially if large amounts were moved. Do not delay — the faster you report, the better your chance of recovering the money and preventing further theft.

After you contact your bank, change your password from a different device (a computer or phone that was not used to access the account before). Use a password you have never used anywhere else. If you used the same password on other accounts, change those too.

How your bank investigates and refunds the theft

Your bank will review the transactions and determine which ones were unauthorized. They will also check whether you were negligent — for example, whether you wrote your password on a sticky note or shared it with someone. In most cases, if you report the takeover promptly, the bank refunds unauthorized transfers within 10 business days while the investigation continues.

Under federal law, your liability for unauthorized transfers depends on how quickly you report. If you report within two business days of discovering the takeover, your loss is capped at $50. If you report between two and 60 days, your loss is capped at $500. If you wait more than 60 days, you may lose everything that was taken. Report immediately — do not wait to see if the bank notices on its own.

The investigation itself can take 10 to 45 days. During this time, your account may be frozen, which means you cannot access your own money. Ask your bank whether they can provide emergency cash or a temporary account while the investigation is underway.

Protecting your account from takeover

Use a strong unique password for your bank account — at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Never reuse a password from another website. A password manager like Bitwarden or 1Password stores complex passwords securely so you only have to remember one master password.

Enable two-factor authentication (2FA) on your bank account if your bank offers it. This means that even if a criminal has your password, they cannot log in without also having your phone or email. Choose authentication methods your bank sends to you (like a code via text or email), not methods that rely on an app you have to download — those can be compromised too.

Monitor your account regularly. Log in at least weekly and scan for unfamiliar transactions. Set up account alerts through your bank's app or website so you receive a notification whenever a transfer over a certain amount is made. Some banks offer free credit monitoring or dark web monitoring as part of their security package — use it.

Be skeptical of unsolicited contact. Your bank will never ask for your password, PIN, or full Social Security number via email, text, or phone call. If someone claiming to be from your bank contacts you, hang up and call the number on your card instead.

What happens to your account while it is frozen

Once you report account takeover, your bank will freeze the account to stop further theft. You cannot withdraw money, set up bill pay, or make transfers while the freeze is in place. This is frustrating, but it is necessary to preserve evidence and prevent the criminal from moving more money.

Ask your bank how long the freeze will last and whether they can provide you with emergency cash or a temporary account for essential bills. Some banks offer a courtesy advance or will expedite the investigation if you are in financial hardship. Be specific about what you need — if you have rent due in three days, tell the bank that.

Once the investigation is complete and the bank confirms which transactions were unauthorized, they will refund your account and lift the freeze. You will then need to update any automatic bill payments or direct deposits that were set up on the old account.

Frequently Asked Questions

Can the criminal still access my account after I change my password?

Not if you change your password from a clean device and your bank has already frozen the account. However, if the criminal installed malware on your computer, they may still have access even after you change your password. Run a full antivirus scan on any device you use to access your bank account, or consider using a different device entirely until you are sure the malware is gone.

Will my bank refund me if I was careless with my password?

Most banks will refund you even if you were somewhat careless, as long as you report within 60 days. However, if you wrote your password on a sticky note, shared it with someone, or used the same password on multiple websites that were breached, the bank may deny your claim. The best protection is to report immediately — the faster you report, the stronger your case.

What if the criminal transferred money to another bank?

Your bank will trace the transfer and work with the receiving bank to recover the funds. This process is slower than stopping a transfer before it leaves your account, which is why speed matters. The receiving bank has a legal obligation to freeze the funds if they are notified of fraud, but this only works if your bank reports quickly.

Do I need to close my account after a takeover?

Not necessarily. Once your bank has refunded the unauthorized transfers and confirmed the account is secure, you can keep it open. However, some people feel more comfortable closing the old account and opening a new one with a completely new account number. Ask your bank whether they can issue a new account number without closing the account, which preserves your account history and routing number for direct deposits.

Can account takeover happen if I use online banking through my bank's app?

Yes. Using the official bank app is safer than using a web browser, but it is not foolproof. The app can still be compromised if your phone has malware, if you use a weak password, or if someone obtains your login credentials through phishing. Two-factor authentication on the app provides the strongest protection.