Bank fraud is when someone uses your account, card, or personal information to move money without your permission.
Bank fraud covers a range of crimes: a thief using your debit card to buy groceries, someone opening a credit card in your name, a criminal transferring money out of your checking account, or a scammer posing as your bank to trick you into revealing your password. The common thread is that money leaves your account or a new debt appears in your name without your consent. The person committing the fraud may be a stranger, a family member, or someone who works at a financial institution.
The damage varies. A single unauthorized transaction might cost you $50. Identity theft can result in tens of thousands of dollars in fraudulent accounts opened in your name, and recovery can take months or years. Federal law limits your liability for unauthorized transactions, but only if you report them within a specific window—and only if you meet the conditions for protection.
Key Takeaways
- Bank fraud includes unauthorized card use, account takeover, identity theft, and wire fraud—all crimes where someone moves your money or borrows in your name without permission.
- Your liability for unauthorized debit card charges is capped at $50 if you report within two business days, but rises to $500 if you wait longer, and you may lose all protection if you wait more than 60 days.
- Credit card fraud carries different protections: you are liable for no more than $50 per card, regardless of how much was stolen, as long as you report it.
- Reporting fraud to your bank immediately—by phone, not email—starts the clock on investigation and protection; written confirmation should follow within 15 days.
- Fraud often signals that your personal information has been compromised, so checking your credit report and placing a fraud alert with the credit bureaus is a necessary second step.
Types of bank fraud and how they work
Card fraud happens when someone uses your debit or credit card—or the card number alone—to make purchases or withdraw cash. They may have stolen the physical card, skimmed the number from a gas pump or ATM, or obtained it through a data breach. You may not notice for days or weeks if the fraudster makes small purchases or if statements arrive by mail.
Account takeover occurs when a criminal gains access to your online banking login, usually through a phishing email, a malware-infected device, or a password breach at another company. Once inside, they can transfer money to another account, change your contact information, or lock you out of your own account. This is faster and more damaging than card fraud because large sums can move in minutes.
Identity theft is when someone uses your Social Security number, name, and address to open new accounts—credit cards, loans, utilities, phone lines—in your name. You may not discover this for months, and by then the fraudster has run up debt and damaged your credit score. This type of fraud is often discovered through a credit report or a collection call about an account you never opened.
Wire fraud involves tricking you into sending money to a criminal's account. A scammer may pose as your bank, your employer, a government agency, or a trusted contact and convince you to wire funds or provide banking details. Unlike card fraud, wire transfers are extremely difficult to reverse once sent.
Your liability depends on the type of fraud and how fast you report it
Federal law sets limits on what you owe for unauthorized transactions, but the protection is conditional. For debit card fraud, your liability is capped at $50 if you report the fraud within two business days of discovering it. If you wait longer than two business days but report within 60 days, your liability rises to $500. If you do not report within 60 days of receiving your statement, you may lose all protection and be liable for the full amount stolen.
For credit card fraud, your liability is capped at $50 per card, period—even if the thief charged $10,000. This protection applies as long as you report the fraud; there is no time window as strict as with debit cards. However, you must still report promptly to limit the damage to your credit score and prevent further charges.
For account takeover and wire fraud, protections are weaker. If a criminal gains access to your online banking and transfers money, your bank may not cover the loss if you failed to use reasonable care with your password or if you were tricked into revealing login information. Wire fraud is rarely covered at all because the money has left the banking system entirely. Your only recourse is to report it to the FBI and hope law enforcement can recover the funds.
The key is speed: call your bank by phone the moment you notice unauthorized activity. Do not email or use online chat—a phone call creates a record with a timestamp, and your bank can place a fraud hold on your account immediately.
What your bank does after you report fraud
When you report fraud by phone, your bank should place a temporary hold on your account and issue you a new card or new login credentials within one to three business days. They will open a fraud investigation, which typically takes 10 business days for debit card fraud and up to 30 days for more complex cases like account takeover.
During the investigation, your bank will review the disputed transactions, contact merchants if necessary, and determine whether each charge was truly unauthorized. They will also check whether you contributed to the fraud through negligence—for example, by writing your PIN on your card or using a password that was already compromised in a public data breach.
Your bank must send you written confirmation of the investigation within 15 days, even if the investigation is not complete. If they find the fraud was genuine, they will credit your account for the full amount (minus your liability cap). If they find you were negligent or if the transaction was actually authorized, they will deny the claim and you remain liable.
Request a copy of the investigation report for your records. You will need it if you later dispute the bank's decision or if you discover related fraud on other accounts.
Fraud often means your personal information is compromised
A single fraudulent transaction may be an isolated incident—a skimmed card number, a one-time phishing attempt. But it may also signal that your Social Security number, address, or other identifying information has been stolen and is circulating in criminal networks. Criminals often sell stolen data in bulk, so one fraud can be the first of many.
After reporting fraud to your bank, check your credit report at all three bureaus—Equifax, Experian, and TransUnion—through AnnualCreditReport.com, the only free source authorized by federal law. Look for accounts you did not open, inquiries from lenders you did not contact, and incorrect personal information. If you find fraudulent accounts, dispute them with the credit bureau in writing and with the creditor directly.
Place a fraud alert with all three credit bureaus by contacting one of them; the alert will automatically notify the other two. A fraud alert tells lenders to verify your identity before opening new accounts in your name. It lasts one year and is free. If you discover identity theft affecting multiple accounts, you can place an extended fraud alert lasting seven years.
Consider a credit freeze if the fraud is serious or if you have already been a victim of identity theft. A freeze locks your credit file so that no one—including you—can open new accounts without unfreezing it first. It is free in most states and lasts until you remove it.
Reporting fraud to law enforcement and the FTC
Bank fraud is a federal crime. If you believe you are a victim, file a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. The IC3 does not investigate individual cases but compiles data on fraud trends and may share information with law enforcement if a pattern emerges.
Also file a report with the Federal Trade Commission (FTC) at reportfraud.ftc.gov. The FTC maintains a database of fraud complaints and uses the data to identify scams and issue warnings. Filing with the FTC also creates an official record that can help you if you need to dispute fraudulent accounts or prove you were a victim.
If you were tricked into sending money via wire transfer or gift card, contact the wire service (Western Union, MoneyGram) or the gift card company immediately. Provide them with the transaction details and ask them to freeze the receiving account. Recovery is rare but possible if you act within hours.
Steps to take if you discover fraud on your account
| Step | Action | Timing |
|---|---|---|
| 1 | Call your bank's fraud line by phone (number on back of card or statement) | Immediately, within hours if possible |
| 2 | Report each unauthorized transaction and ask for a new card or new login credentials | Same call |
| 3 | Request written confirmation of the fraud report within 15 days | Same call |
| 4 | Check your credit report at AnnualCreditReport.com for fraudulent accounts | Within one week |
| 5 | Place a fraud alert with one of the three credit bureaus | Within one week |
| 6 | File a report with the FBI (ic3.gov) and FTC (reportfraud.ftc.gov) | Within one week |
| 7 | Dispute fraudulent accounts with the credit bureau and the creditor in writing | Within 30 days of discovering the fraud |
| 8 | Monitor your credit report and bank statements for new fraud over the next 12 months | Ongoing |
Frequently Asked Questions
Will my bank refund the money if I report fraud?
Your bank will refund unauthorized transactions if the fraud is genuine and you reported it within the required timeframe. For debit cards, you must report within two business days to cap your liability at $50; for credit cards, your liability is capped at $50 regardless of timing. However, if your bank determines you were negligent—for example, you shared your PIN or used a weak password—they may deny the claim.
How long does a fraud investigation take?
Most debit card fraud investigations take 10 business days. More complex cases, like account takeover or wire fraud, can take up to 30 days. Your bank must send you written results within 15 days, though the investigation may still be ongoing. During the investigation, you typically have access to a temporary credit or replacement card.
Can I be held liable for fraud if someone in my household did it?
If a family member or household member commits fraud on your account without permission, it is still fraud and your bank should treat it as such. However, proving you did not authorize it can be difficult if you share devices, passwords, or physical access to cards. Document everything and report it to your bank and law enforcement immediately.
What should I do if I think my Social Security number was stolen?
Place a fraud alert with the credit bureaus, check your credit report for fraudulent accounts, and consider a credit freeze. You can also create an account at IdentityTheft.gov, which walks you through recovery steps and provides templates for dispute letters. Monitor your credit report for at least one year, and consider placing an extended fraud alert lasting seven years.
Is my bank responsible if my card was skimmed at an ATM?
Your bank is responsible for refunding skimmed card fraud as long as you report it within the required timeframe. The ATM operator may also be liable if they failed to maintain the machine or if they installed the skimming device. Report the fraud to your bank and to the ATM operator's customer service line, and file a complaint with your state's attorney general if the operator is unresponsive.