Start with your bank's fraud department, not the internet
Call your bank immediately using the number on the back of your card or statement—not a number from a search result. The fraud department can see exactly which transactions were unauthorized, from which devices or locations they came, and sometimes which merchant or service was compromised. They have access to IP addresses, device fingerprints, and login timestamps that you cannot see in your own account.
Tell them the specific transactions you did not make and ask them to pull the full details: the IP address used, the device type (mobile, desktop, location), the time of day, and whether it was a card-present or card-not-present transaction. If multiple transactions happened, ask whether they came from the same IP or device. This tells you whether one person had access or whether your information was sold to multiple fraudsters.
Your bank will also tell you whether the breach came from their own systems, a merchant you used, or a third-party service like a payment app or password manager. They may not have the full answer immediately, but they can narrow it down enough to point you in the right direction.
Key Takeaways
- Your bank's fraud department can see the IP address, device type, and location of unauthorized transactions—information you cannot access yourself.
- Ask your bank whether the breach came from their systems, a merchant you used, or a third-party app or service.
- Check your email for password reset confirmations, two-factor authentication codes, or login alerts you did not trigger.
- Review your connected apps and devices in your bank's settings to find unauthorized access points.
- File a report with the Federal Trade Commission at IdentityTheft.gov so you have documentation for disputes and credit monitoring.
Check your email for signs of account takeover
Hackers often change your password or add a recovery email address to lock you out. Search your email inbox and spam folder for messages from your bank with subject lines like "Password Changed," "Email Address Updated," "Two-Factor Authentication Disabled," or "New Device Signed In." If you see these and did not trigger them, someone had access to your account.
Also look for emails from services you use—payment apps, cryptocurrency exchanges, password managers, or shopping sites. Hackers often test stolen credentials across multiple platforms. If you see login confirmations from cities you were not in or devices you do not own, that service was also compromised.
Do not delete these emails. Screenshot them or forward them to yourself with a note about the date and time. Your bank and the Federal Trade Commission will ask for this documentation later.
Review connected apps and devices in your bank account settings
Log into your bank account on a device you trust and look for a section called "Connected Apps," "Authorized Devices," "Login History," or "Active Sessions." Different banks name this differently, but most have it under Settings or Security.
You should see a list of devices and apps that have accessed your account, usually with the device type, location, and last login date. If you see a phone, computer, or app you do not recognize, that is a direct sign of unauthorized access. Note the device name, location, and the date it was last active. This information helps your bank trace the breach and helps you understand how long the hacker had access.
Do not just remove the device—take a screenshot first. Your bank may need this for their investigation, and you may need it for a dispute later.
Look for a data breach involving a service you use
Your bank account information may have been stolen not from your bank, but from a merchant, payment app, or other service where you entered your card details. Check Have I Been Pwned (haveibeenpwned.com) and enter your email address. The site will tell you which known data breaches included your email.
If a breach is listed, click on it to see what information was exposed—sometimes it is just email and password, sometimes it includes payment card details. If the breach included your bank card number, expiration date, or CVV, that explains how the hacker got your information.
You can also search for the specific merchant or service name plus "data breach" to see whether they have publicly disclosed a compromise. Major breaches are usually reported in news articles within days or weeks of discovery.
Check your credit report for accounts opened in your name
Hackers sometimes use stolen bank information to open new accounts—credit cards, loans, or utility accounts—in your name. Get your free credit report from AnnualCreditReport.com (the only official site for free reports). You are may have access to to one free report per year from each of the three major bureaus: Equifax, Experian, and TransUnion.
Look for accounts you did not open, especially recent ones. If you see a credit card, auto loan, or personal loan you did not apply for, that is a sign of identity theft beyond just account compromise. Note the account number, the date it was opened, and the creditor name.
If you find fraudulent accounts, contact the creditor directly and tell them the account was opened without your consent. Ask them to close it and mark it as a fraud claim. Also place a fraud alert on your credit file by contacting one of the three bureaus—they are required to notify the other two.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report. This is a free federal service, not a private company. The report documents what happened, when you discovered it, and what steps you have taken. You will receive a recovery plan and an Identity Theft Report, which you can use when disputing fraudulent charges with your bank or other creditors.
The FTC does not investigate individual cases, but your report becomes part of their database. If many people report the same merchant or service, the FTC may open an investigation into that company. Your report also creates an official record in case you need to prove to creditors or collection agencies that you were a victim of fraud.
Secure your accounts to prevent further access
Once you know how the hacker got in, close that door. If the breach came from a merchant or service, change your password on that platform immediately and enable two-factor authentication if it is available. If the breach came from your bank, your bank will issue you a new card and may reset your online password for you.
Change your bank password to something long and unique—at least 16 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used anywhere else. If you use the same password on multiple sites, change it on all of them.
Enable two-factor authentication on your bank account if you have not already. Most banks offer this through an authenticator app (like Google Authenticator or Authy), SMS text, or a hardware security key. An authenticator app is more secure than SMS, but SMS is better than nothing.
Frequently Asked Questions
Can the bank tell me the hacker's name or address?
No. Your bank can tell you the IP address and device used, but tracing that to a person requires law enforcement. If the fraud is large enough, your bank may file a report with the FBI or Secret Service, but they will not share the investigation details with you. Focus on recovering your money and securing your accounts.
What if my bank says they cannot see where the unauthorized transactions came from?
Ask to speak with a supervisor or the fraud investigation team. Front-line customer service representatives sometimes do not have access to the full transaction details. If the bank still cannot provide IP addresses or device information, ask whether they are treating this as a dispute or a fraud claim—the two have different investigation timelines and documentation requirements.
Do I need to file a police report?
Not required, but it can help. If the fraud amount is large or your bank asks for one, contact your local police department's non-emergency line and ask how to file a report for identity theft or fraud. You will receive a report number, which you can give to your bank and the FTC. Some banks move faster on disputes when a police report is filed.
How long does it take to get my money back?
Your bank has different timelines depending on whether they treat this as a dispute or fraud. Debit card fraud is usually resolved within 10 business days if you report it quickly. Credit card fraud often takes 30 to 60 days. Ask your bank for their specific timeline and get it in writing.
What if the hacker used my bank account to send money to someone else?
Tell your bank immediately. If the money was sent via wire transfer or ACH, your bank can sometimes recall it if the receiving bank cooperates. The faster you report it, the better the chance of recovery. If the money went to a cryptocurrency exchange or a third-party payment app, recovery is much harder and may not be possible.