Report the theft to your bank within two business days

Call your bank's fraud line immediately — do not wait. The phone number is on the back of your card or in your online banking portal. Tell them which transactions were unauthorized and when you first noticed them missing. The bank will freeze your account and begin an investigation.

Your bank has a legal obligation under the Electronic Funds Transfer Act to investigate and restore your money, but the speed and amount depend on how fast you report it. If you report within two business days, your liability is capped at $50 per unauthorized transaction. If you wait longer than two business days but report within 60 days, you could lose up to $500. After 60 days, you may not recover anything.

Write down the date and time you called, the name of the person you spoke with, and what you reported. Ask for a confirmation number. This record protects you if the bank later claims you never called.

Key Takeaways

  • Report unauthorized transactions to your bank within two business days to limit your liability to $50 per transaction.
  • Your bank must investigate and typically restores money within 10 business days if the theft is confirmed.
  • File a police report and get the case number — banks often require this before releasing funds.
  • If your bank denies your claim, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau.
  • Freeze your credit with the three major bureaus to prevent the thief from opening new accounts in your name.

File a police report and get the case number

Contact your local police department or file a report online through your state's attorney general website. You do not need to go to a police station — many departments accept reports by phone or through their website. Provide the bank's name, the amount stolen, the dates of the unauthorized transactions, and any information about how the theft happened (phishing email, malware, lost card, etc.).

Ask for a case number and a copy of the report. Banks often will not release your money without proof that you reported the crime to law enforcement. Keep this number and report handy — you will need it when you follow up with the bank.

If you believe your identity was stolen (not just your account compromised), file an identity theft report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and gives you additional protections under the Identity Theft Enforcement and Restitution Act.

Provide documentation to your bank and wait for the investigation

Your bank will ask you to sign an affidavit swearing that the transactions were unauthorized. They may also ask for the police report number, your statement showing the fraudulent charges, and any communications you have with the thief (emails, texts, etc.). Send these documents by the method the bank specifies — usually through secure email or your online banking portal.

The bank has up to 10 business days to investigate and restore your money if the fraud is clear-cut. If the investigation is more complex, they have up to 45 days. During this time, your account may remain frozen or limited. Ask the bank whether you can make withdrawals or if you need a temporary card to access your money while they investigate.

Do not close the account during the investigation. Closing it can delay the process or cause the bank to deny your claim. Keep all communications with the bank in writing — follow up phone calls with emails summarizing what was discussed.

What happens if the bank denies your claim

If the bank says the transactions were authorized or that you were negligent, you have the right to dispute their decision. Request a written explanation of why they denied your claim. Banks sometimes deny claims incorrectly, especially if the thief used your PIN or if the theft happened through a third-party app linked to your account.

File a complaint with your state's banking regulator. Each state has a banking commissioner or department of financial regulation. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can order banks to reverse denied claims. Include copies of your police report, the bank's denial letter, and your affidavit.

If the amount is small enough, you can also sue the bank in small claims court. Bring your police report, bank statements, and all written communications with the bank. The burden is on the bank to prove the transaction was authorized, not on you to prove it was not.

Secure your account and prevent future theft

Once the bank restores your money, change your online banking password immediately. Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Do not reuse passwords across different banks or websites.

Enable two-factor authentication on your bank account if it is not already on. This means the bank will send a code to your phone or email every time someone tries to log in from a new device. Even if a thief has your password, they cannot access your account without this second code.

Check whether your email or phone number was compromised. If the thief accessed your bank account through your email, change your email password and enable two-factor authentication there as well. If they used your phone number to reset your password, contact your phone carrier and ask them to add a PIN to your account so no one can switch your number without your permission.

Freeze your credit to stop identity theft

Contact Equifax, Experian, and TransUnion — the three major credit bureaus — and request a security freeze. A freeze prevents anyone from opening new credit accounts in your name. You can freeze your credit for free by calling each bureau or visiting their website. The freeze takes effect within one business day.

You will receive a PIN for each freeze. Keep these PINs in a safe place. If you need to open a new credit account yourself, you will need to temporarily lift the freeze by providing your PIN.

You can also place a fraud alert on your credit file, which is faster but less protective. A fraud alert tells lenders to verify your identity before opening new accounts, but it does not prevent them from doing so. A freeze is stronger and is recommended if your identity was stolen.

Monitor your accounts and credit report going forward

Check your bank and credit card statements every week for the next three months, then monthly for a year. Look for transactions you do not recognize. The sooner you spot fraud, the faster you can report it and recover your money.

Pull your credit report from each of the three bureaus at annualcreditreport.com — this is free and does not hurt your credit score. Look for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you see fraud on your credit report, dispute it with the bureau in writing and send a copy to the lender that opened the fraudulent account.

Consider signing up for credit monitoring or identity theft protection, though these services are not required. Some banks offer free monitoring to customers whose accounts were compromised. If you pay for a service, choose one that monitors all three credit bureaus and offers identity theft insurance.

Frequently Asked Questions

How long does it take to get my money back?

If you report within two business days and the fraud is straightforward, your bank typically restores the money within 10 business days. Complex cases can take up to 45 days. Some banks credit your account temporarily while they investigate, so you may have access to your money sooner even if the investigation is still ongoing.

What if I used my debit card and the thief made purchases at stores?

Debit card fraud is treated the same way as unauthorized transfers. Report it to your bank within two business days and your liability is capped at $50. The bank will investigate and restore your money if they confirm the charges were not made by you. Bring receipts or store records if you have them, but the bank can also contact the merchants directly.

Can the bank hold me responsible if I shared my password with someone?

If you voluntarily gave your password to someone and they stole your money, the bank may deny your claim and hold you liable for the full amount. However, if someone tricked you into sharing your password (phishing, social engineering), that is still fraud and the bank should cover it. The key is whether you knowingly authorized the person to access your account.

What if the thief transferred my money to another bank account?

Your bank will trace the transfer to the receiving bank and request that the funds be frozen. The receiving bank has a legal obligation to hold the money while the investigation happens. If the receiving bank released the money before the investigation was complete, your bank can pursue them for restitution. You will still recover your money, but it may take longer.

Do I need to close my account after it was hacked?

You do not have to close it, but you can if you want to. Closing the account does not affect your recovery — the bank will still restore your money. However, closing it during an active investigation can slow things down. Wait until the investigation is complete and your money is restored, then decide whether to keep the account open or move to a different bank.