Stop the bleeding first, then notify your bank

The moment you suspect your account has been hacked, call your bank's fraud line directly—not the number on your card, but the one on your statement or their official website. Have your account number ready. Tell them you believe unauthorized transactions have occurred and ask them to freeze your account immediately. This stops the hacker from moving money out while you work through what happened.

Your bank will likely cancel your debit card and credit card on file and issue replacements. They will also walk you through their fraud claim process, which varies by bank but generally involves documenting which transactions were not yours. Do not hang up until you understand what happens next and when you will hear back.

Most banks cover unauthorized transactions on checking and savings accounts under federal law (Regulation E), but the speed of reimbursement depends on how quickly you report it. Report within two business days and you are protected for the full amount. Wait longer and your liability can climb to $500 or more, depending on your bank's policy and how long you waited.

Key Takeaways

  • Call your bank's fraud line immediately and ask them to freeze your account; do not wait for a letter or email confirmation.
  • Report unauthorized transactions within two business days to stay protected under federal law; delays can cost you money.
  • Change your password from a different device (not the one that may be compromised) and enable two-factor authentication on your bank account.
  • File a report with the Federal Trade Commission at IdentityTheft.gov so you have an official record if the hack involves identity theft.
  • Monitor your credit reports for new accounts opened in your name; you can request a free report from each bureau at AnnualCreditReport.com.

Secure your account from the hacker's access point

While your bank is investigating, change your password immediately—but do it from a different device than the one you normally use. If your computer or phone was compromised, logging in from that device may give the hacker your new password too. Use a phone, tablet, or computer you trust, or a public computer at a library.

Make your new password at least 16 characters long, mixing uppercase and lowercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you have used the same password on other accounts (email, social media, shopping sites), change those too, because the hacker may try them.

Enable two-factor authentication on your bank account if it is not already on. This means your bank will send a code to your phone or email every time someone tries to log in from a new device. Even if the hacker has your password, they cannot get into your account without that code. Ask your bank which two-factor methods they support—SMS text is common, but app-based authentication (like Google Authenticator) is more secure.

Document what was taken and file a fraud claim

Write down every unauthorized transaction: the date, the amount, the merchant or recipient, and the status (pending, posted, reversed). Your bank will ask for this list when you file your fraud claim. Take screenshots of your account showing the transactions, even if your bank can see them—you want your own copy.

Your bank will send you a fraud claim form, either by mail or through your online account. Fill it out completely and return it within the timeframe they give you (usually 10 to 30 days). Be specific about which transactions were yours and which were not. If you are unsure about a transaction, mark it as disputed rather than claiming it was fraud—your bank can investigate either way, but fraud claims have stronger legal protections.

Most banks will provisionally credit your account within three to five business days while they investigate. This means the money goes back into your account, but it is not final until the bank completes their review (usually 10 to 45 days). During that time, do not spend the provisional credit—if the bank's investigation finds against you, they will take it back.

Report the hack to the Federal Trade Commission

Go to IdentityTheft.gov and file a report. This is a free government resource that creates an official record of the hack. You will answer questions about what happened, which accounts were affected, and what steps you have already taken. At the end, you get a recovery plan and an Identity Theft Report, which you can show to your bank, creditors, or credit bureaus if you need to dispute something later.

The FTC report does not investigate the hack itself—that is your bank's job—but it creates a paper trail that protects you if the hacker opened new accounts in your name or if the hack turns into identity theft. Keep a copy of your report and the recovery plan.

Check your credit reports and place a fraud alert

Request a free credit report from each of the three major bureaus—Equifax, Experian, and TransUnion—at AnnualCreditReport.com. This is the only official site for free reports; do not use other sites that claim to be free but ask for a credit card. Review each report for accounts you did not open, inquiries you did not authorize, or addresses that are not yours.

If you find fraudulent accounts or inquiries, contact the bureau that reported them and file a dispute. Include a copy of your FTC Identity Theft Report. The bureau must investigate within 30 days and remove the fraudulent item if they cannot verify it.

Place a fraud alert with all three bureaus. A fraud alert tells creditors to contact you before opening new accounts in your name. You can place it for free by calling one bureau; they will notify the other two. The alert lasts one year and can be renewed. If you believe you are a victim of identity theft (not just account hacking), you can request a credit freeze instead, which is stronger but requires you to unfreeze your credit when you want to apply for new accounts.

What to do about pending transactions and holds

If the hacker initiated a wire transfer or ACH payment that has not yet posted, call your bank immediately and ask them to recall it. Banks can sometimes stop outgoing transfers before they clear, but only if you catch them quickly—usually within hours. Once the transfer posts to the receiving bank, it is much harder to reverse.

If money was transferred to another bank account, your bank can file a claim with that bank asking them to freeze the funds. This works best if you report it the same day. Provide your bank with the receiving account number and routing number if you have it, or the name of the receiving bank and the amount transferred.

If the hacker used your account to pay for goods or services, contact the merchant directly and explain that the transaction was unauthorized. Some merchants will cancel the order or refund the charge without waiting for your bank's investigation. This is especially true for online retailers and digital services.

Prevent future hacks: update your security

Run a malware scan on any device you use to access your bank account. Download Malwarebytes (free version) or Windows Defender (built into Windows) and scan your computer. If you use a Mac, run Malwarebytes or the built-in Xprotect. On your phone, go to Settings and run a security scan if your device offers one.

Update your operating system and all software to the latest version. Hackers often exploit known vulnerabilities in older versions. Turn on automatic updates so you do not have to remember.

Use a password manager like Bitwarden, 1Password, or Dashlane to generate and store unique passwords for every account. This way you only have to remember one strong master password. Password managers also fill in your login information, which reduces the chance you will accidentally log into a fake website.

Consider using your bank's mobile app instead of logging in through a web browser. Apps are generally more secure because they do not fall for phishing websites. If you do use a browser, bookmark your bank's website and always click the bookmark—do not search for the bank or click a link in an email, because those can lead to fake sites.

Frequently Asked Questions

How long does it take to get my money back?

Most banks provisionally credit your account within three to five business days. The full investigation takes 10 to 45 days, depending on the bank and the complexity of the fraud. If the bank finds in your favor, the credit becomes permanent. If they find against you, they will debit your account again.

What if my bank says I am liable for the fraud?

If you reported the fraud within two business days, federal law (Regulation E) protects you from liability. If your bank still refuses to refund you, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. Include your bank's name, account number, the amount in dispute, and a summary of what happened.

Can the hacker access my account again after I change my password?

Not if you change your password from a secure device and enable two-factor authentication. However, if your device is still infected with malware, the hacker may be able to see your new password as you type it. Run a malware scan first, or change your password from a different device entirely.

Do I need to close my account?

Not necessarily. Closing the account does not erase the fraud from your record, and it can hurt your credit score if the account was in good standing. Keep the account open, change your password, enable two-factor authentication, and monitor it closely for the next few months. You can close it later if you want.

What if the hacker opened new credit accounts in my name?

This is identity theft, not just account hacking. File a report at IdentityTheft.gov immediately. Contact each creditor that opened the fraudulent account and tell them it was not you. Dispute the accounts on your credit reports. You may also want to place a credit freeze to prevent new accounts from being opened without your permission.