Stop the bleeding first: lock your account and call your bank
Call your bank's fraud line the moment you notice unauthorized transactions. Most banks have a 24/7 number on the back of your debit card or in your online banking portal. Tell them your account has been compromised and ask them to freeze it immediately. A frozen account stops new transactions from going through while you sort out what happened.
Your bank will likely cancel your current debit card and issue a replacement, which takes 5 to 10 business days to arrive. Ask whether they can issue a temporary card number or expedite a physical card if you need access to funds before then. Some banks offer next-day delivery for a fee; others will not.
Do not close the account yourself yet. Your bank needs it open to investigate the fraudulent charges and process refunds. Closing it can actually slow down the recovery process.
Key Takeaways
- Call your bank's fraud line immediately and ask them to freeze your account; most banks reverse unauthorized charges within 10 business days if you report them promptly.
- File a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record and gives you a recovery plan specific to your situation.
- Check your credit reports at AnnualCreditReport.com for accounts you did not open, and place a fraud alert with the three credit bureaus to prevent new accounts in your name.
- Change your online banking password and the password for any email account linked to your checking account, using a password manager to create unique, complex passwords.
- Monitor your bank account and credit reports for at least six months, because some fraudsters wait weeks or months before making additional charges.
Understand what your bank will and will not refund
Debit card fraud is covered under the Electronic Funds Transfer Act (EFTA). If you report unauthorized charges within two business days, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. After 60 days, you may lose the full amount, though many banks refund it anyway as a courtesy.
The clock starts from the day you discover the fraud, not the day the charge occurred. If your statement shows a charge from three weeks ago that you just noticed, you still have time to report it within the 60-day window.
ACH transfers and bill payments from your checking account are handled differently. If someone used your account number to set up unauthorized ACH debits, you have 60 days to report them. Your bank should reverse these as well, but the process can take longer because ACH transactions involve other banks.
Your bank will ask you to document which charges are fraudulent. Be specific: provide the date, amount, and merchant name for each one. Vague reports slow down the investigation.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report. This is a free federal resource, not a private company. The FTC creates an official record of the fraud and generates a recovery plan tailored to your situation.
You will answer questions about what happened: when you discovered it, which accounts were affected, and what steps you have already taken. The FTC uses this information to track fraud patterns and sometimes shares data with law enforcement.
At the end, you will receive an Identity Theft Report, which is a document you can show to your bank, credit card companies, and creditors. Some banks accept this report in place of their own fraud affidavit, which speeds up the process.
Secure your email and linked accounts
Hackers often gain access to your checking account through your email. If your email password is weak or reused across multiple sites, change it immediately. Use a password manager like Bitwarden, 1Password, or KeePass to generate and store a unique, complex password—at least 16 characters with uppercase, lowercase, numbers, and symbols.
Check your email's recovery options. Go to your email provider's security settings and confirm that the recovery phone number and backup email address are ones you recognize. If a hacker has changed these, they can lock you out and reset your passwords.
Enable two-factor authentication (2FA) on your email account and your online banking portal. This means even if someone has your password, they cannot log in without a code from your phone or an authentication app. Use an authenticator app like Google Authenticator or Authy rather than SMS codes when possible, because SMS can be intercepted.
Review your connected apps and devices. In your email and bank settings, look for a section called "Connected apps," "Authorized devices," or "Active sessions." Remove anything you do not recognize.
Place a fraud alert and monitor your credit
Contact one of the three major credit bureaus—Equifax, Experian, or TransUnion—and request a fraud alert. You only need to call one; they are required to notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name.
A fraud alert lasts one year and is free. After one year, you can renew it if needed. If you have already been a victim of identity theft, you can request an extended fraud alert that lasts seven years.
Order your free credit reports from AnnualCreditReport.com (the only official site for free reports). Check all three reports for accounts you did not open, inquiries you do not recognize, or addresses that are not yours. If you find fraudulent accounts, contact the creditor and the credit bureau immediately.
Set up free credit monitoring through your bank or through services like Credit Karma or AnnualCreditReport.com's monitoring tool. Check your reports at least monthly for the next six months. Some fraudsters wait weeks or months before making additional charges, so early detection matters.
Recover funds and document everything
Your bank will investigate the fraudulent charges and typically issue a provisional credit within 10 business days. This credit is temporary while they investigate. The final information usually comes within 30 to 45 days.
Keep records of everything: the dates you called your bank, the names of the people you spoke with, confirmation numbers, copies of your statements showing the fraudulent charges, and your FTC Identity Theft Report. If your bank denies a refund, you will need this documentation to dispute it.
If your bank refuses to refund a charge you reported within 60 days, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints against banks and can force them to refund money if they violated the EFTA.
Prevent future hacking: change how you bank
Do not use the same password across multiple sites. If one site is breached, hackers can try that password on your bank, email, and other accounts. A password manager solves this by storing unique passwords securely.
Avoid public Wi-Fi for banking. Hackers can intercept unencrypted traffic on public networks. If you must bank on public Wi-Fi, use a VPN (virtual private network) to encrypt your connection, though a VPN is not a substitute for a strong password and 2FA.
Check your bank's security features. Some banks offer transaction alerts, which send you a text or email every time money leaves your account. This lets you spot fraud within minutes instead of days. Enable these if your bank offers them.
Consider using a separate checking account for online bill payments and transfers, keeping most of your money in a savings account. This limits the damage if your checking account is compromised.
Frequently Asked Questions
How long does it take to get my money back?
Your bank usually issues a provisional credit within 10 business days. The investigation takes 30 to 45 days, after which the credit becomes permanent. If your bank denies the refund, you can dispute it with the CFPB, which can take several weeks.
What if the hacker transferred money to another bank account?
ACH transfers can sometimes be reversed if you report them within 60 days. Your bank will contact the receiving bank and ask them to return the funds. If the receiving bank refuses or the account has already been closed, recovery becomes much harder. Report it immediately to maximize your chances.
Do I need to file a police report?
No, but you can. Police reports are rarely investigated for small amounts of fraud, but filing one creates an official record that may help if you need to dispute charges later. The FTC report is usually sufficient for your bank and creditors.
Can I be held responsible for charges made after I reported the fraud?
No. Once you report fraud to your bank, you are not liable for any charges made after that point, even if they occur before your account is fully frozen. Your bank's fraud line creates a timestamp of when you reported it.
Should I close my checking account after this?
Wait until the investigation is complete and all refunds have been processed. Closing the account early can interrupt the refund process. Once everything is resolved, you can close it if you want, but many people keep it open and simply monitor it closely for several months.