How to Keep Your Bank Account Safe From Fraud

To keep your bank account safe from fraud, turn on multi-factor authentication, set low-dollar transaction alerts, and review your statements every month, because federal law caps your personal liability for unauthorized debit card transactions at $50 only if you report the fraud within two business days.¹ Wait longer and that protection erodes fast. The difference between a $50 loss and losing everything in the account often comes down to how quickly you notice and how quickly you call.

Lock Down Your Login

Multi-factor authentication is the single most effective barrier between a thief and your account. It requires a second form of verification after your password, usually a time-sensitive code sent to your phone, a code generated by an authenticator app, or a tap on a physical security key.² Even if someone steals your password, they can’t get in without that second factor. Most banks bury this setting in the security or privacy menu of the mobile app or online portal. If you haven’t turned it on, do it now.

Not all second factors are equally secure. SMS text codes are the most common but are vulnerable to SIM swapping, where a scammer convinces your mobile carrier to transfer your phone number to a device they control. Once they have your number, every text code goes to them. Authenticator apps generate codes on the device itself, cutting out the phone network. Hardware security keys and passkeys built on the FIDO2 standard are the strongest option because they can’t be phished or intercepted.³ If your bank offers an authenticator app or passkey login, choose that over SMS.

Biometric login through fingerprint or facial recognition adds another layer on your phone. These systems convert your physical traits into encrypted data stored on the device itself, not on the bank’s servers, so a breach of the bank’s database doesn’t expose your biometric data.

Strong passwords still matter as the first factor. Avoid anything tied to your personal life like birthdays, pet names, or addresses. A password manager generates long, random strings and stores them in an encrypted vault. It also auto-fills credentials, which protects against a subtle risk: if you land on a fake site designed to look like your bank, the password manager won’t fill in your details because the URL won’t match.

Set Transaction Alerts, and Set Them Low

Most banks let you configure push notifications, texts, or emails for specific account events: any withdrawal over a dollar amount you set, purchases in a new city, login attempts from unfamiliar devices, or transfers above a threshold. Set the dollar threshold low. A thief testing a stolen card number often starts with a small purchase to see if it goes through.

When an alert flags something you didn’t authorize, speed is everything. Call your bank’s fraud department using the number printed on the back of your debit card, not a number from any text or email you received. Many banks now include a one-tap option in the alert itself to confirm or deny the transaction, which can trigger an automatic freeze on the account within seconds.

Know the Reporting Deadlines That Control Your Losses

The timeline for reporting an unauthorized debit card transaction directly controls how much money you can lose. Under Regulation E, which implements the Electronic Fund Transfer Act, consumer liability works on a sliding scale tied to how quickly you notify your bank:¹

Within 2 business days: your liability caps at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
After 2 business days but within 60 days: liability can climb to $500.
After 60 days from your statement date: you could be on the hook for the full amount of any unauthorized transfers that occurred after that 60-day window, with no cap at all.

The 60-day clock starts when your bank sends the first statement showing the unauthorized transaction, not when you notice it. That’s why reviewing statements every month matters even if you have alerts on. A small fraudulent charge buried in a long statement can go unnoticed, and ignoring statements for two months can cost you every dollar in the account.

Credit Cards Offer Stronger Protection Than Debit Cards

If you use a credit card instead of a debit card for purchases, your maximum liability for unauthorized charges is $50 regardless of when you report it, as long as the card issuer has met basic notification requirements.⁴ There’s no escalating scale and no 60-day cliff, and many issuers advertise zero-liability policies on top of that. A stolen credit card number is an inconvenience; a stolen debit card number puts your actual cash at risk. Using a credit card for everyday purchases and paying it off monthly gives you significantly better fraud protection than swiping a debit card.

Peer-to-Peer Payment Apps

Apps like Zelle and Venmo create a specific gray area. If someone gains access to your account and initiates a transfer without your permission, that’s an unauthorized transfer covered by Regulation E, and your bank must investigate and restore the funds. The CFPB has confirmed that when a scammer tricks you into handing over login credentials or a one-time code and uses those to move money, the resulting transfer is still unauthorized under the law.⁵

The harder situation is when you personally send money to a scammer, believing their story. If you opened the app and authorized the transfer yourself, most banks and app operators treat that as an authorized transaction even though you were deceived. Recovery in those cases is much harder. Never send money through a payment app to someone you don’t personally know, and treat any urgent request from a “friend” or “family member” with suspicion until you verify it through a separate channel.

Use Secure Connections

Public Wi-Fi in coffee shops, airports, and hotels is essentially an open channel. Without encryption, anyone on the same network can intercept the data flowing between your device and the bank’s server. Attackers also set up fake networks with names that mimic legitimate ones. If you need to check your bank account away from home, your phone’s cellular connection is far more secure because the data travels through your carrier’s encrypted network rather than a shared public one.

When cellular isn’t an option, a Virtual Private Network encrypts everything leaving your device and routes it through a secure server. For your home network, make sure your router uses WPA3 encryption, the current standard. Older protocols like WPA2 have known vulnerabilities.

Keep your phone’s operating system and your banking app updated. Security patches close vulnerabilities that hackers are actively exploiting, and running an outdated version means those holes stay open. Turn on automatic updates.

Protect Your Cards, ATMs, and Checks

ATM and Card Reader Safety

Criminals attach skimming devices over ATM card slots to read magnetic stripe data, and thinner “shimmer” devices that slide inside the reader to intercept chip information. Before inserting your card, give the card slot a firm tug. If it moves, feels loose, or looks misaligned compared to the rest of the machine, walk away and use a different ATM. Look also for anything covering the keypad or a pinhole camera aimed at it.

Contactless payments and mobile wallets are safer for in-person transactions because they transmit a one-time encrypted token instead of your actual card number. A skimmer can’t do anything useful with a token that expires after a single use. When you do use a physical keypad, shield your PIN entry with your other hand. That simple habit defeats the hidden cameras that work in tandem with skimming hardware.

Lock Your Card Remotely

Most banking apps now include a card lock feature that lets you freeze your debit card instantly if you can’t find it or suspect it’s been compromised. A locked card blocks new purchases and ATM withdrawals, though recurring charges and previously authorized transactions may still process. If the card turns up in your coat pocket, you can unlock it just as quickly. If it’s genuinely lost or stolen, call the bank to report it and request a replacement, which permanently deactivates the old card number.

Check Washing

Check washing is a low-tech fraud where thieves steal mail containing checks, use chemicals to erase the payee and dollar amount, and rewrite them. The U.S. Postal Inspection Service recommends depositing outgoing mail in collection boxes before the last scheduled pickup and never leaving mail in your mailbox overnight.⁶ If you still write checks, mailing them from inside a post office is safer than using a curbside mailbox. Better yet, use your bank’s online bill pay to keep paper checks out of the mail system.

Recognize the Scams That Target Your Codes

Phishing emails, smishing texts, and vishing phone calls all work the same way: a scammer impersonates your bank and creates urgency. The message claims your account is locked, a suspicious purchase needs verification, or your information needs updating immediately. A link takes you to a convincing replica of your bank’s website, where anything you enter goes straight to the scammer.

Voice calls add social pressure that emails can’t. A caller claiming to be from your bank’s fraud department might ask you to “confirm” the one-time code that just arrived on your phone. That code is the second factor of your authentication, and handing it over gives the caller full access to your account. Legitimate banks already have the tools to verify your identity internally. They will never call you and ask for your full password, your one-time passcode, or your PIN. Any request for those is a scam.

The safest response to any unsolicited contact claiming to be your bank is to hang up and call the number on the back of your debit card. Don’t use any number provided in the suspicious message. If it really was your bank, calling back through official channels will connect you to the same fraud team.

Recovery Scams

People who have already been victimized are prime targets for a second round. Recovery scammers buy lists of fraud victims and contact them claiming to be attorneys, government officials, or asset recovery firms who can get the stolen money back. The catch is always an upfront fee: a “retainer,” a “donation,” or “overdue taxes” that need to be paid before the recovery process can start.⁷ After the first payment, requests for more follow. If someone contacts you unsolicited about recovering lost funds, verify their identity by calling the agency they claim to represent using a number from that agency’s official website.

What to Do After Fraud Happens

When you spot an unauthorized transaction, the order in which you act matters.

Contact your bank immediately. Call the fraud department using the number on your card or statement. Ask them to freeze the compromised account or card. Request written confirmation of the date and time you reported the fraud, since your liability under Regulation E depends on this timeline.¹
File an identity theft report with the FTC at IdentityTheft.gov or 1-877-438-4338. The site generates an Identity Theft Report and a personalized recovery plan. If you create an account, it tracks your progress and pre-fills dispute letters. If you don’t, print everything before leaving the page because you won’t be able to access it again.⁸
File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, the federal hub for reporting cyber-enabled fraud. Complaints are reviewed and may be referred to federal, state, or local law enforcement.⁹
Place a fraud alert. Contact one of the three major credit bureaus (Experian, TransUnion, or Equifax) and the alert will be shared with the others. An initial fraud alert lasts one year and requires creditors to take extra steps to verify your identity before opening new accounts. An extended alert, available to confirmed identity theft victims, lasts seven years.¹⁰
Consider a security freeze, which is stronger than an alert. It blocks credit bureaus from releasing your credit report to anyone, preventing new accounts from being opened in your name. Federal law requires bureaus to place a freeze within one business day of an online or phone request, free of charge, and it stays in place until you remove it.¹⁰
Freeze your ChexSystems file. Credit freezes don’t protect against someone opening a new bank account in your name. Banks use ChexSystems to screen new account applicants, and you can freeze your ChexSystems file separately through the consumer portal at chexsystems.com or by mail.¹¹

A credit freeze and a ChexSystems freeze together cover both credit applications and new bank account openings, which closes the two main doors an identity thief uses to exploit stolen information.

A Note for Business Accounts

Regulation E’s consumer liability protections generally don’t apply to business bank accounts. Commercial electronic transfers are governed by UCC Article 4A, which shifts the liability question to whether the bank followed “commercially reasonable” security procedures. If the bank offered multi-factor authentication and the business declined it, the business can bear the loss from an unauthorized wire transfer.

The practical defense is dual control: requiring two people within the organization to approve any outgoing payment. One employee initiates the transfer, and a second with separate credentials reviews and approves it before the bank processes it. Before approving, the second person should verify payment instructions through a known contact number for the vendor, not a number from the email requesting the payment. Business email compromise scams, where a hacker impersonates a vendor or executive to redirect a wire transfer, are among the most expensive fraud types, and dual control is the most effective countermeasure.

1
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
2
CISA. A How-To Guide for Multi-Factor Authentication
3
ISACA. Passwordless Authentication: Risk, Reward, and Readiness
4
eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
5
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
6
United States Postal Inspection Service. Check Washing
7
CFTC. Don’t Be Re-Victimized by Recovery Frauds
8
IdentityTheft.gov. Steps to Take After Identifying Fraud
9
FBI. Internet Crime Complaint Center (IC3)
10
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
11
ChexSystems. Place a Security Freeze