Preventing bank fraud comes down to a handful of habits that block the common attacks and a few federal deadlines that decide whether you get your money back when something slips through. The steps that matter most: use a credit card instead of a debit card where you can, secure your logins and your phone number, watch your accounts closely enough to report anything wrong within days, and freeze your credit so stolen information can’t be used to open new accounts in your name.
Credit Cards vs. Debit Cards: The Choice That Shapes Everything Else
Before anything technical, understand how the law treats the two cards in your wallet differently. It should change which one you reach for.
On a credit card, your maximum liability for unauthorized charges is $50, and that cap applies regardless of when you report the fraud, so long as you report it after discovering it.1GovInfo. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers voluntarily waive even that $50. The money at risk is the issuer’s, not yours, so you avoid the cash-flow hit of watching your checking balance disappear while the bank investigates.
A debit card is a different story. Under the Electronic Fund Transfer Act, your liability depends entirely on how fast you report:2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning about the fraud: liability capped at $50.
- Report after 2 business days but within 60 days of the statement being sent: liability rises to $500.
- Report after 60 days from the statement date: unlimited liability. You can lose everything taken from the account.
Even when the bank eventually reimburses you, money already withdrawn from checking is gone during the investigation, which can trigger bounced payments and overdraft fees.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The practical rule: pay with a credit card for everyday purchases when you can, and open your bank statements within days of receiving them, not weeks.
Lock Down Your Online Access
Most unauthorized account access exploits weak or reused passwords, intercepted verification codes, or outdated software. A few settings changes close the common doors.
Unique Passwords and Multi-Factor Authentication
Use a unique, complex password for every financial account. Reusing the same password means a single breach at any company exposes every bank login you have. A password manager generates and stores strong passwords so you don’t have to remember them.
Turn on multi-factor authentication wherever it’s offered. This adds a second check — typically a one-time code from an authenticator app or a fingerprint or facial scan — before granting access. If your bank supports passkeys, they’re stronger still: passkeys replace passwords with cryptographic keys tied to your device, so there’s nothing for a phishing site to capture and nothing to reuse across fake pages.
Protect Your Phone Number from SIM Swapping
A SIM swap is when a criminal convinces your wireless carrier to move your phone number to a device they control. Once they have your number, they receive any text-message verification codes your bank sends. FCC rules now require wireless carriers to verify your identity using secure authentication methods before processing a SIM change or a port to a new carrier.4Federal Register. Protecting Consumers from SIM-Swap and Port-Out Fraud Call your carrier and set a PIN or passcode on the account. Ask them to place a port-out lock on your number, which blocks transfer requests until you remove it.
Networks and Updates
Access financial accounts only on private, password-protected networks. Public Wi-Fi lacks encryption, so data traveling between your device and your bank can be intercepted. Keep your banking apps and phone operating system updated. Patches close specific security holes, and an outdated app is an open door.
Spot the Scam Before You Act
Technology guards your accounts. Social engineering targets you. Phishing emails, smishing texts, and vishing phone calls all work the same way: they impersonate a trusted institution and manufacture urgency — a compromised account, a large pending transaction, an imminent lockout. Fraudsters can spoof your bank’s phone number so the caller ID looks legitimate.
Your bank will never ask for your password, PIN, or a one-time verification code through an unsolicited call, text, or email. If you receive a suspicious message, delete it or hang up without clicking anything. Then call the number on the back of your card to check whether there’s an actual problem.
Synthetic identity fraud is a growing variant. Criminals combine real information, such as a stolen Social Security number, with fabricated details to build an entirely new identity. Because there’s no direct impersonation of you, standard fraud detection has a harder time catching it.5Federal Reserve Financial Services. Fake Companies, Real Risk: The Rise in Synthetic Business Fraud Credit monitoring and credit freezes are the strongest defense because they alert you when someone uses your information to open new accounts.
Report scam attempts to the FTC at ReportFraud.ftc.gov. Reports are shared with more than 2,800 law enforcement agencies and help authorities identify patterns.6Federal Trade Commission. ReportFraud.ftc.gov
Physical Safeguards Still Matter
Plenty of bank fraud still starts with a stolen envelope, a tampered card reader, or a piece of paper pulled from the trash.
Check Washing
Check washing is when a thief steals a check from your mailbox, dissolves the ink with chemicals, and rewrites the payee and amount. The U.S. Postal Inspection Service recommends dropping outgoing mail in collection boxes before the last daily pickup rather than leaving it in your residential mailbox, retrieving delivered mail promptly, and placing a hold on your mail when traveling.7United States Postal Inspection Service. Check Washing Black gel ink resists washing better than standard ballpoint because the pigment bonds to paper fibers.
Skimmers and ATM Safety
Skimming devices sit over legitimate card readers at ATMs and gas pumps to capture your card data. Before inserting your card, check whether the reader feels loose, bulky, or different from the machine around it. Cover the keypad with your hand while entering your PIN to block hidden cameras. Carry only the cards you need for a given outing.
Shred Before You Throw Out
Shred bank statements, pre-approved credit offers, and any document with an account number. A cross-cut shredder is more effective than a strip-cut model. Criminals do go through trash.
Monitor Your Accounts So You Catch Fraud in Time
Even with strong prevention, some fraud will get through. How fast you catch it determines your legal rights and your financial exposure.
Turn on real-time transaction alerts through your bank’s app. Most banks let you customize them by any transaction, by amount, by international purchase, or by online purchase.8Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud An alert for a charge you didn’t make lets you freeze the card in minutes.
Review every statement line by line. Criminals often test an account with small charges, sometimes under a dollar, before attempting anything larger. Report anything unfamiliar right away. For debit card and electronic transfer disputes, you generally need to notify your bank within 60 days of the statement date to preserve your full rights.9Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors The same 60-day window applies to credit card billing errors, counted from the date the statement was sent.10Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution
Freeze Your Credit
A credit freeze stops new credit accounts from being opened in your name. When a freeze is in place, lenders can’t pull your credit report to approve applications, so a criminal holding your personal information still can’t open cards, loans, or other accounts.11Federal Trade Commission. Credit Freezes and Fraud Alerts Placing and lifting a freeze is free and doesn’t affect your credit score. When you need credit yourself, lift it temporarily and put it back. You have to place the freeze separately with each of the three major bureaus: Equifax, Experian, and TransUnion.
A fraud alert is a lighter tool. Instead of blocking access to your credit report, it requires businesses to take extra steps to verify your identity before issuing credit. An initial fraud alert lasts one year. Confirmed identity theft victims can place an extended alert that lasts seven years.12Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts Placing an alert at one bureau requires that bureau to notify the other two, so one request covers all three.
For most people, a freeze is the stronger protection because it blocks access entirely rather than relying on a creditor to follow a verification step. If you’re not actively applying for credit, keeping a freeze in place costs nothing.
Wire Transfers and Peer-to-Peer Payment Apps
Wire transfers and payment apps like Zelle, Venmo, and Cash App are different from card transactions in one critical way: once the money leaves your account, getting it back is extremely difficult. Wires are designed to be fast and final. If you wire money to a scammer, your bank can attempt a recall, but success depends on whether the recipient’s bank can freeze the funds before withdrawal, and criminals move money out immediately.
Payment apps sit in a legal gray area. If someone gains access to your account and sends money without your authorization, that transfer is generally covered by the Electronic Fund Transfer Act, and your bank or the app must investigate and correct the error.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability But if you personally initiate the payment, even because a scammer tricked you into sending it, the transfer is typically classified as authorized, and federal law provides far less recourse. The CFPB has brought enforcement actions against major banks over how they handled Zelle disputes, signaling that regulators expect stronger protections in this area.13Consumer Financial Protection Bureau. Early Warning Services, LLC; Bank of America, N.A.; JPMorgan Chase Bank, N.A.; Wells Fargo Bank, N.A.
Treat wires and P2P payments like handing over cash. Only send money to people and businesses you know. Never wire money or send a P2P payment in response to an unsolicited request, even if the caller claims to be from your bank or a government agency. If you believe you’ve wired money to a fraudster, contact your bank immediately to request a recall, then file a report with the FBI’s Internet Crime Complaint Center at IC3.gov.
A Note for Business Accounts
The consumer liability caps described above don’t apply to business accounts. The Electronic Fund Transfer Act and Regulation E explicitly exclude commercial transactions. Business accounts are governed instead by Uniform Commercial Code Article 4A, which places responsibility on the business to maintain “commercially reasonable” security procedures.14Legal Information Institute. UCC 4A-202 – Authorized and Verified Payment Orders If your business declines the security tools your bank offered, you could bear full liability for unauthorized transfers.
Banks offer fraud-prevention tools built specifically for commercial accounts:
- Positive Pay: you submit a file of every check you issue, and the bank rejects any check presented for payment that doesn’t match.
- ACH debit blocks: these prevent any electronic debits from posting unless they come from pre-approved sources.
- ACH debit filters: rules that allow debits from recognized partners while returning everything else.
If your bank offers these and you decline, that decision weakens your position later. The standard for a business is whether you took reasonable steps, not simply whether the transaction was unauthorized.
If Fraud Already Happened
Acting in the first 24 to 48 hours affects both your legal rights and your odds of recovering funds. IdentityTheft.gov recommends this sequence:15IdentityTheft.gov. Identity Theft: What to Do Right Away
- Contact your bank. Report the unauthorized transactions, ask the bank to freeze or close the compromised account, and change all login credentials and PINs. For debit card fraud, this call starts the clock on your liability window. Reporting within two business days caps your exposure at $50.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Place a fraud alert or credit freeze. Contact one of the three bureaus for an initial one-year fraud alert (that bureau will notify the other two), or contact all three individually to place a freeze.12Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
- Report the fraud to the FTC. File at IdentityTheft.gov or call 1-877-438-4338. The site generates a personalized recovery plan and an Identity Theft Report you can use when disputing fraudulent accounts.
- File a police report. Bring your FTC Identity Theft Report, a government-issued photo ID, and proof of address to your local police department. A police report strengthens disputes with creditors and helps credit bureaus remove fraudulent information from your file.
Pull your credit reports from all three bureaus at AnnualCreditReport.com and flag any accounts or inquiries you don’t recognize. Keep monitoring your accounts closely for several months after the initial fraud. Criminals who obtained your information once often try to use it again.