The most effective way to prevent bank fraud is to layer your defenses: turn on strong login security, get an alert for every transaction, freeze your credit files, and treat any unsolicited call, text, or email about your account as a scam until you’ve verified it through a channel you chose. Federal law caps your liability for unauthorized debit card charges at $50 if you report within two business days, which is why the alerts and the habits matter as much as the technology.
Lock Down How You Log In
Start inside your banking app’s security settings. Turn on multi-factor authentication so signing in requires your password plus a second step. An authenticator app or hardware security key is stronger than a text-message code, because SMS codes can be intercepted if a criminal convinces your phone carrier to move your number to a new SIM card.
A growing number of banks now support passkeys built on the FIDO2 standard. Passkeys use cryptographic keys tied to your specific device, so there is nothing to type, nothing to intercept, and nothing that works on a fake login page. If your bank offers passkey enrollment, take the five minutes. Biometric login through fingerprint or facial recognition adds another layer; your bank stores a mathematical representation of the scan rather than the image itself, so a data breach at the bank would not expose usable biometric data.
For passwords you still need, use a password manager to generate long, random strings. The one password you have to remember is the master password for the manager. Skip birthdates, pet names, or anything a stranger could pull off your social media.
Watch Every Transaction
Turn on real-time push notifications for every transaction on your accounts, including charges as small as a dollar. Fraudsters often test a stolen card number with a tiny charge before running up a large one, and catching that test is your best shot at stopping the damage. Most banking apps let you customize alerts by transaction type, dollar amount, and whether the purchase was in person or online.
Also compare your monthly statement against your own records at least once a month. Automated alerts miss things a human eye catches, like a subscription you canceled months ago still quietly billing. Regular review also keeps you inside the reporting deadlines that decide how much of your money the law actually protects.
Know Your Liability Deadlines
The Electronic Fund Transfer Act sets a tiered liability structure for unauthorized debit card transactions that rewards fast reporting and punishes delay. Notify your bank within two business days of learning about the fraud and your maximum liability is $50. Report between two and sixty days after your statement is sent, and the ceiling jumps to $500. Miss the sixty-day window entirely and the bank has no obligation to reimburse you for transfers that occurred after that mark.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Those deadlines are not suggestions. The difference between a two-day report and a sixty-one-day report can be the difference between losing $50 and losing your account balance.
Credit cards are protected more generously. Federal law caps your liability for unauthorized credit card charges at $50 regardless of when you report, as long as the unauthorized use occurred before you notified the issuer, and most major card issuers waive even that $50.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card This is one reason security experts recommend a credit card over a debit card for everyday purchases. When a credit card is compromised, you are disputing the issuer’s money. When a debit card is compromised, the cash is already gone from your checking account while you wait for the investigation.
Spot the Scams That Bypass Your Bank’s Security
The strongest login in the world does not help if you hand your credentials to a criminal who asked nicely. Social engineering attacks exploit trust and urgency instead of technical vulnerabilities, and they account for a large share of bank fraud losses.
Phishing Emails and Fraudulent Calls
These follow a predictable script: something is wrong with your account, you must act right now, and you need to verify your identity by providing sensitive information. The urgency is the tell. Your bank will never call you and ask for your password, one-time code, PIN, or Social Security number. If someone does, hang up and call the number printed on the back of your card.
Text Scams
Text-message scams work the same way in a shorter format. A message claiming your account is locked with a link to “verify” your identity is almost certainly fraudulent. Watch for suspicious sender numbers, misspelled URLs, and generic greetings like “Dear Customer” instead of your name. Never tap a link in an unexpected text about your bank account.
Cloned Voices
A newer variation uses artificial intelligence to clone the voice of someone you know. A caller who sounds exactly like your spouse or adult child might claim to need emergency money transferred from your account. The defense is the same: slow down, hang up, and call the person directly at a number you already have saved.
QR Code Scams
Fraudulent QR codes posted in public places or sent by email can redirect you to convincing fake bank login pages. The U.S. Postal Inspection Service warns that criminals place these codes on parking meters, restaurant tables, and package inserts, hoping you will scan without thinking.3United States Postal Inspection Service. Quishing Before scanning any QR code, ask who posted it and whether you have a reason to trust it. If a code claims to be from your bank, open your bank’s app instead.
Even scam attempts you did not fall for are worth reporting to the Federal Trade Commission at ReportFraud.ftc.gov, which feeds law enforcement pattern data.4Federal Trade Commission. ReportFraud.ftc.gov
Protect Cards, Checks, and Mail
Digital fraud gets the headlines, but physical theft of banking items still drains accounts.
At an ATM, check the card reader for loose components or overlays before you insert your card. Skimming devices sit on top of the real reader to capture card data, often paired with a tiny camera aimed at the keypad. If anything wobbles or looks off, use a different machine. Cover the keypad with your hand when entering your PIN.
If a card goes missing, use your banking app’s instant lock feature to disable it before a thief can use it. Most major banks offer this and it takes about three seconds. Keep a separate record of each card’s customer service number so you can call even if you do not have the card in front of you.
Check washing is one of the fastest-growing forms of bank fraud. Criminals steal checks from residential mailboxes, use chemicals to erase the payee and amount, and rewrite the check to themselves for a larger sum. The U.S. Postal Inspection Service recommends dropping outgoing mail in a blue collection box before the last scheduled pickup or handing it to a postal clerk inside the post office. Never leave outgoing mail in your home mailbox overnight, and pick up incoming mail promptly.5United States Postal Inspection Service. Check Washing
Better yet, use your bank’s online bill pay whenever possible. Electronic payments eliminate the physical check that makes this fraud possible. When you must write a check, store your checkbook somewhere secure rather than in a car or an unlocked drawer. Shred anything that contains account numbers, Social Security numbers, or other banking details before throwing it out. A micro-cut shredder turns paper into confetti-sized pieces that cannot be reassembled.
Secure Your Devices and Wi-Fi
Every device you use to reach your bank account is a potential entry point. Keep your phone’s operating system and your banking app updated, since those updates frequently patch security holes that criminals actively exploit. Delaying an update by a few weeks can leave you exposed to a known attack.
Public Wi-Fi in airports, hotels, and coffee shops is convenient and inherently insecure. A virtual private network encrypts your traffic so anyone watching the network sees scrambled data instead of your credentials. Without a VPN, don’t log into your bank on public Wi-Fi.
At home, make sure your router uses WPA3 encryption, the current standard for wireless networks. If your router only supports older protocols, consider replacing it. Run antivirus scans on any computer you use for banking, and set your mobile devices to erase data automatically after a set number of failed passcode attempts in case the phone is stolen. Avoid apps from unofficial sources on devices where you bank; malware disguised as free software can log your keystrokes or record your screen while you type your password.
Freeze Your Credit and Your ChexSystems File
A credit freeze is one of the most effective tools for stopping criminals from opening new accounts in your name, and federal law requires all three major credit bureaus to let you place and lift a freeze for free.6Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention, Fraud Alerts and Active Duty Alerts While a freeze is active, lenders who pull your credit report get a notification that access is blocked, which stops most fraudulent loan and credit card applications.
You have to freeze your file separately at Equifax, Experian, and TransUnion. Each bureau must place the freeze within one business day of a phone or online request. When you legitimately need to apply for credit, you can temporarily lift the freeze for a specific window at no cost, and the lift takes effect within one hour of an electronic request.7Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report
Most people stop there, but criminals can also open fraudulent checking and savings accounts in your name. ChexSystems is the consumer reporting agency most banks check before opening a deposit account. You can place a security freeze with ChexSystems too, which blocks new bank accounts from being approved in your name without your consent.8ChexSystems. Security Freeze Information This is an often-overlooked step that closes a real gap.
Know the Gaps: P2P Apps and Business Accounts
Peer-to-peer payment apps like Zelle and Venmo have created a fraud problem that existing law was not designed to handle. When someone steals your debit card and makes purchases, that is an unauthorized transfer and federal law protects you. When a scammer tricks you into sending money yourself, by posing as your bank or pretending to be a relative in trouble, the transfer was technically authorized by you even though you were deceived. Federal consumer protection for electronic transfers was written around unauthorized access, not authorized-but-manipulated payments. If you voluntarily initiated the transfer, even under false pretenses, your bank may have no legal obligation to reimburse you.
Treat P2P payments like cash. Only send money to people you know and trust, verify unusual requests through a separate channel before sending, and never use a payment app in response to an unsolicited message or call. If someone claiming to be from your bank asks you to “move your money to a safe account” through Zelle, it is always a scam.
Business accounts also sit outside most of the protections described above. The Electronic Fund Transfer Act covers consumer transactions; business-to-business transfers fall under the Uniform Commercial Code’s Article 4A, which lets banks shift liability through contract terms and generally puts more responsibility on the account holder. If you run business payments through a designated business account, the consumer liability caps may not apply. Ask your bank specifically what fraud protections your account has, and read the account agreement.
If Fraud Already Happened
Speed matters more than anything else once you find unauthorized activity. Every day of delay can move you into a worse liability tier. Work the following sequence:
- Call your bank’s fraud department using the number on the back of your card or on the bank’s official website. Ask them to freeze the compromised account and issue new account or card numbers. Write down a case number and the name of the person you spoke with.
- File a police report. Many banks require one to process a fraud claim, and even when they don’t, the report creates an official record.
- Send your bank a written notice of error to follow up your phone call. Under federal regulations the bank must begin investigating within ten business days of receiving your notice.
- Report identity theft at IdentityTheft.gov. The FTC’s portal generates a recovery plan, pre-fills dispute letters, and creates an official FTC Identity Theft Report you may need when disputing fraudulent accounts.
- Freeze your credit at all three bureaus and at ChexSystems if the fraud suggests your personal information has been compromised beyond a single card number.
- Change your passwords for your banking app, your email (password resets flow through email), and any other account that shared the same credentials.
Document as you go. Save confirmation numbers, screenshots of fraudulent transactions, and notes from every call. You will need that paper trail if the dispute escalates.
Once you report an unauthorized electronic transfer, the bank has to act on a schedule. It must investigate and resolve the error within ten business days of receiving your notice. If it needs more time, it can extend the investigation to forty-five days, but only if it provisionally credits your account for the disputed amount within those first ten business days.9eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The bank must notify you within two business days of issuing the provisional credit and give you full use of the funds during the investigation. If it concludes no error occurred, it can reverse the credit, but it has to explain its findings and provide copies of the documents it relied on.
If your bank stalls or denies your claim without a proper investigation, file a complaint with the Consumer Financial Protection Bureau. The CFPB forwards complaints to the bank and expects a response within fifteen calendar days, and it analyzes complaint patterns to identify institutions that are systematically failing customers.10Consumer Financial Protection Bureau. Consumer Complaint Program