How to Protect Your Bank Account From Fraud: Steps and Liability

To protect your bank account from fraud, stack defenses that don’t rely on any single point of failure: use multi-factor authentication (preferably app-based), lock your phone number with your carrier, turn on real-time transaction alerts, keep banking off public Wi-Fi, and use a credit card instead of a debit card whenever you can. If something does slip through, federal law caps your liability at $50 for unauthorized debit transactions, but only if you report within two business days of learning about the loss. Wait longer and the ceiling climbs fast.

Turn On Multi-Factor Authentication

A password by itself is a broken lock. Breaches leak millions of credentials every year, and if yours is in a dump, a thief can walk in. Multi-factor authentication adds a second check after your password: a code by text, a push notification from your bank’s app, or a code from a standalone authenticator app like Google Authenticator or Authy.

Authenticator apps beat text-message codes because they aren’t vulnerable to SIM-swap attacks. If your bank offers app-based codes, pick those over SMS. Biometric verification through fingerprint or facial recognition ties the login to your phone’s hardware and adds another layer. Turn on every authentication option your bank offers.

Lock Down Your Phone Number

SIM-swapping is when a fraudster convinces your mobile carrier to move your phone number to a device they control. Once they have your number, every verification text your bank sends goes to them. It’s one of the fastest-growing fraud methods and the main reason app-based authentication matters.

The FCC finalized rules in late 2023 requiring wireless carriers to verify a customer’s identity through secure authentication before processing a SIM change or number transfer, and to notify the customer immediately when such a request is made.¹ Do your part too:

Set a port-out PIN or password with your carrier. Every major carrier offers this. Without the PIN, no one can transfer your number.
Add a separate account PIN. This blocks changes made in-store or over the phone.
Check periodically that port-out protection is still active, especially after any account changes.

Set Real-Time Account Alerts

Most banks let you configure alerts for logins from unfamiliar devices, transactions above a dollar amount you choose, changes to your contact information, and international purchases. They arrive by push notification, email, or text. Speed matters here because your liability for unauthorized debit transactions is measured from the moment you could have known.

Some banks also let you place automatic holds on transactions above a threshold until you confirm them. If yours offers that, turn it on for any amount large enough to hurt. Confirming a legitimate purchase is a small tax to pay to keep a thief from clearing your balance in one transfer.

Recognize Phishing, Smishing, and Spoofing

Phishing emails mimic your bank’s branding and warn about a frozen account or suspicious activity to get you to click. The link leads to a fake login page that captures your credentials in real time. Smishing does the same by text. Both rely on panic to short-circuit judgment.

Caller ID spoofing is harder to spot. A fraudster manipulates the phone network so your screen shows your bank’s real customer service number, then uses urgency to pull one-time passcodes or account details out of you. Your bank will never call and ask for a verification code. If someone does, hang up and dial the number on the back of your card.

The common thread: the attacker needs you to hand something over. No legitimate bank employee will ask you to share a verification code, move money to a “safe” account, or click a link in an urgent text. Treat every inbound request for account details as fraudulent until you’ve verified it through a channel you chose.

Protect Checks From Washing

Check washing is low-tech but effective. A thief steals a check from your mailbox, dissolves the ink with chemicals, and rewrites it for a larger amount. The U.S. Postal Inspection Service recommends depositing outgoing mail in collection boxes before the last scheduled pickup, never leaving mail in your box overnight, and holding your mail at the post office when you travel.² Gel pens with pigment-based ink resist chemical removal because the ink bonds with paper fibers. A locking mailbox is worth it if you still write checks regularly.

Secure Your Network and Devices

Where you bank matters almost as much as how you authenticate. A home network running WPA3 encryption shields your traffic. Public Wi-Fi at a coffee shop or airport does not, and an attacker on the same network can intercept data between your device and the bank.

A virtual private network encrypts your traffic and makes intercepted data unreadable. Use one if you ever need to bank on public Wi-Fi. Confirm your browser shows HTTPS before entering credentials. Keep your banking app and operating system updated; those patches close holes attackers are actively using.

Use a Credit Card Instead of a Debit Card

The two are treated under entirely different federal statutes, and the gap is wide.

Credit card fraud falls under the Truth in Lending Act. Your maximum liability for unauthorized charges is $50, with no escalating tiers.³ Most issuers layer zero-liability policies on top. The money at risk belongs to the card issuer, so a disputed charge doesn’t drain your checking account while things get sorted out.

Debit card fraud falls under the Electronic Fund Transfer Act and Regulation E, and your liability climbs with delay:⁴

Report within 2 business days of learning of the loss: liability caps at $50.
Report after 2 business days but within 60 days of your statement: liability can reach $500.
Report after 60 days: potentially unlimited liability for transfers that occur after that 60-day window.

When a thief uses your debit card, the money leaves your account. You may get it back, but you’re short in the meantime. With a credit card, you dispute a line on a bill. Use credit for everyday purchases when you can.

Be Careful With Zelle, Venmo, and Cash App

Peer-to-peer services create a gray zone. Under Regulation E, an “unauthorized electronic fund transfer” is one initiated by someone other than the account holder without permission.⁵ That covers a thief who hacks your account or tricks you into handing over your login and then moves money themselves.

The harder case is when a scammer talks you into sending the money yourself, often by posing as your bank and telling you to “transfer funds to a safe account.” Because you pushed the button, many banks argue that transfer falls outside Regulation E. The CFPB has pushed back on that reading in enforcement actions against banks operating Zelle, but the law here is contested. Assume money you voluntarily send through a P2P app may be unrecoverable. Treat it like handing someone cash.

How to Report Fraud to Your Bank

Speed is everything. Your liability starts climbing the moment you could reasonably have discovered the fraud, so check your accounts regularly and act the same day something looks wrong.

Before you call, gather what the fraud department will need:

The exact date, merchant name, and dollar amount of each suspicious charge.
Transaction IDs or reference numbers from your banking app, which let the fraud team pull the exact ledger entry.
When you first noticed the activity and whether your card or credentials were lost, stolen, or otherwise compromised.

Call the number on the back of your card or on your bank’s official website. Oral notice is enough to start the process; you don’t need a written letter. If the bank asks you to follow up in writing within 10 business days, do it. Failing to confirm in writing can give the bank grounds to withdraw any provisional credit it issues.

A bank cannot refuse to investigate until you file a police report. The CFPB has made clear that a financial institution may not delay starting or completing an error resolution investigation while waiting for a police report or other documentation from you.⁶ If a representative tells you otherwise, they’re wrong.

Your Liability Under Federal Law

Regulation E sets the tiers for unauthorized debit transactions, and they’re worth repeating:⁴

Within 2 business days of learning of the loss: maximum $50 liability.
Between 2 and 60 days after your statement is sent: maximum $500 liability.
After 60 days: potentially unlimited. Every dollar taken after that 60-day mark can be on you.

The 60-day clock starts when the bank sends or makes available the statement showing the unauthorized transfer, not when you open it. Ignore statements for three months while a thief siphons funds, and you bear the loss for everything after day 60.

What the Bank Must Do After You File

Once the bank receives your notice, it must investigate and reach a determination within 10 business days. If it needs more time, it can extend the investigation to 45 calendar days, but only if it provisionally credits your account within those first 10 business days. That provisional credit covers the full disputed amount (minus up to $50 if the bank has a reasonable basis to believe an unauthorized transfer occurred), and you get full use of the funds while it investigates.⁷

Two things extend those windows. Accounts open fewer than 30 days get 20 business days for the initial review instead of 10. Disputes involving transfers initiated outside the country or point-of-sale transactions stretch the extended investigation window from 45 to 90 days.⁷ The bank will usually close the compromised account, issue a new card and account number, and reset your online credentials while it works.

If the Bank Denies Your Claim

Denials happen more often than people expect, sometimes on thin reasoning. If your claim is denied, the bank must send a written explanation of its findings and tell you that you can request the documents it relied on. Ask for them. The investigation file sometimes shows the bank barely looked.⁷

If the bank extended provisional credit and then denies the claim, it can reverse that credit after giving you at least five business days’ notice. From there:

You can reassert the error, as long as you’re still within the original 60-day reporting window from when the statement was sent.
You can file a complaint with the CFPB. A CFPB complaint often gets a faster and more thorough response than another call to the bank.
You can consult an attorney. The EFTA provides for actual damages, statutory damages, and attorney’s fees when a bank violates the law.

Credit Freezes, Fraud Alerts, and Identity Theft Reports

Reporting to your bank protects the compromised account. These steps protect everything else.

Credit Freezes

A credit freeze blocks anyone, including you, from opening new credit in your name until you lift it. Placing and removing a freeze is free, and the bureaus must act within one business day for electronic or phone requests.⁸ Freeze your file at all three bureaus: Equifax, Experian, and TransUnion. A freeze stays in place until you remove it and does not affect your credit score.

Fraud Alerts

A fraud alert tells creditors to take extra steps to verify your identity before issuing credit. An initial alert lasts one year. An extended alert, available to confirmed identity theft victims who file an FTC or police report, lasts seven years.⁸ You only need to contact one bureau; it’s required to notify the other two.⁹

A freeze is stronger than an alert. An alert asks creditors to verify you; a freeze blocks access to your file. If your bank account was compromised, a freeze is the better call unless you’re actively applying for credit.

FTC and Police Reports

If the fraud involves stolen personal information rather than a single unauthorized charge, file an identity theft report at IdentityTheft.gov. The FTC will generate an Identity Theft Affidavit that serves as your official record. Print and save it right away, because you won’t be able to retrieve it later. Then bring the affidavit, a government-issued photo ID, and proof of address to your local police department to file a report. Together they form your Identity Theft Report, which unlocks additional protections like the seven-year extended fraud alert.¹⁰

Business Accounts Do Not Get These Protections

If the account is in a business’s name, the rules above mostly don’t apply. The Electronic Fund Transfer Act and Regulation E generally cover only consumer accounts. Business accounts fall under the Uniform Commercial Code, where the protections are weaker.

Under UCC Article 4, a business must discover and report an unauthorized signature or alteration within one year of the statement being made available. A tighter deadline sits inside that rule: if the same fraudster strikes again, the business loses the right to dispute any subsequent forged items paid by the bank more than 30 days after the first compromised statement was available.¹¹ Sit on the first bad statement and every fraudulent check that follows can be your loss. For electronic transfers, UCC Article 4A generally shifts the risk of loss to the business when the bank verified the payment order using a commercially reasonable security procedure. Reconcile business accounts daily, and ask your bank what security procedures apply to your wires and ACH payments.

1
Federal Register. Protecting Consumers from SIM-Swap and Port-Out Fraud
2
United States Postal Inspection Service. Check Washing
3
Office of the Law Revision Counsel. 15 U.S.C. 1643 – Liability of Holder of Credit Card
4
Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
5
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
6
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
7
Consumer Financial Protection Bureau. Procedures for Resolving Errors
8
Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Consumer Advice. Credit Freezes and Fraud Alerts
10
Federal Trade Commission. IdentityTheft.gov Recovery Checklist
11
Legal Information Institute. U.C.C. 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration