How to Protect Your Bank Account From Identity Theft

To protect your bank account from identity theft, layer your defenses: turn on multi-factor authentication, guard your phone number against SIM swap attacks, use unique passwords, and set real-time transaction alerts so you catch unauthorized activity within hours instead of weeks. That speed matters because federal law caps your liability at $50 if you report unauthorized electronic transfers within two business days, but the ceiling rises to $500 after that, and can become unlimited if you miss the 60-day window after your bank sends a statement showing the fraud.

Turn On Multi-Factor Authentication and Biometric Login

Multi-factor authentication adds a verification step beyond your password. After you enter your password, the bank sends a temporary code by text message or through an authentication app, and you have to enter that code to finish logging in. A thief who steals your password still cannot get in without also controlling your phone or authentication device.

Biometric login uses a physical characteristic — your fingerprint, face, or voice — to verify identity. Most banking apps support fingerprint scanning or facial recognition, and enabling these features means a remote attacker cannot log in even with your password in hand.

Authentication apps such as Google Authenticator, Microsoft Authenticator, or Authy are generally more secure than text-message codes, because they are not vulnerable to phone number hijacking.

Protect Your Phone Number From SIM Swap Attacks

A SIM swap happens when a criminal contacts your mobile carrier, impersonates you, and convinces the carrier to move your phone number to a new SIM card. Once they control your number, they receive the verification codes your bank sends by text and can reset your passwords.

Two steps cut this risk sharply. First, call your mobile provider and ask to add a PIN or passcode that has to be verified before any changes to your account, including number transfers. Verizon, T-Mobile, and AT&T all offer this. Second, enable a port-out lock, which blocks your number from moving to another carrier until you remove the lock yourself. Most carriers let you activate it through the website, the app, or customer service.

Check in with your carrier now and then to confirm these protections are still active. If your phone suddenly loses service for no obvious reason, contact the carrier immediately. An unexpected loss of signal is one of the earliest signs of a SIM swap in progress.

Use Unique Passwords, Avoid Public Wi-Fi, and Recognize Phishing

Reusing passwords is one of the most common ways bank accounts get compromised. When a breach on a less-secure site exposes your login, attackers try the same credentials on banking portals. Use a different, complex passphrase for every financial account. A password manager generates and stores unique credentials so you only have to remember one master password.

Public Wi-Fi at a coffee shop, airport, or hotel runs over a shared network that others can monitor. A virtual private network encrypts the connection between your device and the internet, making it much harder for anyone on the same network to intercept your login information.

Phishing messages remain one of the most effective tools thieves use to steal bank credentials. They mimic your bank’s branding and typically create urgency: your account has been locked, a suspicious charge was detected, you need to verify your information. Legitimate banks do not ask for passwords, PINs, or full account numbers by email or text. If you are unsure, open a new browser window and go directly to your bank’s site instead of clicking any link in the message.

Set Real-Time Transaction Alerts

Most banking apps let you configure instant notifications for account activity: purchases, withdrawals, transfers, balance changes. Set your dollar threshold low — an alert on any transaction over $1 will tell you within seconds if something unauthorized posts. How fast you learn about a fraudulent transaction directly determines how much liability you face under federal law, which makes these alerts one of the most valuable protections available.

Review your monthly statements even with alerts on. Some fraudulent charges start small, a dollar or two, specifically to test whether the account is being watched before larger withdrawals follow. Federal law gives you 60 days from the date your bank sends a statement to report unauthorized transactions shown on that statement, and missing that window can expose you to unlimited losses on any transfers that follow.

Federal Liability Limits for Unauthorized Bank Transactions

The Electronic Fund Transfer Act and its implementing rule, Regulation E, set a tiered structure for your liability when someone makes unauthorized electronic transfers from your account. The tier depends on how quickly you report:

Report within two business days of learning about the loss or theft, and your maximum liability is $50, or the amount of the unauthorized transfers made before you told the bank, whichever is less.¹
Report between two and 60 days, and your liability can rise to $500 for unauthorized transfers that happened after the two-day window closed but before you notified the bank.¹
Report more than 60 days after your bank sends a statement showing the unauthorized transfer, and you face unlimited liability for any unauthorized transfers that occur after the 60-day period ends, until you finally notify the bank.²

The 60-day rule catches most people off guard. If fraudulent transactions appear on your June statement and you do not review it or report the problem until September, your bank is not required to reimburse you for unauthorized transfers that happened after the 60-day deadline passed.³ If a delay was caused by extenuating circumstances such as extended travel or hospitalization, the bank must extend these deadlines to a reasonable period.¹

Why Credit Cards Beat Debit Cards for Everyday Spending

If fraud hits a credit card instead of a debit card, your maximum liability is $50, full stop. No escalating tiers, no 60-day trapdoor. Once you report the unauthorized use, you cannot be held liable for any charges after that point.⁴

The practical difference matters too. Unauthorized debit card transactions pull money straight out of your checking account, which can trigger bounced payments and overdraft fees while you wait for the investigation to conclude. Unauthorized credit card charges show up as a balance on a statement, and the money never leaves your bank account. Where you have the choice, use a credit card for everyday purchases and keep the debit card for ATM withdrawals.

What to Do the Moment You Spot Fraud

Speed is the single biggest factor in limiting your losses. If you see an unauthorized transaction or suspect someone has accessed your account, work through these steps in order:

Call your bank’s fraud department using the number on the back of your debit card or on the bank’s official website. Ask that the compromised card or account be frozen. Note the representative’s name, the date, and any reference number.
File an Identity Theft Report with the Federal Trade Commission at IdentityTheft.gov. The FTC will generate a report and a personalized recovery plan based on your situation. You’ll need your contact information and details about how the theft occurred.⁵
File a police report. It is not always required to get your money back, but it strengthens your case, and some businesses require one before releasing transaction records related to identity theft under federal law.⁶
Send written notice to your bank by certified mail with return receipt, following up your phone call. Include the transaction dates, amounts, and IDs for every unauthorized charge. This creates a verifiable record and prevents the bank from later claiming it never received your report.

Gather documentation before you call: the date, dollar amount, and transaction ID for each unauthorized charge, plus the last time you had a stolen or missing card in your possession. An organized timeline speeds up the dispute.

How Your Bank Must Investigate

Once your bank receives notice of an error or unauthorized transaction, federal rules impose strict deadlines. The bank must complete its investigation and report results to you within 10 business days. If it cannot finish in that window, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount (minus up to $50) within those initial 10 business days. The bank must tell you about the provisional credit within two business days of posting it and give you full use of the funds while the investigation continues.⁷

The 45-day deadline stretches to 90 days in three situations: the disputed transaction was a point-of-sale debit card purchase, the transaction originated outside the United States, or your account had been open for fewer than 30 days when the transfer occurred.⁷

If the bank decides no error occurred, it must report the result to you within three business days and explain its reasoning. If it reverses a provisional credit, it must give you at least five business days’ notice before debiting the funds back and provide a written explanation. If the bank does not reverse the provisional credit within the applicable investigation period, that credit becomes permanent.

If Your Bank Denies the Claim

When a bank denies your fraud claim, you have the right to request copies of the documents it relied on during the investigation. The bank must provide them promptly.⁷ Read them carefully. Wrong dates, mismatched transaction details, or a failure to consider evidence you submitted can all form the basis for an appeal.

If you believe the decision is wrong, file a complaint with the Consumer Financial Protection Bureau. You can submit online at consumerfinance.gov/complaint, which takes roughly 10 minutes, or by phone at (855) 411-2372. The CFPB forwards your complaint to the bank, which generally responds within 15 days. In more complex cases the bank may take up to 60 days to provide a final response. You then have 60 days to review that response and provide feedback.⁸

Freeze Your Credit to Block New Accounts in Your Name

Identity thieves who get hold of your personal information often do more than drain existing accounts. They open new credit cards, loans, or bank accounts in your name. A credit freeze, sometimes called a security freeze, tells credit reporting agencies not to release your credit report to new creditors, which blocks anyone from opening accounts using your identity.

Federal law requires each of the three major credit bureaus — Equifax, Experian, and TransUnion — to place and remove freezes free of charge. Request a freeze by phone or online and the bureau must place it within one business day. By mail, the bureau has three business days. Removing a freeze when you need to apply for credit yourself is also free and must happen within one hour of an online or phone request.⁹

Identity theft victims who have filed an FTC Identity Theft Report or a police report can also place an extended fraud alert that lasts seven years. It requires creditors to take extra steps to verify your identity before issuing credit and removes you from marketing lists for unsolicited credit and insurance offers for five years.¹⁰

You can also ask the credit bureaus to block any fraudulent accounts or debts from appearing on your credit report. After receiving your identity theft report and identification of the fraudulent information, each bureau must block the reporting of that information within four business days.¹¹

1
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
2
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
3
Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
4
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
5
Federal Trade Commission. IdentityTheft.gov
6
Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft
7
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
8
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
9
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
10
Federal Trade Commission. Credit Freezes and Fraud Alerts
11
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft