What Happens If Your Bank Account Gets Hacked: Liability and Claims

If your bank account gets hacked, federal law limits what you can lose and forces your bank to investigate on a strict timetable. Under the Electronic Fund Transfer Act and Regulation E, your liability for unauthorized electronic transfers ranges from zero to $50 in most hacking situations, provided you report the fraud within 60 days of the statement that first shows the unauthorized activity. How fast you call the bank decides both how much you owe and how quickly the money comes back.

Call the Bank First, Then Document

The moment you spot a transaction you didn’t make, phone your bank’s fraud line. Most banks staff a dedicated fraud number around the clock, and a call starts your legal protections faster than an online form. Ask the representative to freeze the account so no more withdrawals clear, and get a confirmation number for the report.

While the freeze goes in, put a record together:

  • Write down the dates, amounts, and transaction ID numbers of every unauthorized transfer you can see on the statement. Screenshot anything that might be the entry point — a phishing email, a strange text, a malware alert.
  • File an Identity Theft Report at IdentityTheft.gov. The site generates an official report that businesses and credit bureaus recognize, and builds a recovery plan for your situation.1IdentityTheft.gov. What To Do Right Away
  • Consider a police report. It isn’t always required, but some banks ask for one before processing a fraud claim, and it strengthens your file if the claim is later disputed.2Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft
  • Change your online banking password, security questions, and PINs. If you reused that password elsewhere, change it on those accounts too.

Expect the bank to send you a written fraud affidavit or statement of unauthorized activity to sign. Be precise on the transaction details. Vague or conflicting entries slow the investigation, and some banks require a notarized signature.

How Much You Can Be Held Liable For

Regulation E caps what you owe for unauthorized electronic transfers. The cap depends on two things: whether the fraud involved a lost or stolen physical access device such as a debit card, and how quickly you reported.

Hacking Without a Lost or Stolen Card

Remote hacking — phishing, malware, credential theft — is the best-protected scenario. The Consumer Financial Protection Bureau’s official commentary on Regulation E states that the $50 and $500 liability tiers do not apply to unauthorized transfers made without an access device.3Consumer Financial Protection Bureau. Comment for 1005.6 Liability of Consumer for Unauthorized Transfers Report the activity within 60 days of the date the bank sent the statement showing those transfers, and you owe nothing.

Miss that 60-day window and you can be held responsible for unauthorized transfers that occur after the 60 days expire and before you finally tell the bank, but only those the bank can prove would not have happened had you reported on time.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Anything within the first 60 days remains the bank’s problem.

When a Debit Card or PIN Was Involved

If the fraud involved a lost or stolen debit card, PIN, or other physical access device, a tiered schedule applies:

The underlying statute puts the burden of proof on the bank, not on you, to show that a transfer was authorized and that your delay caused additional losses.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The statute also recognizes extenuating circumstances such as extended travel or hospitalization that may excuse a delayed report.

The Bank’s Investigation Clock

Once you file the report, the bank has 10 business days to complete its initial review and decide whether an error occurred. If it confirms the transactions were unauthorized, it must correct the error within one business day of that decision.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors

If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within 10 business days. The bank may withhold up to $50 from the provisional credit if it has a reasonable basis to think an unauthorized transfer occurred and you may bear some liability.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors You get to use the provisionally credited money while the investigation runs.

The clock stretches in some cases. If the disputed transaction was a point-of-sale purchase, originated outside the United States, or hit an account opened within the last 30 days, the bank gets 20 business days for the initial review and up to 90 days for the extended one.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors

What a Freeze Does to the Rest of Your Financial Life

When the bank freezes the compromised account, your debit card stops working, ATM withdrawals fail, and outgoing transfers are blocked. Any automatic bill payments linked to that account will bounce. Failed payments trigger late fees, and repeated failures can prompt a service provider to cancel your account or send the balance to collections.

If the hackers drained your balance before the freeze, transactions that post against an now-empty account can generate overdraft fees, which vary by bank and pile up fast when multiple auto-payments hit the same day.7FDIC. Overdraft and Account Fees Call each company expecting a payment and explain what happened. Many will waive late fees with fraud documentation.

Most banks will close the compromised account entirely and open a new one with a new account number. That means updating direct deposit with your employer, every automatic transfer, and any payment app tied to the old account. Give the transition a week or more to settle.

Where These Protections Don’t Reach

Regulation E covers debit cards, ACH transfers, and electronic transfers from your bank account, including P2P services like Zelle and Venmo when a hacker uses your stolen credentials to send money. The CFPB has confirmed that a transfer initiated by someone who broke in through phishing, a data breach, or a compromised phone is an unauthorized electronic fund transfer even when it goes through a P2P app.8Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs

A few situations sit outside Regulation E, and the difference matters:

  • Wire transfers are explicitly excluded from the Electronic Fund Transfer Act. If a hacker initiates a fraudulent wire from your account, your rights depend on the wire transfer agreement you signed with your bank, and for commercial accounts on Article 4A of the Uniform Commercial Code.9FDIC. EFTA – Electronic Fund Transfer Act
  • Forged paper checks are governed by state law under Article 4 of the UCC. There is an absolute one-year deadline: if you don’t discover and report a forged check within one year of receiving your statement, you’re barred from contesting it.10Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
  • Transactions you personally initiated, even after being tricked by a scammer, may not qualify as “unauthorized” under Regulation E, because you sent the payment. There is a legal line between a hacker accessing your account and a scammer convincing you to move money yourself.

If the Bank Denies Your Claim

If the bank concludes no unauthorized transfer occurred, it must send you a written explanation and tell you that you can request copies of the documents it relied on.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Ask for those documents right away. They may show errors in the investigation or give you facts to challenge the denial. If you had a provisional credit, expect the bank to reverse it after a denial.

You still have moves left:

  • Resubmit with evidence the bank didn’t review. IP address logs, phishing emails, and a police report can all support a fresh dispute.
  • File a complaint with the CFPB. It accepts complaints about banks that fail to follow Regulation E’s error-resolution rules, and filing often prompts the bank to look again.
  • Contact your state attorney general. Many have consumer protection divisions that handle banking disputes.
  • Sue. The EFTA gives you a private right of action against a bank that fails to comply, including actual damages, statutory damages, and attorney’s fees.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability

Protect Yourself Against Follow-On Identity Theft

A hacked account can lead to more than a drained balance. If the breach exposed your Social Security number or other personal data, the hacker may try to open new accounts in your name. Two free tools blunt that risk:

  • A credit freeze blocks new credit applications under your name until you lift it. Place one with each of the three credit bureaus — Equifax, Experian, and TransUnion. It’s free, and you can lift it temporarily whenever you need to apply for credit.12Federal Trade Commission. Credit Freezes and Fraud Alerts
  • A fraud alert requires businesses to verify your identity before opening new credit. An initial alert lasts one year and only needs one bureau, which notifies the other two. An extended alert lasts seven years and requires an FTC Identity Theft Report or police report.12Federal Trade Commission. Credit Freezes and Fraud Alerts

If the fraud left unpaid overdrafts or an involuntary account closure, your bank may report it to specialty consumer reporting agencies like ChexSystems or Early Warning Services. A negative record with them can make it hard to open a new bank account for up to five years. If the record stems from fraud rather than your own account use, dispute it directly with the agency, attaching your Identity Theft Report and police report.