If your bank account has been hacked, call your bank’s fraud line right now, before you do anything else. Under federal law, reporting unauthorized electronic transfers within two business days caps what you can lose at $50. Wait longer than 60 days after your statement arrives and that cap disappears entirely. Every other step below matters, but none of them matters as much as the phone call you make in the next hour.
Why the First Two Days Decide How Much You Lose
Federal law puts a hard limit on your liability for unauthorized electronic transfers, but only if you report quickly. The limits work on a sliding scale:
- Report within 2 business days of learning about the hack: your maximum loss is $50.
- Report after 2 business days but within 60 days of the statement showing the fraud: your maximum loss is $500.
- Report more than 60 days after that statement: no cap. You can be held responsible for every unauthorized transfer that happens after the 60-day mark until you finally notify the bank.
These rules come from the Electronic Fund Transfer Act and its implementing regulation, and they cover debit card transactions, ATM withdrawals, direct transfers, and other electronic activity on personal accounts.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The two-day clock starts when you learn about the breach, not when the transfer happened. If something like hospitalization or extended travel kept you from reporting sooner, the bank must extend those deadlines to a reasonable period.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Even if you’re not certain fraud has occurred, report a suspected problem. Reporting early costs you nothing. Waiting can cost you everything.
Lock Down Your Online Access
Do this while you’re on hold with the bank, or in the minutes before you call. Change your online banking password to something you haven’t used anywhere else. Turn on multi-factor authentication if it isn’t already on, so anyone signing in also needs a one-time code from your phone.
Most banking platforms have a “sign out of all sessions” button. Use it. If a hacker is currently logged in from another device, that kicks them out, and your new password plus the second factor keeps them out.
Then open your profile settings. Hackers routinely swap the email address or phone number on the account so they can intercept password-reset links and fraud alerts. If your contact information has been changed, restore it, and confirm that alerts for large transactions are turned on.
Check Linked Payment Apps
If Zelle, Venmo, Cash App, or a similar service is linked to your account, open each one and check for transactions you didn’t authorize. An unauthorized transfer through one of these apps is still covered by federal law when someone accessed your account or device without permission.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Report the fraud to both the bank and the app.
One distinction matters here. If a scammer tricked you into sending the money yourself, by posing as a friend or a company you trust, that is treated differently from someone breaking into your account and moving money without your knowledge. The federal liability caps apply most clearly when someone else initiated the transfer. Transfers you initiated under false pretenses have historically been harder to recover, and banks have denied many of those claims.
What to Tell the Bank
Call the fraud department directly. Most banks run these lines around the clock, and many also accept reports through secure messaging or at a branch. Have this ready before you call:
- A list of every transaction you didn’t authorize, with date, amount, and merchant or recipient.
- The exact date and time you first noticed the activity or realized you were locked out.
- Your account number and your most recent legitimate statement.
The bank will usually ask you to complete a fraud affidavit or dispute form. These are downloadable from the bank’s site or available at a branch.
Ask About Written Confirmation
If you report by phone, the bank can require you to send written confirmation within 10 business days. Skip that step and the bank is not required to provisionally credit your account while it investigates, which can leave you without your money for weeks longer than necessary.3eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors When you call, ask specifically whether written confirmation is required. Get the address. Send it the same day.
What the Bank Has to Do Next
Once your report is in, the bank has 10 business days to investigate and decide whether an error occurred. If your account has been open less than 30 days, it gets 20 business days.4Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
If it can’t finish that quickly, it must provisionally credit your account for the disputed amount (minus up to $50) within 10 business days of receiving your report, so you can access your money while the investigation continues.3eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The full investigation must wrap up within 45 days. For transactions that occurred in a foreign country, within 30 days of account opening, or at a point-of-sale terminal with a debit card, that limit stretches to 90 days.4Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
When the bank confirms the fraud, it must correct the error within one business day and tell you the results within three. Usually it closes the compromised account, issues a new account number and debit card, and permanently restores the stolen funds. Update any automatic bill payments or direct deposits tied to the old account number. That step is easy to forget and painful to miss.
File an Identity Theft Report and a Police Report
The bank call protects your money. The federal and local reports create the paper trail for everything else that can spin out of a hack.
Go to IdentityTheft.gov and create an Identity Theft Report. This is the federal government’s official reporting portal, and the report it generates is your formal declaration that someone used your personal information without permission.5Federal Trade Commission. Report Identity Theft Credit bureaus, insurers, and other financial institutions ask for this document when you dispute accounts or transactions you didn’t open.
Then file a report with your local police. Call the non-emergency line, bring your documentation, and ask for a copy of the report and the case number. Some departments push back on reports for online crimes. If that happens, ask to file a miscellaneous incident report instead. The report and case number are often required for extended fraud alerts and for disputing fraudulent accounts opened in your name.
Freeze Your Credit and Banking Reports
A hacker who got into your account probably has enough personal information to open new credit cards, loans, or additional bank accounts in your name. Freezes are the strongest way to block that.
Credit Freezes at the Three Bureaus
A credit freeze stops lenders from pulling your credit report, which means no one, including you, can open new credit until you lift it. Contact Equifax, Experian, and TransUnion separately. Freezes are free to place and lift and don’t affect your credit score.6Federal Trade Commission. Credit Freezes and Fraud Alerts
Fraud Alerts
A fraud alert is a lighter option you can layer on top of a freeze. It tells lenders to verify your identity before approving new credit. You only need to contact one of the three bureaus, and that bureau must notify the other two.7Consumer Financial Protection Bureau. What Do I Do if I Have Been a Victim of Identity Theft An initial alert lasts one year. With an Identity Theft Report, you can request an extended alert that lasts seven years.6Federal Trade Commission. Credit Freezes and Fraud Alerts
ChexSystems Freeze
Credit bureaus track credit accounts. ChexSystems tracks checking and savings accounts. When someone tries to open a new bank account, the bank usually checks ChexSystems first. A security freeze there blocks those inquiries and stops fraudulent bank accounts the same way a credit freeze stops fraudulent credit cards.8ChexSystems. Security Freeze Information You can place the freeze through the ChexSystems consumer portal or by calling 800-887-7652. A ChexSystems freeze covers only banking reports, so you still need separate freezes at the three credit bureaus.
Pull Your Free Credit Reports
Federal law entitles you to a free credit report from each bureau if your report is inaccurate because of identity theft or fraud, or if you have a fraud alert on file.9Federal Trade Commission. Free Credit Reports Pull them and review carefully for accounts, addresses, and inquiries you don’t recognize. Keep checking for at least a year. Identity thieves sometimes sit on stolen information for months before using it.
Business Accounts Are Not Covered the Same Way
The liability caps and investigation timelines above apply only to accounts established for personal, family, or household purposes. Federal law defines a protected “account” in those terms and excludes business and commercial accounts.10Office of the Law Revision Counsel. 15 USC 1693a – Definitions If your business account is hacked, your protections come from your agreement with the bank and from state commercial law, typically Article 4A of the Uniform Commercial Code. Many bank agreements place the loss on the business when the bank followed its agreed-upon security procedures, regardless of how quickly the business reported. Review your commercial account agreement now, and ask specifically what security procedures shift liability.
If You Permanently Lose Money, Can You Deduct It?
If the bank fully reimburses you, there is nothing to report on your taxes. If you permanently lose money because you missed a reporting deadline or the bank denied your claim, you generally cannot deduct that loss on your personal federal return. Since 2018, individual theft loss deductions have been limited to losses caused by a federally declared disaster, and a bank hack does not qualify.11Internal Revenue Service. Topic No. 515 Casualty Disaster and Theft Losses If the stolen funds came from a business account or a transaction entered into for profit, the loss may still be deductible. Talk to a tax professional about eligibility before you file.