What to Do If Your Bank Account Is Hacked: Report, Recover, Protect

If your bank account has been hacked, call your bank’s fraud department right now, before you do anything else. Under federal law, how much of the stolen money you’re responsible for depends almost entirely on how fast you report the unauthorized activity: your liability can be as low as $50 if you call within two business days, and as high as the full amount stolen if you wait more than 60 days.¹ Everything else — changing passwords, filing police reports, freezing your credit — comes after that first phone call.

Call the Bank’s Fraud Department First

The number is on the back of your debit card and on the bank’s website. Most banks run a dedicated fraud line separate from general customer service. When you reach someone, tell them you have unauthorized transactions, give them the dates and amounts, and ask for a claim number in writing. The bank will typically freeze the compromised account on the spot and start the process of issuing new account numbers and cards.

Before the call, open your statements and write down what you need: the date and time of each transaction you didn’t make, the exact dollar amount, the type of transaction (debit card purchase, ACH, ATM withdrawal, peer-to-peer transfer), and any recipient name or account number shown. Check whether the email address, phone number, or mailing address on your account has been changed. Hackers often swap those details so they can intercept verification codes or a replacement card, and flagging the change helps the bank trace the intrusion.

How Much You Can Lose Depends on How Fast You Report

The Electronic Fund Transfer Act sets three liability tiers for unauthorized debit card and electronic account transactions.

Report within two business days of learning about the unauthorized access, and your liability is capped at $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.¹
Report after two business days but within 60 days of the statement being sent, and your liability can rise to $500 for transfers that occurred after the two-day window, if the bank can show those transfers would not have happened with faster reporting.¹
Report after 60 days, and the bank does not have to reimburse losses it can show would have been prevented by timely reporting. You could lose the full amount stolen after that 60-day window.¹

Many banks voluntarily offer zero-liability policies on debit cards that go beyond these federal minimums, but those are bank policies, not legal guarantees. The statutory tiers above are the baseline you can always enforce.

Lock Down Your Account, Device, and Email

Once the bank has your report, close off the ways the attacker got in. Change your online banking password to something you don’t use anywhere else. If your bank offers a card lock or freeze toggle in its app, turn it on. Enable multi-factor authentication, and use an authenticator app rather than text messages where possible.

A new password doesn’t help if the device you’re typing it on is compromised. Run a full antivirus scan on every device you use for banking before you reset credentials, and look for software you don’t recognize, unusual slowdowns, or unexpected pop-ups. If something feels wrong, reset the password from a different, trusted device.

Check your email account too. Attackers often add hidden forwarding rules or filters that quietly redirect or delete bank alerts, keeping you from seeing fraud as it happens. Review your forwarding settings and mail filters, remove anything you didn’t create, change the email password, and turn on multi-factor authentication there as well. A compromised email lets an attacker reset passwords on almost every other account you have.

What the Bank Must Do After You Report

Your bank has to investigate your fraud claim and reach a decision within 10 business days. If it needs longer, it can extend the investigation to 45 days, but only if it deposits a provisional credit for the disputed amount into your account within those first 10 business days.² The bank must tell you the amount and date of the credit within two business days of applying it, and you get full access to those funds during the investigation.

The investigation can stretch to 90 days in three situations: the unauthorized transfer originated outside the United States, it was a point-of-sale debit card transaction, or it involved an account opened within the past 30 days.³ For new accounts, the bank also gets 20 business days instead of 10 before provisional credit is required.

If the bank confirms fraud, it must credit your account for the stolen amount, plus any interest and fees caused by the unauthorized transactions, within one business day of finishing its investigation. If it decides no fraud occurred, it has to send you a written explanation and let you request copies of the documents it relied on.² If you disagree, you can escalate by filing a complaint with the Consumer Financial Protection Bureau.

Credit Cards, Payment Apps, and Wire Transfers Work Differently

The rules above apply to debit card and electronic account transactions on consumer accounts. A few common situations fall outside them, so it’s worth knowing where you stand.

Credit cards. If a hacker used a credit card linked to your account, your maximum liability is $50 regardless of when you report, and the card issuer bears the burden of proving the charges were authorized.⁴ If both your debit and credit cards were compromised, prioritize the debit card report, because your debit liability is the one that climbs with time.

Peer-to-peer payment apps. Transfers through Zelle, Venmo, Cash App, and similar services are covered by the same federal protections as other electronic fund transfers. The CFPB has clarified that when a third party fraudulently obtains your login credentials or tricks you into sharing account access and then initiates a transfer, that transfer qualifies as unauthorized under Regulation E.⁵ The hard line is between someone else accessing your account to send money, which is protected, and you personally sending money to a scammer, which generally is not.

Wire transfers. Wire transfers through systems like Fedwire are excluded from Regulation E entirely.⁶ If a hacker initiated a wire from your account, your rights come from your account agreement and your bank’s policies, not from the liability caps above.

Business accounts. Regulation E applies only to consumer accounts. Fraud on a business bank account is governed by the Uniform Commercial Code and your agreement with the bank.

File Official Reports

Reporting to the bank protects your money. Reporting to government agencies builds the paper trail you’ll need for credit disputes, insurance claims, and any law enforcement follow-up.

File an identity theft report at IdentityTheft.gov. The site generates a personalized recovery plan and an official Identity Theft Report, which creditors, banks, and credit bureaus accept as proof of the crime.⁷ Creating an account lets the site track your progress and pre-fill dispute letters. The report is also required if you later want an extended fraud alert on your credit file.

If the hack involved phishing, account takeover, skimming, or business email compromise, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.⁸ IC3 reports feed federal investigations and help identify patterns across victims, which matters most in larger-dollar or sophisticated cases.

A local police report has limited investigative value for cyber-based fraud, but the report itself can support insurance claims, creditor disputes, or future legal action.

Protect the Rest of Your Identity

A hacker who got into your bank account may have enough information to open new accounts in your name. Lock down your credit profile to prevent the second wave.

Fraud Alerts

An initial fraud alert lasts at least one year and requires lenders to take extra steps to verify your identity before approving new credit. You only need to contact one of the three major bureaus (Equifax, Experian, or TransUnion); it must notify the other two. No proof of identity theft is required. If you filed an Identity Theft Report through IdentityTheft.gov, you can request an extended fraud alert that lasts seven years.⁹

Credit Freeze

A credit freeze is stronger. It blocks the bureaus from releasing your credit report to potential lenders, which prevents anyone, including you, from opening new credit until the freeze is lifted. Freezes are free, remain in place until you remove them, and must be placed separately with each of the three bureaus.⁹ When you need to apply for credit, you can temporarily lift the freeze using a PIN the bureau gives you.

ChexSystems Freeze

Standard credit freezes don’t block someone from opening a new checking or savings account in your name. ChexSystems is the specialty reporting agency most banks check before approving new deposit accounts. You can place a separate security freeze on your ChexSystems file online, by phone at 800-887-7652, or by mail.¹⁰

Pull Your Credit Reports

Once the alerts and freezes are in place, pull all three credit reports through AnnualCreditReport.com. Look for accounts you don’t recognize, inquiries you didn’t authorize, and addresses where you’ve never lived. Dispute any fraudulent accounts with both the bureau and the creditor, using your Identity Theft Report as supporting documentation. Update login credentials and turn on multi-factor authentication for your other financial accounts too, since reused passwords are a common path from one compromise to the next.

If You Can’t Recover the Money

If the bank reimburses the stolen funds, there’s no tax consequence. If you can’t recover the loss, don’t assume you can deduct it. Since 2018, personal theft losses are deductible only when they result from a federally declared disaster, and a bank account hack does not qualify.¹¹ A narrow exception exists if the stolen funds were held in an account used for investment or profit-making purposes rather than purely personal use; qualifying theft losses are reported on IRS Form 4684.¹² A tax professional can tell you whether your situation fits.

1
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
2
Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – 1005.11 Procedures for Resolving Errors
3
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
4
GovInfo. 15 USC 1643 – Liability of Holder of Credit Card
5
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
6
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
7
Federal Trade Commission. Identity Theft Recovery Steps
8
Federal Bureau of Investigation. Common Frauds and Scams
9
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
10
ChexSystems. Place a Security Freeze
11
Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts
12
Internal Revenue Service. About Form 4684 – Casualties and Thefts