If your bank account has been hacked, call your bank’s fraud department now, before you read the rest of this page. Federal law caps your losses from unauthorized electronic transfers at $50 if you notify the bank within two business days of discovering the problem. Wait longer and the cap climbs to $500. Let 60 days pass after the statement showing the fraud, and there is no cap at all. Everything else you do today is built around getting that first call on the record.
The First Hour
Find the fraud number on the back of your debit card or in the security section of your bank’s website. Automated menus usually have a dedicated option for lost or stolen cards or suspicious transactions. When you reach a live person, ask them to freeze the compromised account and deactivate any linked debit cards. Get a case or reference number before you hang up. That number is your receipt and the only reliable way to track the claim later.
While you still have the bank on the phone, or immediately after, change your online banking password and PIN. If you reused that password anywhere else, change those accounts too, and turn on two-factor authentication wherever it’s offered. Credentials stolen through phishing or a data breach are routinely tried against other sites, so treat this as a broader security incident.
Before the details fade, screenshot or write down every unauthorized transaction: date, exact amount, and the merchant or recipient name shown. This is what the bank’s investigator will work from, and it prevents a fraudulent charge from slipping past between legitimate ones.
Put the Dispute in Writing
Most banks have an online or in-app dispute portal in addition to the phone line. Use it even if you already called. Submitting through the portal creates a timestamped written record and often lets you upload evidence. If the bank asks for a signed affidavit or written statement to follow up, send it by certified mail with return receipt. That receipt is your proof that notice landed within the federal deadlines.
The bank may ask you to confirm your dispute in writing within 10 business days of the phone call. If the bank requested it and you don’t send it, the bank is no longer required to provisionally credit your account while it investigates.
How Much You Can Be Held Responsible For
The Electronic Fund Transfer Act and Regulation E govern unauthorized transfers from consumer bank accounts. Your liability turns almost entirely on how quickly you report.
- Report within two business days of discovering the problem: your maximum liability is $50, or the total unauthorized transfers before you notified the bank, whichever is less. Often this comes out to zero.
- Report after two business days but within 60 days of the statement showing the fraud: your liability can climb to $500. The bank has to show the extra losses beyond $50 would not have happened had you reported sooner.
- Report more than 60 days after that statement date: you are responsible for every unauthorized transfer that occurs after the 60-day window closes and before you notify the bank. No dollar cap.
The two-business-day clock starts when you learn the account was compromised, not when the hack occurred.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The 60-day clock starts when your bank sends or makes available the periodic statement showing the first unauthorized transaction.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability People who check statements regularly almost always land inside the safer tiers. Those who don’t are the ones who get burned.
Stolen login credentials count. Regulation E defines an “access device” broadly to include any card, code, or other means of access to your account, so a hacker who phished your username and password has obtained your access device through fraud, and the resulting transfers are treated as unauthorized.3Consumer Financial Protection Bureau. 1005.2 Definitions
What the Bank Has to Do Next
Once you report, the bank has 10 business days to investigate and tell you whether it found an error. If it confirms the fraud, it must correct the error within one business day.4eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days. The bank may withhold up to $50 from that provisional credit if it has a reasonable basis for believing the transfer was unauthorized and your account otherwise qualifies. You get full use of the credited funds while the investigation continues.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
If the bank concludes no error occurred, it must send a written explanation and tell you that you can request copies of the documents it relied on. If provisional credit is already sitting in your account, the bank must give you at least five business days’ notice before debiting it back.4eCFR. 12 CFR 205.11 – Procedures for Resolving Errors You can then escalate by filing a complaint with the Consumer Financial Protection Bureau or pursuing the matter in court. A bank that fails to follow the required investigation procedures can be liable for treble damages under the EFTA.
Getting Overdraft and NSF Fees Refunded
Unauthorized withdrawals often set off a chain reaction. The balance drops, legitimate payments bounce, and the bank charges overdraft or non-sufficient-funds fees on each one. Regulation E addresses this directly. When the bank confirms an error, it must refund fees it imposed as a result of the unauthorized transfer. The bank only gets to keep fees that would have been charged regardless of the fraud.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E If your bank confirms fraud but tries to keep the cascading fees, cite this provision. It’s one of the most commonly overlooked pieces of Regulation E.
Report the Identity Theft
A bank account breach usually means personal information is compromised beyond the account itself. File a report at IdentityTheft.gov, the FTC’s dedicated portal. It generates an official Identity Theft Report and a personalized recovery plan built from your answers about how the information was misused and which accounts were affected.7Federal Trade Commission. IdentityTheft.gov That report qualifies you for a seven-year extended fraud alert on your credit reports and is documentation banks and creditors recognize when handling fraud claims.
A police report is worth filing too. Some banks want a police report number before processing larger reimbursements. The FTC recommends bringing your Identity Theft Report, a government-issued photo ID, proof of address, and any evidence of the theft to the station.8IdentityTheft.gov. What To Do Right Away Many departments accept online or phone reports when there’s no immediate physical danger.
Freeze or Alert Your Credit
Assume the hacker has enough personal information to try opening new accounts in your name. Two federal protections exist, and they work differently.
A credit freeze blocks creditors from pulling your credit report, which stops most new-account fraud outright. All three major credit bureaus must place a freeze for free within one business day of an electronic or phone request, and removing it later is also free.9Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts Contact Equifax, Experian, and TransUnion separately. A freeze doesn’t affect your credit score or prevent you from using existing accounts.
A fraud alert is lighter. It flags your file so lenders are supposed to take extra steps to verify your identity before approving new credit. An initial fraud alert lasts one year and requires only a good-faith suspicion. You contact one bureau and it notifies the other two. With an FTC Identity Theft Report or police report, you can request an extended fraud alert lasting seven years.9Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts A freeze is generally the stronger move if you’re not planning to apply for credit soon.
Deal With Recurring Payments and Direct Deposit
Freezing the account means every automatic payment tied to it will start bouncing. Mortgage, utilities, insurance, subscriptions. Each bounce can trigger late fees from the company on the other end. As soon as you can, list every recurring payment and every direct deposit linked to the compromised account.
For bills you still owe, contact each company to revoke the old payment authorization and set up a new payment method. The CFPB recommends calling and writing each company to formally withdraw permission, then following up with your bank to place a stop payment order on the old authorization.10Consumer Financial Protection Bureau. How Do I Stop Automatic Payments From My Bank Account Canceling the payment method doesn’t cancel what you owe, so pay through another channel in the meantime. If your paycheck arrives by direct deposit, update your details with HR. A paycheck landing in a frozen account can create weeks of trouble.
If the Hacked Account Belongs to a Business
Everything above applies to personal consumer accounts. Business accounts are not covered by the Electronic Fund Transfer Act or Regulation E. They are governed by Article 4A of the Uniform Commercial Code, which most states have adopted and which places far more responsibility on the account holder. If the bank offered a commercially reasonable security procedure and the business declined or failed to use it, the bank may not be liable for the unauthorized transfers at all. Business owners should review their bank’s security protocols carefully and consider cyber liability insurance to fill the gap.
If You End Up Absorbing a Loss
Full reimbursement from the bank means nothing to report on your taxes. If you absorb a loss because you reported too late or the bank denied the claim, the tax treatment is unfavorable for most individuals. Since 2018, personal theft losses are deductible only if they stem from a federally declared disaster, and bank account hacking doesn’t qualify.11Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts
There is a narrow exception when the stolen funds were held in an account used for investment or profit-generating purposes rather than purely personal use. The IRS may treat the loss as a theft from a transaction entered into for profit, potentially deductible if you have no reasonable prospect of recovery and the loss qualifies as theft under your state’s criminal law.11Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts The line is narrow enough that a tax professional should review your specifics before you claim anything.