Discovering unauthorized activity in your bank account is alarming — but how you respond in the first hours and days can make a significant difference in how much money you recover and how quickly your account gets secured. Here's what the process looks like, what your rights are, and what factors shape the outcome.
Not every suspicious transaction means your account was hacked, but the following are common indicators that something is wrong:
Sometimes these are errors or merchant holds. Other times, they signal a genuine compromise. Either way, the right first move is the same: act immediately.
Your first call should be to your bank's fraud department — not their general customer service line if you can avoid it. Most banks have a dedicated fraud hotline printed on the back of your debit card or listed on their website.
When you call:
Time matters here. Federal regulations — specifically Regulation E, which governs electronic fund transfers — set liability limits that depend heavily on how quickly you report the problem.
Regulation E is the primary federal consumer protection law for unauthorized electronic transactions on checking and savings accounts. It sets out a tiered liability structure based on when you report the fraud:
| Reporting Timing | Your Maximum Liability (General Framework) |
|---|---|
| Before any unauthorized use | $0 |
| Within 2 business days of learning about it | Up to $50 |
| 3–60 days after your statement is sent | Up to $500 |
| More than 60 days after statement | Potentially unlimited for transactions after that window |
These are the federal baseline figures — your specific bank's policies may offer stronger protections than the law requires, but never weaker. Many banks advertise zero-liability policies for debit card fraud, which can be more generous than the federal standard.
Credit cards are a separate category. They fall under the Fair Credit Billing Act, which generally caps your liability at $50 for unauthorized charges — and most major issuers voluntarily extend full zero-liability protection. If fraudsters also accessed a credit card connected to your account, the dispute process and protections differ from your deposit account.
Once your bank is alerted, shift your focus to cutting off the attacker's access:
If you reuse passwords across accounts, treat all of those accounts as potentially compromised and update them as well.
A phone call to your bank starts the process, but follow up in writing. Many banks allow you to submit a fraud dispute through their online portal or mobile app. Request confirmation that your dispute has been received and ask about the timeline for investigation.
Under Regulation E, banks are generally required to:
These timelines can vary depending on the specifics of your case and your bank's procedures. Ask your bank explicitly what to expect.
Depending on the nature of the hack, you may want to file reports beyond your bank:
A hacked bank account may be one piece of a larger identity theft situation. If criminals obtained your Social Security number or other identifying information, they may attempt to open new accounts or lines of credit in your name.
The distinction between a fraud alert and a credit freeze matters: a fraud alert is temporary and advisory; a freeze actively blocks new credit applications. Both are free under federal law.
Recovery isn't guaranteed, and the outcome varies based on several factors:
How quickly you reported: The single biggest variable. The Regulation E timeline above is clear — waiting costs you protection.
Type of account and transaction: Debit vs. credit, ACH transfer vs. card transaction, wire transfer vs. mobile payment — each has different dispute rules and different levels of consumer protection. Wire transfers, in particular, carry weaker reversal protections once funds have left your account.
Your bank's internal policies: Many banks offer protections beyond the legal minimum. Their fraud team's judgment about the circumstances of your claim also plays a role.
Whether you shared credentials: If you voluntarily gave someone access — even under a scam — some banks may categorize that differently than a straightforward hack. Authorized push payment fraud (where you were deceived into sending money yourself) is a growing gray area in consumer protection law.
Your account history and documentation: Having clear records of your normal transaction patterns and acting promptly strengthens your claim.
Once the immediate crisis is resolved, it's worth looking at what made you vulnerable:
Understanding how access was gained helps you close that specific door — and informs what monitoring habits or security tools are worth adopting. Account alerts (text or email notifications for every transaction) are one of the simplest early-warning systems available through most banks at no cost.
The right longer-term response depends on what happened and how exposed your broader financial and personal information may be — which is why working through those questions with your bank and, if needed, an identity theft recovery service, matters more than any single checklist.