Bank Account Hacked? What to Do in the First Hour and After

If your bank account was hacked, call your bank straight away on the number printed on the back of your card or listed on its official website, not a number from a text or email. Ask them to freeze or lock your cards and online banking, report every transaction you didn’t make, and follow up in writing. Then change your online banking password from a clean device, secure your email and phone number, and consider a credit freeze if your personal details may have been exposed.

Speed matters more here than with almost any other hacked account. In the US, how much protection you get for unauthorized electronic transfers can depend on how quickly you report them, so it’s worth making that call before you do anything else.

Signs your bank account has been hacked

• Transactions, transfers or new payees you don’t recognize.
• Alerts about a password change, a new device or a changed phone number or email address on the account.
• You can’t sign in to online or mobile banking, or you’re signed out unexpectedly.
• Your statements or cards stop arriving, or cards you didn’t order arrive.
• Calls, texts or emails from “your bank” asking you to confirm a code, move money or install an app.
• A sudden change in your balance, or small test charges from unfamiliar merchants.

The point about calls matters most. Some of the most damaging bank fraud isn’t a technical hack at all. A criminal phones pretending to be your bank’s fraud team, says your account is under attack and talks you into reading out a one-time code or moving money to a “safe account”. Your real bank will not ask you to do either.

What to do right now: the first hour

1. Call your bank’s fraud line. Use the number on the back of your card, on a statement, or on the bank’s official website that you type in yourself. If someone called you, hang up and call back on that number.
2. Freeze or lock your cards. Most banking apps let you lock a card instantly. Ask the bank to block the card and issue a new one if it’s been used.
3. Report every unauthorized transaction. Go through recent activity with the fraud team and list everything you didn’t make or authorize. Note the date, time and the name of the person you spoke to, and any case or reference number.
4. Ask the bank to secure online banking. They can often block online access, reset your credentials and check for changed contact details, new payees or new devices.
5. Follow up in writing. Send a written dispute through the bank’s secure messaging or by letter, and keep a copy. Written notice is often required, and it creates a record.

How US protections work, in general terms

This is general information, not legal advice, and the details depend on your account type and circumstances.

• Debit cards, ATM withdrawals and electronic transfers are covered by federal rules under the Electronic Fund Transfer Act. They limit your liability for unauthorized transfers, but how much protection you get depends on how quickly you tell the bank after you learn of the problem or after the statement showing it is sent.
• Credit cards are covered by the Fair Credit Billing Act, which gives you the right to dispute unauthorized charges and billing errors. You generally need to dispute in writing within a set period after the statement.
• Payments you were tricked into making are treated differently from payments someone made without your involvement. If a scammer persuaded you to send money yourself, protection may be weaker or less clear, especially for instant payment apps. Report it anyway, and ask the bank what applies.

If your bank doesn’t resolve the problem fairly, you can submit a complaint to the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. For larger losses or disputes, talk to a consumer protection lawyer.

Secure your online banking and the accounts behind it

Once your cards are frozen and the fraud is reported, close the door the criminal used.

1. Change your online banking password from a phone or computer you trust. Use a long password you’ve never used anywhere else.
2. Turn on the strongest sign-in option your bank offers, such as app-based approval, a passkey or a security key.
3. Check contact details on the account. Make sure the phone number, email and mailing address are yours. Criminals change these to hide alerts.
4. Review payees, linked accounts and devices. Remove anything you didn’t set up, including linked payment apps.
5. Turn on transaction alerts for every payment, not just large ones, so you see problems immediately.
6. Secure your email. If a criminal controls your email, they can reset your banking password and hide the bank’s warnings. Our guide for an email account hacked covers the steps.
7. Protect your phone number. Ask your mobile carrier to add a PIN and port-out or SIM-swap protection. A hijacked number lets criminals receive your text codes.
8. Check linked payment apps. If your bank is linked to PayPal, Venmo, Cash App or Zelle, check those too. See our guides for a PayPal account hacked and Zelle scams.

If you think a device is compromised, for example because you installed a “security” app a caller told you to install, clean or reset that device before you sign in to banking on it again.

If your identity is being misused

Sometimes a hacked bank account is part of something bigger. If the criminal has your Social Security number, date of birth or ID documents, they may try to open new accounts or loans in your name.

• Report identity theft at IdentityTheft.gov, the FTC’s official site. It creates a recovery plan and an FTC Identity Theft Report you can use with banks and creditors. Our FTC identity theft report guide explains how.
• Freeze your credit with each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. A freeze is free and stops most new credit being opened in your name. You can lift it temporarily when you need to apply for credit yourself.
• Consider a fraud alert, which asks lenders to take extra steps to verify your identity before opening credit.
• Check your credit reports for accounts you don’t recognize. You can get free reports through the official annual credit report site.
• Report to the police if you need a report for a creditor or if the fraud is significant, and report online fraud to the FBI’s Internet Crime Complaint Center at ic3.gov.

Our guide on what to do if your identity is stolen covers the full recovery process.

A worked example

This is an illustrative scenario, not a real client. Kofi gets a text that looks like it’s from his bank: “Unusual payment detected on your account. If this wasn’t you, reply NO.” He replies NO, and a minute later someone calls claiming to be from the bank’s fraud team. They know his name and the last four digits of his card. They say they’ll cancel the payment but need him to read out a code the bank is about to send.

Kofi reads the code out. Twenty minutes later, he gets an alert that a new payee has been added and a transfer sent. Now suspicious, he hangs up on a second call, turns his card over and calls the number on the back. The real fraud team freezes his card and online banking, confirms the transfer and the new payee weren’t him and opens a case.

That evening he sends a written dispute through the bank’s secure messages, changes his banking and email passwords, asks his carrier for a PIN on his account and turns on alerts for every transaction. Because the caller knew his card details, he also places credit freezes with all three bureaus as a precaution. The bank tells him the outcome of the dispute will take time and depends on its investigation.

Common mistakes to avoid

• Calling a number from the text or email. Always use the number on your card or the bank’s official site.
• Reading out a one-time code to a caller. The code is how the criminal gets in or approves a payment. No genuine bank employee needs it.
• Moving money to a “safe account”. There is no such thing. Your bank will never ask you to transfer money to protect it.
• Waiting to see if it happens again. Delays can reduce your protection.
• Paying a “recovery service”. People who contact you promising to get stolen money back for a fee are running a second scam. Our guide to recovery scams explains how they work.
• Fixing the bank but not the email. If your email is still compromised, the criminal can reset your banking password again.

How to protect your bank account going forward

• Use a unique banking password, stored in a password manager.
• Use your bank’s app or a bookmark to sign in, never a link in a message.
• Turn on alerts for every transaction and every change to your account details.
• Keep your phone and banking app updated.
• Lock your carrier account with a PIN.
• Keep credit freezes in place when you’re not applying for credit.
• Check whether your email appears in known breaches with Have I Been Pwned and change any reused passwords.

If the fraud spills into your public life, for example fake accounts or listings in your name, our personal reputation management team can help you assess and clean up what shows up when people search for you.

Frequently asked questions

Will my bank refund money taken from my hacked account?

Often, for transactions you didn’t make or authorize, especially if you report them quickly. US rules limit liability for unauthorized electronic transfers and credit card charges, but the protection depends on timing and circumstances. Payments you were tricked into sending yourself may be treated differently.

How did someone get into my bank account?

Common causes are phishing texts or emails leading to fake banking sites, callers pretending to be the bank who ask for codes, reused passwords from other breaches, SIM swaps that intercept text codes, and malware on a phone or computer.

Should I close my bank account after it was hacked?

Your bank may recommend closing the account and opening a new one with a new number, especially if account details were exposed. Follow their advice, and update any direct deposits and automatic payments afterwards.

Do I need to report a hacked bank account to the police?

Report it to your bank first. A police report can help if the fraud is large or a creditor asks for one. You can also report online fraud to the FBI at ic3.gov and identity theft at IdentityTheft.gov.

Does a credit freeze stop someone using my existing bank account?

No. A credit freeze stops most new credit accounts being opened in your name. To protect your existing account, work with your bank: new cards, new credentials, alerts and, if needed, a new account number.