Your Bank Account Got Hacked. Here's Exactly What to Do Next

You open your banking app and something is wrong. A charge you do not recognize. A transfer you did not make. Or worse, your balance is lower than it should be and money is just gone. What you do in the next few hours matters a lot, and most of it is simple, boring steps that protect the money you still have.

First, do not wait. Call your bank right now, not tomorrow, not after work. Use the number on the back of your debit card or the number on the bank's official website, never a number from a text message or an email about the fraud, because those can be fake. Tell them you see unauthorized transactions. They will freeze the card, and often the account, and start a fraud claim. This is the single most important step, because freezing the account stops the bleeding. Every hour you wait is an hour the thief can keep spending.

While you are on the phone, ask the bank to do three specific things. First, freeze or cancel the compromised debit card and send a replacement. Second, put a hold or alert on the account so new withdrawals and transfers need extra verification. Third, ask them to confirm which transactions were fraudulent and start a dispute for each one. Write down the claim number, the name of the person you spoke to, and the date and time of the call.

Next, check the rest of your money. If someone got into your checking account, they might have your login, your email, or your card number, and that means other accounts could be at risk too. Look at every account you have: savings, credit cards, PayPal, Cash App, Venmo, anything linked to that bank account or that debit card. If you see anything strange anywhere, report it to that company too. Change the passwords on your bank login and your email, because email is often how a thief resets your bank password. Use a password you have not used anywhere else, and turn on two-factor authentication for your bank and your email if it is not already on. Two-factor authentication is annoying for about ten seconds a day and is the best free protection you will ever get.

Now understand what the bank actually owes you, because the rules are different depending on what kind of account was hit. For a debit card, federal law limits your liability if you report quickly. If you report within two business days of discovering the unauthorized use, your losses are capped at $50. If you wait longer than two business days but report within 60 days of your statement, the cap goes up to $500. If you wait more than 60 days after the statement, you can be on the hook for everything. That is why speed matters.

For credit cards, the rules are better. Under federal law, your liability for unauthorized credit card charges is capped at $50, and most major card issuers waive even that and give you zero liability. That is one real reason to use a credit card for online purchases instead of a debit card. When a thief hits your credit card, it is the bank's money that is gone. When a thief hits your debit card, it is your money that is gone, and getting it back takes time.

And time is the part nobody warns you about. Even when the bank agrees the charges were fraud, getting your money back is not instant. The bank usually issues a provisional credit while they investigate, but that can take a few business days, and the full investigation can take up to 45 to 90 days. If your rent or a bill is due while your money is missing, call those companies and explain the situation. Many will give you a short extension if you tell them before the due date.

While the claim is running, watch your accounts every day. Check for new charges, new login alerts, or anything that looks off. Set up transaction alerts on your bank app so you get a notification for every purchase or transfer. That way, if it happens again, you find out in minutes instead of days. Also pull your free credit reports at annualcreditreport.com and look for accounts you did not open. If a thief has your personal information, they might try to open a credit card in your name next. If you see anything you do not recognize, dispute it with the credit bureau.

Finally, figure out how they got in, because that determines what you need to fix. The most common ways are a data breach at a store or website where you used the card, a phishing text or email that tricked you into entering your login, malware on your phone or computer, or a card skimmer on an ATM or gas pump. If you clicked a link in a suspicious message, that was probably it. If you used your debit card at a gas pump or an ATM that felt off, that might have been it. You cannot undo how they got in, but you can close the hole. Stop using your debit card at gas pumps and ATMs you do not trust. Use a credit card or tap-to-pay instead. Never log into your bank from a link in a text or email. Go to the app or type the address yourself.

Getting hacked is fixable. Banks deal with this every day, the law is mostly on your side if you act fast, and a few boring steps right now will protect the money you still have and make it much harder for it to happen again.

Disclosure: This article was drafted with AI assistance and reviewed by the author.