My Bank Account Has Been Hacked. Can I Get My Money Back?

What To Do If Your Bank Account Has Been Hacked

If your bank account has been hacked, report it to your bank's fraud department and freeze the account. Then, immediately change your passwords and security questions. 

If you don’t report the incident right away, banks may not refund your money. Also consider taking these steps to lock down your account and identity.

1. Check your bank statements

If you see transactions you’ve never made — and you haven’t let anyone else use your card — you should report fraud to your bank. Here’s what to do, using Chase Bank as an example:

• Report credit card fraud that you’ve discovered in your Chase account. Credit card charges need to be posted before you can dispute them. Go to Recent Activity and choose the credit card that reflects the fraudulent charge. Find the transaction in question, and verify that it’s been posted to your account. Click on it, then select Report a problem, and answer the prompts. It may take a few weeks for Chase to review and remove the charge.
• Report debit card fraud found in your Chase account. Follow the same process, but instead choose your checking account in Recent Activity. You’ll be able to check the status of your report under Account Services → Track Claims. Report any pending unauthorized debit charges by calling 1-866-564-2262.
• Lock your cards. Locking your debit card or credit card will block scammers from making new purchases. In the Chase Mobile app, click on the account you want to lock. Scroll down to Account Services and tap on Lock and Unlock Card; then toggle on Lock.

2. Contact your bank or card issuer’s fraud department

Your bank’s website may list several fraud lines. Chase, for example, has different phone numbers for reporting fraud on your checking and savings accounts, debit cards, credit cards, auto financing, and home loans [*].

Call the one that’s applicable; then ask the fraud representative to cancel your cards and accounts, and ask for new ones. Point out all suspicious transactions, and ask the representative to note the charges in your file.

You may need to provide more documentation before a bank can share information about a fraudulent account opened in your name. Chase, for instance, requires a written request, a copy of your government-issued ID, an Identity Theft Report, and other third-party documentation — such as a Power of Attorney sent via first-class mail [*].

{{show-cta}}

3. File reports with the FTC and local police

While the Federal Trade Commission (FTC) doesn't investigate claims directly, it passes along the information to the Identity Theft Data Clearinghouse — a database that helps law enforcement prosecute identity thieves.

If you suspect you’re the victim of identity theft, file an Identity Theft Report with the FTC at IdentityTheft.gov. After submission, you’ll receive an ID Theft Affidavit and a personalized action plan for identity recovery. You won’t have to file a separate fraud report [*].

To prove you’re not responsible for debt incurred by scammers, you should also report unauthorized charges to your bank within two weeks. Most will ask you to include a copy of your ID Theft Affidavit along with:

• A Fraudulent Account Statement which details the creditor’s name and address, your account number, a description of the unauthorized credit, the purchase date, and the transaction amount.
• A copy of your ID.
• Proof of your residence at the time of the crime.

If you don’t think you’re an identity theft victim but still have fraud to report:

• Go to ReportFraud.ftc.gov.
• Complete as much information as possible about the scam — including when, where, and how it happened, transaction amounts, and any other details you have about the fraudsters, such as their phone number or email address.
• If the scam involved malware, elder fraud, or other cybercrime, consider filing a complaint with the FBI through the Internet Crime Complaint Center (IC3).

Lastly, file a police report at your local station. Financial institutions and consumer reporting agencies often require a police report to dispute fraudulent charges and accounts, and most insurance companies ask for one when you file a claim for losses [*].

Bring a printed copy of your Identity Theft Report and ask the officers to attach it to their report. If they won’t take a report, give the officers a copy of the FTC’s Law Enforcement Cover Letter, which outlines why a police report is critical for victims of identity theft.

4. Place a fraud alert and/or security freeze on your account

When you’ve initiated a fraud alert, companies must verify your identity before issuing credit. Fraud alerts are free and typically last for one year. But victims of identity theft can set up an extended fraud alert. These last for seven years and also opt you out of prescreened credit card offers for five years.

• Contact any one of the three major credit bureaus and request a fraud alert. You’ll be asked to share a government-issued ID number, a bill showing your address and full name, and a document that includes your Social Security number. Once the request goes through, that bureau must notify the other two bureaus of your alert.

Security freezes, otherwise known as credit freezes, seal your credit file. Freezes are free and available at any of the major credit bureaus. You must freeze your credit individually at all three major credit bureaus. Memorize your PIN numbers so that you can unfreeze your files in the future.

How to freeze your credit:

For extra protection, you can set up a fraud alert and a security freeze. That way, if a freeze gets lifted, banks will still call you to verify your identity.

Smaller banks and credit unions use a reporting agency called ChexSystems to review checking and savings account activity before issuing new accounts. To block scammers from opening non-credit accounts, consider setting up a ChexSystems freeze.

5. Update your passwords

First, double-check the contact information listed on your accounts. Scammers may have changed your email or phone number so that they receive password reset requests instead of you.

Once you have confirmed that your data is accurate, do the following:

• Change the passwords on all of your online accounts, starting with any compromised ones. Aura’s free Dark Web scanner can uncover usernames and passwords involved in data breaches or leaks. Use strong passwords that don’t contain any information that fraudsters could easily guess.
• Sign up for account alerts. Chase, for example, sends emails, text messages, or push notifications whenever there’s a charge or balance transfer noted on your account, allowing you to quickly respond to fraudulent activity [*].
• Enable extra security measures. Two-factor authentication (2FA) or multi-factor authentication (MFA) can stop hackers from logging in to your accounts — even if they have your password. This is because they would also need your face ID, fingerprint, or a code from your authenticator app in order to gain access.

6. Submit a dispute for stolen or lost funds

It’s best practice to notify your bank of suspicious activity immediately. But if you can’t report it right away, stay within these official reporting time frames to avoid liability:

• Unauthorized debit card withdrawals: Within two days. You will lose no more than $50 if someone uses your PIN or debit card without your permission. 
• Unauthorized credit card transactions: Your liability is capped at $50, regardless of the total amount scammers stole [*].
• Unauthorized checks drawn on your account: Within 60 days after receiving your bank statement.
• Counterfeit checks or checks with forged endorsements drawn on your account: Within six months after receiving your bank statement.
• Unauthorized teller transactions: Within 30 days of appearing on your statement.
• Unauthorized payments and transfers (and bill payments): Within two days to incur no responsibility, and within 60 days to incur a $500 maximum liability. After 60 days, you may be fully liable.
• Preauthorized Electronic Funds Transfers: Stop these payments by notifying your bank within three business days of the send date.

After contacting your bank to explain the situation, you should formally dispute the charges. Some banks have an online process that you can follow or provide a telephone support line. Others require you to send in a letter.

7. Dispute any inaccuracies on your credit report

If you spot fraudulent debt on your credit report, start by disputing it with the information furnisher (the lender or bank that issued the debt). If the furnisher can't or won't reverse the charge, you need to submit a formal dispute with the credit bureau.

Use the FTC’s sample dispute letter as a template. Include any other relevant and supporting information, and send it via certified mail. Keep copies of everything you send.

• File a dispute with Equifax: Submit a formal dispute online or by mail at: Equifax, PO Box 740256, Atlanta, GA 30348.
• File a dispute with TransUnion: Submit a formal dispute online or by mail at: TransUnion LLC, Consumer Dispute Center, PO Box 2000, Chester, PA 19016.‍
• File a dispute with Experian: Submit a formal dispute online or by mail at: Experian, PO Box 4500, Allen, TX 75013.

Credit bureaus have 30 days to investigate your claim and send you results in writing. If your report changes, they must also send you a free copy of your credit report. If your report doesn’t change, ask that your dispute statement be included in your file [*].

8. Follow up with your bank

When dealing with debit cards and new bank accounts, banks typically have 10–20 days to respond and up to 45 days to investigate [*]. For credit card fraud, the issuer must respond within 30 days and investigate within two billing cycles [*].

If your matter doesn't get resolved, file a complaint with the Consumer Financial Protection Bureau (CFPB).

• Fill out the complaint form by visiting consumerfinance.gov/complaint or call 855-411-2372.
• Include all important information, such as how you’ve tried to resolve the issue so far, what you think would be a fair resolution, and supporting documents. It usually takes 15 days to get a response.

Can You Get Back Your Stolen Money?

If you've been scammed, your bank may refund the money stolen from your account. It depends on the amount, how long it took to report the fraud, and how the money was stolen.

While that may not be comforting, you do have some protections, including:

• The Fair Credit Billing Act (FCBA). This federal law limits consumer liability against credit fraud to $50 in most cases, and fraud victims have 60 days to dispute charges over that amount [*]. Banks must acknowledge your complaint in writing and can’t take actions that negatively affect your credit score until their investigation is complete [*].
• Credit Card Zero Liability Protection Policies. Most major credit cards, like Visa and Mastercard, protect cardholders from any unauthorized purchases. Credit card servicers with this policy will restore stolen funds after an investigation.  
• Bank Account Zero Liability Policies. Some banks, such as Citizens Bank, OceanFirst, and Truist, offer zero liability protections for your accounts.
• Regulation E. Part of the Electronic Fund Transfer Act (EFTA), Regulation E protects people using electronic funds — including ATMs, direct deposits, and gift cards [*]. If consumers report losses within two days, their liability cannot exceed $50 [*].

What If Your Bank Won’t Refund You?

• File a complaint with the Federal Reserve. They’ll send your complaint to the appropriate federal regulator or Reserve Bank for investigation [*]. You should receive an update within 15 days and a result within 60 days.
• File a complaint with the Office of the Comptroller of the Currency (OCC). First, search the OCC database. If your bank or federal savings association is regulated by the OCC, the Office will work to get a resolution within 60 days. Have all of your documentation ready before you file — the form times out after 30 minutes of inactivity [*].
• File a complaint with the National Credit Union Administration (NCUA). If your issue is with a credit union, the NCUA will help you resolve it within 60 days [*]. Situations that extend beyond that time frame will undergo a formal NCUA investigation.

Grappling with hacked bank accounts takes time and effort, and it doesn't always pay off. The best way to monitor your accounts may be to sign up for a digital security provider.

With Aura, you get access to identity theft protection, antivirus software, and phishing protection tools. Aura’s U.S.-based support experts are available 24/7, and every adult on your Aura plan gets  up to $1 million in insurance coverage for eligible losses due to identity theft.

Keep your bank account safe from scammers. Try Aura free for 14 days.