Bank Account Hacked? Here's What To Do Right Now (Expert Tips)

Modern cybercriminals are cunning, creative, and highly skilled. They have countless ways of tricking you into revealing your banking info. The consequences of a successful phishing attack can range from financial loss to identity theft.

You can keep your bank accounts safe by learning to recognize common scams and using strong antivirus protection. With so many elaborate schemes around, spotting a scammer can be challenging.

Keep reading to learn how to flag hacked bank accounts and deal with ongoing attacks.

What to do if you discover a bank account hack

We can’t overstate the importance of staying vigilant and reacting quickly. Recognizing a financial scam in time can save you a lot of time, money, and stress. Here’s what to do if you suspect a hacked bank account.

1. Change your passwords immediately

If you can still log in, immediately change your password and personal identification number (PIN). You should always use a different password for multiple accounts. We also recommend enabling two-factor authentication (2FA) for extra security. Finally, take advantage of biometric login options or verbal passwords if available.

2. Alert your bank

If you suspect a hack, your bank should know as soon as possible. Major financial institutions have 24/7 fraud-related customer service devoted to providing safe online banking to their customers. Your bank can help you cancel your cards, hunt down fraudulent transactions, and implement other safety protocols.

3. Freeze your credit

First, request a credit report from one or all major credit bureaus (Equifax, Experian, TransUnion). Then, enact a credit freeze to prevent lenders from accessing your credit report. Freezing your credit prevents scammers from opening new accounts or obtaining loans in your name.

You can request a credit freeze from the three major credit bureaus:

• Equifax
• Experian
• TransUnion

4. Report the hack to the authorities

You can report a hack to several institutions, including local police, the Federal Bureau of Investigation (FBI), and the Federal Trade Commission (FTC). They can help you recover from a hack and teach you how to secure your banking info and other online accounts. Filing a police report and contacting federal organizations will enrich their fraud databases.

5. Dispute fraudulent debts and credit card charges

The Fair Credit Billing Act (FCBA) allows you to withhold payment for any disputed amount for 90 days. (More on this below.) Start by contacting the merchant and demanding a refund for the fraudulent charge.

Then, contact your credit card issuer. By law, you’re not liable for more than $50 for an unauthorized purchase, but most issuers offer $0 liability. Note that you can only dispute charges already posted to your account and have at least 60 days to dispute fraudulent transactions.

6. Run a malware scan

Criminals who use phishing attacks can infect you with keyloggers and secretly steal your data. A keylogger is a type of spyware that records your keystrokes — gathering passwords, credit card numbers, and more. You can unknowingly install it by clicking a malicious phishing link, image, or even a pop-up ad.

A malware scan will remove keyloggers from your system and protect your personally identifiable information (PII). We recommend running malware checks regularly, not only when you notice something suspicious. In addition to dealing with malware infections, they can proactively prevent identity theft, data leaks, bank account hacks, and more.

Is your bank account hacked? Here’s how to tell

Here are some of the common red flags that could indicate a hacked online banking account:

• Suspicious transactions: If you see transactions you didn’t make, you may have been hacked. Every unauthorized transaction, no matter how small, is a potential security risk.
• Unauthorized changes to your account information: Note if your security questions, passwords, or contact details have changed without your input.
• Missing bank statements: If you stop receiving monthly bank statements — or other regular communication from your bank — hackers have likely changed your account’s email address.
• Failed login attempts: A scammer has likely locked you out if you can’t log in to your online bank account. If your login credentials don’t work, you should alert your bank immediately.
• Unauthorized account closure: If your account closes unexpectedly, it’s likely fraud.
• Plummeting cash balance or a declined debit card: A checking account suddenly at $0.00 is a surefire sign of identity theft. You may only find out about this once your debit card is declined.
• Bank notifications: You should never ignore suspicious activity alerts on your online account. For example, some banks will notify you about transactions over a certain amount. That said, phishers love to use these types of messages to trick people into sharing sensitive info. We recommend learning to recognize phishing emails before any interaction with official-looking correspondence.
• Denial of credit: Identity thieves can borrow money in your name and ruin your credit score. Malicious activity could result in your inability to get a line of credit.

Best antivirus programs to protect your bank account

A strong antivirus program can protect your online accounts from malware, phishing, data breaches, identity theft attempts, and more. Here are our top picks:

TotalAV offers excellent antivirus protection, zero-day cloud scanning, protection against phishing and ransomware, and even detects malicious apps for you. Some of its extras include system tune-up tools, a disk cleaner, an ad blocker, a virtual private network (VPN), and much more.

Bitdefender offers comprehensive malware protection and guards you against phishing, fraud, and advanced stealth viruses. It also provides a rescue environment for removing persistent rootkits. Bitdefender will detect when you visit a banking site, prompting you to launch it in its Safepay-protected browser.

Do banks refund money stolen from hacked accounts?

It depends on how quickly you act and what type of account was affected.

Credit card fraud

If the fraud involved a credit card, the Fair Credit Billing Act (FCBA) gives you up to 60 days from your billing statement date to dispute unauthorized charges in writing. Your liability is capped at $50 — and most major issuers offer $0 liability, meaning you won't be on the hook for anything. Note that the FCBA only applies to charges of $50 or more, and disputes must be submitted in writing, not just reported by phone.

During the investigation, you're not required to pay the disputed amount, and the creditor has up to 90 days to complete their review. If the dispute is resolved in your favor, the charge is removed from your account.

Debit card and bank account fraud

Debit card fraud is governed by a different law — the Electronic Funds Transfer Act (EFTA) — and the rules are less forgiving. Your liability depends on how quickly you report the fraud:

• Report within 2 business days: Liability is capped at $50.
• Report between 2 and 60 days: Liability can rise to $500.
• Report after 60 days: You could be liable for the full amount of any unauthorized transfers.

This is why acting fast is critical. The sooner you notify your bank, the more protection you have.

Will your bank give you a full refund?

Legally, you're protected up to the limits above — but in practice, many banks go further. Most major financial institutions offer zero-liability policies for both credit and debit fraud, meaning they'll refund the full amount as long as you report promptly and didn't contribute to the loss through negligence. Contact your bank directly to understand their specific policy.

Bottom line

A hacked bank account is a financial and cybersecurity nightmare. Fortunately, you can minimize the damage by acting fast. If you spot a hack, you can change your passwords, enable 2FA, report it to your bank and the authorities, freeze your credit, and run a malware scan.

If you want to hack-proof your bank account, we recommend learning all about phishing, adopting good cybersecurity habits, and using strong antivirus protection.

FAQs