- Bank Account Hacked? What to Do in Ten Steps (you are here)
- Account Compromise: Why Speed Sets the Size of Your Loss
If someone hijacks your money or identity, speed is your best defense. Freeze your cards and call the fraud number on the back of your card. Then take back your email and phone number, because every other account resets through them. Report each unauthorized debit within two business days and confirm it in writing, read every statement within 60 days, and freeze your credit. The law limits what you lose according to how fast you report, not how careful you were.
Why it matters: Acting within days can decide whether the money comes back.
Summary: Freeze your cards and call the fraud line on the back of your card, then take back your email and phone number, because every other account resets through them. Report every unauthorized debit within two business days and confirm it in writing, read each statement within 60 days, and freeze your credit; the law caps your loss by how fast you report, not by how careful you were.
- Reporting a stolen debit card on day 2 costs at most $50; on day 20, up to $500; after the 60-day statement window, $500 plus everything taken after that window closes.
- Carelessness, such as writing a PIN on the card, cannot raise your liability; delay can.
- Text-message codes stopped 76% of targeted takeovers in Google’s study; security keys stopped all of them.
- Business accounts, brokerage accounts, paper checks and wires sit outside the consumer debit rules.
Throughout this volume we follow a single filer earning $75,000; for that household, reporting on day 120 instead of day 2 in this chapter’s example costs about one net paycheck of $2,163.60.
Discovering a compromise — an unfamiliar charge, a password-reset email you didn’t request, a phone that suddenly has no signal, a letter about an account you never opened — produces panic, and panic produces mistakes. The order below is built around one idea: close the doors an attacker can still use before cleaning up what they already did. Your email and phone number are the master keys to almost every other account, because password resets go through them.
- 1. Stop the bleeding. Freeze or lock affected cards in your banking app, then call the fraud line using the number printed on the back of your card or on the bank’s official website — never a number from a text, email or caller. Ask the bank to block further transfers and to note the date and time of your report.
- 2. Secure your email first. From a device you trust, change the password, sign out all other sessions, and check for forwarding rules, recovery addresses or phone numbers the attacker may have added. Whoever controls your email can reset everything else.
- 3. Secure your phone number. If your phone lost service unexpectedly, call your carrier from another phone: this is the sign of a SIM swap or port-out. Set an account PIN and turn on the carrier’s free number-lock or port-out protection. FCC rules adopted in Nov 2023 will require carriers to offer one, but compliance was postponed in July 2024, so ask for it rather than assuming it is on.
- 4. Change credentials and revoke sessions. Use a password manager to give every financial account a unique, long password. Sign out of all devices. Turn on phishing-resistant multi-factor authentication — passkeys or a hardware security key — where offered, and an authenticator app elsewhere; text-message codes are the weakest option because they depend on the phone number.
- 5. Dispute in writing and note the clocks. For debit cards and bank transfers, Regulation E limits your loss to $50 if you report within two business days of learning of a lost or stolen card, and $500 if later; transfers after 60 days from the statement can be entirely yours. For credit cards, Regulation Z caps your liability at $50, and a written billing-error dispute must reach the issuer within 60 days of the first statement showing the charge. Follow every phone report with a letter or secure message.
- 6. Freeze your credit. Place a free credit freeze at each of Equifax, Experian and TransUnion separately (13.3), and add a fraud alert, which you request from one bureau and it notifies the other two.
- 7. Report it. File at IdentityTheft.gov, the FTC’s site, which produces an official Identity Theft Report and a personal recovery plan; report online fraud to the FBI at ic3.gov. File a police report if a creditor requires one, the thief is known, or the loss is large.
- 8. Preserve evidence. Screenshot messages, transactions, caller numbers and profiles before they disappear. Keep a dated log of every call: who you spoke to, reference numbers, what was promised.
- 9. Lock the government doors. Get an IRS Identity Protection PIN so no one can file a tax return in your name. Create your own my Social Security account at ssa.gov before a thief does, or ask Social Security (1-800-772-1213) to block electronic access to your record.
- 10. Monitor and restore. Check your credit reports at AnnualCreditReport.com, the official free site, and dispute any account you didn’t open. Watch statements for at least a year, and keep the freezes in place — thaw them only when you apply for credit.
Nearly every account has a “forgot password” door, and it opens with a link sent to your email or a code sent to your phone. Whoever controls those two channels can reset the bank, the brokerage and the payment apps without ever knowing a password, then change the recovery details so you cannot get back in. That is why steps 2 and 3 come before changing any other password: a new password set while the attacker still reads your email can be reset again within minutes.
A SIM swap attacks the phone channel directly: the thief persuades your carrier to move your number to a SIM card he controls, or to port it to another carrier, and every text code then goes to him. The first sign is your phone showing no service. In Nov 2023 the FCC adopted rules requiring carriers to verify identity before a SIM change or port-out, notify you before it completes, and offer a free lock. A July 2024 FCC order postponed compliance until a separate compliance date is published, and no such notice had appeared in the Federal Register as of Oct 2026, so ask your carrier for its lock rather than assuming it is on.
Google, with researchers from New York University and UC San Diego, measured how well each second step blocked account takeovers (published May 17, 2019). A text-message code blocked 100% of automated bot attacks, 96% of bulk phishing and 76% of targeted attacks; a prompt on a phone you were already signed in to blocked 100%, 99% and 90%; and no user who relied only on a physical security key fell to targeted phishing during the study. The weakness of codes is structural: a fake login page can ask for the code and pass it on in real time. A passkey or security key is tied to the website it was created for, so a look-alike site receives nothing it can use, and nothing reusable is stored on the server. CISA calls text and voice codes a “last resort.” Any second factor still beats a password alone.
| When | What to have done | Steps |
|---|---|---|
| First hour | Cards frozen and bank’s fraud line called; email and phone account secured; passwords changed on the bank and email accounts | 1–4 |
| First day | Written disputes sent; credit freezes at all three bureaus; fraud alert placed; IdentityTheft.gov report filed; evidence saved | 5–8 |
| First week | IRS IP PIN obtained; my Social Security secured; every financial account has a unique password and MFA; credit reports pulled and checked; police report if needed | 7, 9, 10 |
| Next 3 months | Provisional credits and dispute results tracked against the deadlines; follow-up letters for anything unresolved | 5, 10 |
You report an unauthorized $600 debit-card transfer on a Monday. Under Regulation E the bank has 10 business days to investigate. If it needs longer — up to 45 days, or 90 for point-of-sale debit and some other transfers — it must provisionally credit the $600 within those 10 business days, so you are not without the money while it decides. On a credit card, the billing-error rules let you withhold payment of the disputed amount, bar the issuer from reporting it as delinquent while it investigates, and require a resolution within two billing cycles and no more than 90 days.
Three questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. On the same morning you receive password-reset emails you did not request and your phone suddenly loses all signal. What does the lost signal most likely mean, and what do you do?
- A hacked handset; factory-reset it before contacting your bank
- Spyware; install the security app a fraud caller recommends
- A SIM swap; call your carrier from another phone and lock your number
- A network outage; wait for service before changing any passwords
Reveal Answer
Answer: C. Lost service is the sign of a SIM swap or port-out that moves your text codes to a thief. Call the carrier from another phone, set a PIN and turn on number lock (Part 13.4, step 3).
2. You have just discovered a compromise of your bank and email accounts. Which task belongs in the first hour rather than the first day?
- Securing your email account and your phone carrier account
- Mailing written disputes to the card issuer and bank
- Placing credit freezes separately at all three credit bureaus
- Filing an Identity Theft Report online at IdentityTheft.gov
Reveal Answer
Answer: A. The first hour closes the doors still open: cards frozen, the fraud line called, then email and phone secured, because they reset everything else. Freezes, reports and written disputes follow within the day. (Part 13.4)
3. You dispute an unauthorized $600 charge on your credit card two weeks after first spotting it. While the issuer investigates, what do the federal billing-error rules allow?
- Keeping the dispute open on condition you file a police report
- Withholding the $600 without being reported as delinquent
- Owing up to $500 because you waited past two business days
- Paying the $600 first, then waiting up to 45 days for a refund
- Regulation E §1005.11: error resolution — Investigation deadlines
- IdentityTheft.gov — Identity theft reports and recovery plans
- Regulation E §1005.6: liability — Unauthorized-transfer liability
- §1026.12 — CFPB — Regulation Z §1026.12 and §1026.13: credit-card liability and billing errors
- File a complaint — Reporting online fraud
- Get an Identity Protection PIN — Tax identity protection (13.4, A.1)