Someone Is in Your Bank Account: What to Do in the First Hour

You open your banking app and something is wrong. A transfer you did not make. A new payee you have never heard of. Maybe an alert says your password was changed, or your balance is suddenly lower than it was this morning. Your heart starts racing, and it is hard to know what to do first.

The first hour matters. Acting quickly can stop more money from leaving, protect your other accounts, and put you in a stronger position to get money back. The steps below are in order of urgency. Keep this page handy, or better yet, read it now while everything is fine, so you know the drill if it ever happens.

Step 1: Call your bank using a number you trust

Your first call should go to your bank's fraud line. Use the phone number on the back of your debit card, on your printed statement, or inside the bank's official app. Do not call a number from a text message, email, or pop-up, even if it looks official. Criminals often send fake fraud alerts to steer victims to their own phone lines.

Tell the representative that there is unauthorized activity on your account. Ask them to freeze or restrict the account, cancel any cards linked to it, and stop pending transfers if possible. Write down the date, time, the representative's name, and any case or reference number they give you.

If you cannot get through right away, use the bank's app or website to lock your debit card and report fraud while you keep trying the phone.

Step 2: Lock your cards in the app

Most banking apps let you turn a debit card off with one tap. Do it now, even if the bank says it is canceling the card. It takes seconds and blocks most new card transactions right away. If you have credit cards with the same bank or linked to the same login, lock those too until you know what happened.

Step 3: Change your passwords from a safe device

If someone got into your online banking, they may have your password, or access to your email or phone. Change your banking password from a device you trust, ideally not the one you suspect might be compromised. Make it long and unique, not a variation of an old one.

Then change the password on the email account tied to your bank. Email is often the master key, because it is where password reset links go. While you are there, check that no one added a forwarding rule or a new recovery email or phone number.

Turn on two-step verification for both your bank and your email if it is not already on. An authenticator app or a passkey is generally stronger than text-message codes. Many banks also let you sign out of all devices and sessions, which kicks out anyone who is currently logged in.

Step 4: Look for changes the intruder made

Criminals who get into an account often change settings to keep control and hide their tracks. Go through your account settings and look for:

• New payees, linked external accounts, or recurring transfers
• A changed mailing address, email address, or phone number
• Turned-off alerts or changed notification settings
• New debit cards ordered or new devices registered
• Changes to your linked payment apps

Report anything unfamiliar to the bank on the same call or in a follow-up. Do not delete evidence yourself. Screenshot it first so the bank can see exactly what was changed.

Step 5: Document everything

Take screenshots of every unauthorized transaction, including the amount, date, and description. Save any suspicious texts or emails, but do not click links in them. Keep a simple log of each call: who you spoke to, when, and what they said they would do.

This paper trail helps the bank investigate and helps you if you need to follow up or escalate later. It also comes in handy if you file reports with other agencies.

Step 6: Check your other accounts

If one account was breached, others may be at risk, especially if you reused the same password. Check your savings accounts, credit cards, payment apps, retirement accounts, and any other financial logins. Change passwords anywhere you used the same or a similar one, starting with accounts that hold money.

Also think about how the intruder got in. Did you recently click a link in a text about a package or a bank alert, download an unfamiliar app, or log in on a shared computer? Knowing the likely entry point helps you close it. If you suspect your phone or computer has malware, run a security scan or have it checked before using it for banking again.

After the first hour: know your rights and deadlines

Federal rules for electronic transfers give you protections, but timing matters. If your debit card or login credentials were lost or stolen, telling your bank within two business days of learning about it generally limits your liability for unauthorized transfers to $50. Waiting longer can raise that limit to $500. For unauthorized transfers that show up on a statement, you generally need to report them within 60 days of when the statement was sent, or you risk losing protection for later losses.

Banks are generally required to investigate reported errors and usually must resolve them within set timeframes, often 10 business days. If the investigation takes longer, the bank typically must provisionally credit your account while it continues. Follow up in writing, and keep copies of what you send.

If the bank denies your claim and you believe it is wrong, ask for a written explanation and the documents it relied on. You can ask to speak with a supervisor or the bank's complaints department. If that does not resolve things, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov, which forwards it to the bank and asks for a response.

Some banks ask for a police report as part of a fraud claim, and a report can also help if your identity was used elsewhere. Your local police department may let you file online for financial crimes. Keep a copy of the report number with your other notes.

Protect yourself from what comes next

Fraud often comes in waves. After a breach, you may get calls or texts from people pretending to be your bank's fraud team, offering to help recover your money. A real bank will not ask you to read back a one-time code, move money to a safe account, or share your full password. Hang up and call the number on your card instead.

If your personal information may have been exposed, consider freezing your credit at Equifax, Experian, and TransUnion, which is free. You can also report identity theft to the Federal Trade Commission at IdentityTheft.gov, which creates a recovery plan based on your situation.

A little preparation now

The best time to prepare for a breach is before it happens. Turn on transaction alerts for every account, so you hear about activity within minutes. Save your bank's fraud number in your phone contacts. Use unique passwords and two-step verification. If something does go wrong, you will be able to move through these steps calmly and fast, which is exactly what the first hour calls for.