Discovering that someone has accessed your bank account is frightening, but what you do in the first hour makes a big difference. Banks can often stop payments, block cards and begin investigations quickly when they hear early. This guide gives you a clear emergency plan, in order, so you know exactly what to do.
Last updated: October 2026. Rules and deadlines vary by country and bank, so use this as a general guide and follow your bank’s instructions. This is not legal advice.
This article is part of our full series on protecting your bank account from hackers.
Signs your bank account may have been hacked
- Transactions you do not recognise, even small ones
- Alerts about logins, password changes or new payees that you did not make
- Being locked out of your account or your password no longer working
- Messages or calls from your bank about activity you did not do
- Your phone suddenly losing signal, which can signal a SIM swap
- New accounts or credit applications in your name that you did not open
The emergency plan: what to do, in order
Step 1: Contact your bank immediately
Call your bank using the official number on the back of your card or on its website, not a number from a message or caller. Tell them you suspect fraud, and ask them to block your cards, stop pending payments if possible, and restrict access to the account. Ask whether any payments can be recalled. Note the time, the name of the person you speak to, and any reference number.
Step 2: Lock your cards
If you can, freeze your cards in your banking app straight away. Our guide on how to lock your bank account and cards shows you how. Ask your bank to issue replacement cards with new numbers.
Step 3: Secure your email and phone account
Criminals who reach your bank often get in through your email or your mobile number. From a device you trust, change your email password to a new, unique one and turn on strong two-factor authentication. Check your email for suspicious forwarding rules or filters that could be hiding bank messages. Contact your phone provider if you suspect a SIM swap, and set a PIN on your account.
Step 4: Change your banking password and review access
Use a clean device. Change your online banking password, review any devices or sessions that are logged in and sign out of all of them, and remove any payees or connected apps you do not recognise. A password manager helps you create strong, unique passwords quickly. Then upgrade your login protection using our guide to two-factor authentication and passkeys.
Step 5: Scan your devices for malware
If your computer or phone may have been infected, run a full security scan with reputable software, and make sure your system is updated. Remove any apps you do not recognise, especially remote access tools you did not install yourself. If you are unsure, a factory reset may be the safest option, after backing up your important files.
Step 6: Document everything
Write down what happened and when. Save screenshots of suspicious transactions, messages and emails, and keep copies of any reference numbers. This information is useful for your bank, the authorities and any dispute.
Step 7: Report the fraud
Report the incident to the authorities in your country:
- United States: Report identity theft to the Federal Trade Commission through IdentityTheft.gov, and consider reporting internet crime to the FBI’s Internet Crime Complaint Center.
- United Kingdom: Report fraud to Action Fraud, or Police Scotland if you live in Scotland.
- Europe: Report to your local police and your national fraud reporting service.
Step 8: Protect your identity
If personal details were exposed, take steps to stop criminals using them elsewhere. In the US, a credit freeze is free and effective, and you can read how in our guide to freezing your credit. Check your credit reports for accounts you did not open, and watch your statements closely for the next few months.
Step 9: Follow up with your bank in writing
After your phone call, send a written follow-up through your bank’s secure messaging or by letter, confirming the transactions you dispute. Keep a copy, and ask about the timeline for the investigation and any refund.
What are your rights to a refund?
Your rights depend on where you live and how the fraud happened. The key point everywhere is to report it as soon as you can.
United States
For unauthorised debit card or electronic transfers, federal rules limit your liability, but the amount depends on how quickly you report. In general, reporting within two business days of learning of the loss caps your liability at $50. Reporting later can raise your liability, and waiting more than 60 days after the statement showing the fraud can leave you exposed to much larger losses. For credit cards, federal law generally limits your liability for unauthorised charges to $50, and many issuers offer zero-liability protection. Check your bank’s own policy.
United Kingdom
Banks generally must refund payments you did not authorise. Since October 2024, mandatory rules require banks to reimburse many victims of authorised push payment (APP) fraud, where you were tricked into sending the money. The cap is £85,000 per claim for Faster Payments and CHAPS, and you must report within 13 months of the last payment. Banks must normally decide within a few working days, though there are exceptions. If you disagree with your bank’s decision, you can complain to the Financial Ombudsman Service.
European Union
Payment services rules generally oblige banks to refund unauthorised transactions promptly, with limited exceptions, such as gross negligence or fraud by the customer. Rules vary by country, so check with your bank and national consumer authority.
What not to do
- Do not use a phone number or link from a suspicious message. Find your bank’s contact details yourself.
- Do not pay anyone who offers to “recover” your money for a fee. Recovery scams target fraud victims.
- Do not delay. Time limits and early reporting often affect refunds.
- Do not feel ashamed. Fraud is a crime, and victims include careful, intelligent people.
After the emergency: prevent it happening again
- Use unique passwords and a password manager.
- Switch to passkeys or an authenticator app.
- Turn on instant alerts and sensible limits.
- Learn the scam patterns in our guide to common bank scams.
- Review your accounts regularly.
Frequently asked questions
Will I get my money back after a bank hack?
In many cases, yes, particularly for unauthorised transactions that you report quickly. The details depend on your country, your bank, and how the fraud occurred.
How fast do I need to report fraud?
As soon as possible. In some places, such as the US, the speed of your report can change how much you are liable for.
Should I close my bank account after being hacked?
Not always. Your bank may be able to secure the account and issue new card numbers. If the account is seriously compromised, your bank may recommend opening a new one.
Who do I report bank fraud to?
Report it to your bank first, then to the authorities in your country, such as the FTC in the US or Action Fraud in the UK.
Can someone empty my account with just my phone number?
Not usually on its own, but a phone number can help criminals with account recovery or SIM swapping, which is why securing your mobile account matters.
Speed matters most. Call your bank, lock your cards, secure your email and phone, and document everything. Then work through the rest of the plan, one step at a time.
