Bank account compromise: what to do first

You check your banking app and see transactions you didn't make. Or your card gets declined and you discover your account is empty. Or you get a fraud alert that might be real or might be a scam itself.

The first hour determines how much money you lose and how long recovery takes. Here's the exact sequence of steps to take immediately, what each action protects, and why timing matters more than you think.

Step 1: Lock the compromised account immediately

Before you call anyone, before you investigate, before you do anything else, lock the account.

Most banks offer instant card locks through their mobile app. This stops new transactions immediately without closing the account. If you can't find the lock feature, log into online banking and look for "freeze card," "stop payments," or "temporary block."

If you don't have app access and can't log in, call the fraud number on the back of your card. Not the number in the suspicious text message. Not the number that called you. The number physically printed on your card. If you don't have your card, search your bank's name plus "fraud department" on their official website.

This step protects you from additional unauthorized transactions while you figure out what happened. Every minute the account stays active, the attacker can drain more money.

Step 2: Verify you're actually talking to your bank

Scammers send fake fraud alerts with callback numbers that connect you to attackers, not your bank. They impersonate bank representatives to extract account details, verification codes, or remote access to your devices.

The FBI warns that tech support and bank impersonation scams often start with urgent notifications about suspicious activity. The pressure to act fast is the attack.

Never call a number from a text, email, or voicemail claiming to be your bank. Hang up and call the number on your card or your bank's official website. Yes, even if the caller ID looks legitimate. Caller ID is trivially spoofed.

If someone claiming to be from fraud prevention asks you to move money to a "safe account," download remote access software, or share verification codes, you're talking to a scammer. Banks never ask for those things.

Step 3: Document everything you see

Before the bank resets anything, before transactions disappear from your history, before the interface changes, take screenshots of everything.

Capture:

• Every unauthorized transaction with date, time, amount, and merchant
• Your account balance before and after the fraud
• Any pending transactions
• Fraud alerts or notifications you received
• Login history showing unfamiliar locations or devices
• Any emails or texts claiming to be from your bank

Save these to a folder on your device and email them to yourself as backup. You'll need this documentation for the fraud report, the police report, and potentially for disputing charges later.

Banks typically resolve fraud cases within 10 business days, but complex investigations can stretch to 45 days. During that time, your memory of what happened will fade. The screenshots won't.

Step 4: Report the fraud to your bank's fraud department

Once you've locked the account and documented the damage, call your bank's fraud department using the number from your card or their official website.

Tell them:

• When you first noticed the unauthorized activity
• Which transactions are fraudulent
• Whether you still have physical possession of your card
• Whether you've shared your PIN, password, or verification codes with anyone
• Whether you've clicked links in emails or texts claiming to be from the bank

The representative will likely freeze your account, cancel your card, and open a fraud investigation. They'll send you an affidavit to sign confirming which transactions are unauthorized.

Federal law limits your liability for unauthorized debit card transactions to $50 if you report within two business days of discovering the fraud. After that, you could lose up to $500. After 60 days, you could lose everything in the account. Credit cards offer stronger protection with zero liability, but you still need to report promptly.

Ask the representative:

• What happens to pending transactions
• When you'll receive provisional credit
• How long the investigation will take
• Whether you need to file a police report
• How to access your account while the card is canceled

Step 5: Check for additional compromised accounts

Attackers rarely stop at one account. If they have your banking credentials, they might have your email password, your credit card numbers, or access to other financial accounts.

Log into:

• Other bank accounts
• Credit card accounts
• Investment accounts
• Payment apps (Venmo, PayPal, Cash App, Zelle)
• Retirement accounts
• Any account linked to the compromised bank account for automatic payments

Look for unfamiliar transactions, changed contact information, new linked accounts, or login activity from locations you don't recognize. If you find anything suspicious, lock those accounts immediately and report fraud.

Check your email for password reset notifications, account changes, or login alerts you didn't trigger. Attackers often compromise email first to intercept bank notifications and reset passwords.

Step 6: Change your passwords and enable two-factor authentication

If attackers accessed your account through stolen credentials, those credentials are still valid until you change them.

Change passwords for:

• Your bank's online banking
• The email address associated with your bank account
• Any other financial accounts
• Any account where you reused the same password

Use strong, unique passwords for each account. If you're not using a password manager, now is the time to start. Reused passwords turn one breach into a skeleton key.

Enable two-factor authentication on every account that offers it. Authenticator apps are stronger than SMS codes, but SMS is better than nothing. This adds a second verification step that makes it much harder for attackers to access your accounts even if they steal your password.

Step 7: Monitor your credit reports

Bank account compromise often leads to identity theft. Attackers use stolen banking information to open new credit accounts, apply for loans, or file fraudulent tax returns in your name.

Request free credit reports from all three bureaus at AnnualCreditReport.com. Look for:

• Accounts you didn't open
• Hard inquiries you didn't authorize
• Addresses you've never lived at
• Employment information that's incorrect

If you find fraudulent accounts, dispute them immediately with the credit bureau and the company that opened the account. File an identity theft report with the FTC at IdentityTheft.gov and consider placing a fraud alert or credit freeze.

A fraud alert tells creditors to verify your identity before opening new accounts. A credit freeze blocks new credit applications entirely until you lift it. Both are free.

Step 8: File a police report

Most banks require a police report for fraud investigations over a certain threshold, typically around $1,000. Even if your bank doesn't require it, file one anyway.

The police report creates an official record of the crime. You'll need this documentation for:

• Your bank's fraud investigation
• Disputing fraudulent accounts with credit bureaus
• Filing an identity theft affidavit with the FTC
• Potential legal action against the fraudster
• Insurance claims if you have identity theft coverage

Bring your documentation: account statements, screenshots, the timeline of events, and any communications with the bank. Ask for a copy of the report and the case number.

Law enforcement probably won't catch the person who drained your account. Most financial fraud is committed remotely by organized groups operating across borders. But the report itself serves as legal evidence that you're a victim, not a participant.

Step 9: Report the fraud to federal authorities

The FTC's fraud reporting platform collects data that law enforcement uses to identify patterns and build cases against large-scale fraud operations. Your individual report might not result in an arrest, but it contributes to investigations that shut down scam networks.

If the fraud involved wire transfers, cryptocurrency, or investment schemes, also file a complaint with the FBI's Internet Crime Complaint Center (IC3). The IC3's 2023 annual report shows that consumer losses from financial fraud exceeded $12.5 billion that year.

These reports matter. The FTC's Consumer Sentinel Network aggregates fraud reports from multiple agencies and shares the data with law enforcement. The more detailed your report, the more useful it is for identifying trends and tracking criminals.

Step 10: Set up account alerts and monitoring

Once your account is secure and you've reported the fraud, configure alerts to catch future unauthorized activity faster.

Most banks offer:

• Transaction alerts for purchases over a certain amount
• Login alerts for new devices or locations
• Balance alerts when your account drops below a threshold
• Alerts for failed login attempts
• Alerts for account changes like new linked accounts or updated contact information

Set these up through your bank's mobile app or online banking. Choose notification methods you'll actually see, text, email, or push notifications.

Some banks offer free credit monitoring that alerts you to new accounts, hard inquiries, or significant changes to your credit report. If your bank doesn't offer this, consider a service like NordProtect that monitors your identity across multiple data sources.

What happens during the fraud investigation

After you report fraud, your bank opens an investigation. Here's what actually happens behind the scenes.

The bank reviews transaction records, IP addresses, device fingerprints, and geolocation data to determine whether the transactions were authorized. They'll compare the fraud pattern to your normal account activity and look for indicators of compromise like logins from unfamiliar locations or rapid sequences of transactions.

For debit card fraud, the bank typically issues provisional credit within 10 business days while the investigation continues. This means you get the money back temporarily, but the bank can reverse it if they determine the transactions were authorized.

Credit card fraud investigations work similarly, but federal law provides stronger consumer protections. You're not liable for unauthorized charges, and the card issuer can't hold you responsible while they investigate.

If the investigation finds that you authorized the transactions, even if you were tricked by a scammer, the bank might deny your claim. This happens frequently with authorized push payment fraud, where you're manipulated into sending money yourself. Banks argue that you initiated the transfer, even if you were deceived.

How to prevent this from happening again

Bank account compromise happens through multiple attack vectors. Here's what actually protects you going forward.

Use unique passwords for every financial account. Credential stuffing attacks succeed because people reuse passwords across sites. When one site gets breached, attackers test those credentials everywhere.

Enable two-factor authentication on your bank account, email, and any account linked to your finances. Authenticator apps are stronger than SMS, but both add meaningful protection.

Never click links in emails or texts claiming to be from your bank. Phishing attacks are the most common entry point for account compromise. When you need to access your account, type the URL directly or use your saved bookmark.

Review your account activity weekly, not monthly. The faster you catch fraud, the easier recovery becomes and the less money you lose.

Use a credit card for online purchases instead of a debit card. Credit cards offer stronger fraud protection and don't directly access your bank account.

Don't share verification codes with anyone, ever. Your bank will never call and ask for a code sent to your phone. That's always a scam.

In The X-Files, Mulder keeps a poster in his office: "I Want to Believe"

The poster shows a UFO. It's aspirational. It's also a reminder that wanting something to be true doesn't make it true.

You want to believe the fraud alert is real. You want to believe the person on the phone is actually from your bank. You want to believe that clicking "verify account" will solve the problem instead of causing it.

Attackers exploit that impulse. They create urgency, they impersonate authority, they make the scam feel more legitimate than the actual security measures your bank uses.

The defense isn't skepticism for its own sake. It's verification. It's the discipline to hang up and call back using a number you trust. It's the habit of checking your account weekly instead of waiting for an alert. It's the recognition that convenience and security exist in tension, and sometimes the inconvenient path is the only safe one.

Bank account compromise isn't a technical failure. It's a human one. The technology works. The fraud succeeds because we're tired, distracted, or convinced that this time, the urgent message is real.

It almost never is.