Your Bank Account Just Got Hacked — Here's What to Do in the First 10 Minutes

I was scrolling through my bank app on a Tuesday afternoon, waiting for a coffee order, when I saw a charge for $847.13 at a store I’d never heard of in a state I’ve never visited. My stomach dropped. That’s the moment every account holder dreads — and the next ten minutes matter more than anything you do later. Here’s exactly what I did, and what you should do, step by step, without panicking.

First, don’t click around aimlessly. Open your banking app or website and look for the option to freeze or lock your card or account. Most major banks — Chase, Bank of America, Wells Fargo — place this under “Card Services” or “Security.” I found mine under a tab labeled “Manage Card.” Tap it, confirm, and your account is frozen instantly. That stops any new transactions from going through. If you can’t find the freeze option, call the number on the back of your card immediately. I keep that number saved in my phone under “Bank Emergency.” While you’re on the call, write down the time you reported it and the representative’s name. This creates a paper trail.

Next, check for other suspicious activity. Look at recent transactions, not just the big one. Hackers often test with small amounts — $0.50, $1.00 — before the big hit. I found three small charges from the same store two days earlier that I’d missed. Screenshot everything. You’ll need those for your bank’s fraud team and possibly for a police report later.

Step-by-Step: How to Freeze Your Account and Stop the Bleeding

Freezing your account isn’t the same as closing it. A freeze prevents all transactions — debit, credit, transfers — without canceling the account itself. Here’s the process I followed:

• Via mobile app: Log in, go to “Security” or “Card Services,” and select “Freeze Card” or “Lock Account.” I use Face ID, so it took 20 seconds. Some apps require a text confirmation code — have your phone handy.
• Via online banking: Same steps, but on a computer. If you’re logged in, look for a red “Freeze” button. I had to scroll down past my balance to find it.
• Via phone call: If you can’t log in (maybe they changed your password), call the 24/7 number. Tell the automated system “fraud” or “lost card” to skip the queue. I got through in under two minutes.

A common pitfall: don’t just delete the transaction from your statement. That doesn’t stop future charges. And don’t try to dispute the charge before freezing — the freeze is step one, the dispute is step three. Also, if you have linked accounts (like a savings or credit line), freeze those too. Hackers sometimes move money between accounts before draining them.

Calling Your Bank: What to Say and What to Ask For

Once your account is frozen, call your bank’s fraud department — not the general customer service line. The number is usually different and printed on your statement or in the app. Here’s the script I used:

“Hi, I’m reporting unauthorized transactions on my checking account. I’ve already frozen the card. I need to file a fraud claim and get a provisional credit for the stolen amount. Can you confirm the claim number and timeline for investigation?”

Key questions to ask:

• “What’s the claim number?” Write it down. I keep mine in a notes app labeled “Fraud Claims.”
• “How long until I get a provisional credit?” Most banks offer this within 10 business days, but some do it in 24 hours for small amounts. My bank credited $847.13 back in 5 days.
• “Will I need a new account number and card?” Usually yes, but ask. I got a new card within 3 business days.
• “Are there any fees for this?” Don’t accept any. Federal law prohibits most fees for fraud resolution.

If the representative seems unsure, ask to speak to a fraud specialist. I once spent 20 minutes with a general rep who couldn’t process the claim. The specialist handled it in 5 minutes.

After the Freeze: Securing Your Digital Life and Next Steps

The freeze stops the bleeding, but the real work is making sure it doesn’t happen again. Here’s what I did in the next 24 hours:

• Change all passwords — not just your bank login. I changed my email password (hackers often use it to reset bank passwords), my phone carrier account (SIM swaps are common), and any retail accounts that stored my debit card. Use a password manager — I use Bitwarden — to generate unique, 16-character passwords.
• Enable two-factor authentication (2FA) on your bank account. If you already had it, check that it wasn’t changed. I use an authenticator app (Google Authenticator) rather than SMS, because SMS can be intercepted. Worth bookmarking this guide: How to Set Up Two-Factor Authentication for Banking.
• Monitor your credit reports. Request a free credit freeze at Equifax, Experian, and TransUnion through AnnualCreditReport.com. This prevents new accounts from being opened in your name. I did this within an hour. Also check your credit report for any unfamiliar accounts — I found none, but it’s worth doing.
• File official reports. If the hack involved identity theft (like opening new accounts), file a report at IdentityTheft.gov (FTC). If it’s just unauthorized transactions, a police report isn’t always required, but it helps if the bank disputes your claim. I filed one online with my local police department — they gave me a case number in 15 minutes.

One counter-intuitive insight: don’t close your bank account immediately. Freezing is often enough. Closing can disrupt automatic payments (like rent or utilities) and accidentally trigger late fees or credit score dips. Wait until your bank issues a new account number, then transfer automatic payments manually.

FAQ: Your Most Urgent Questions Answered

Am I responsible for money lost if my bank account is hacked?

Under federal law (Regulation E), your liability is limited to $50 if you report the fraud within 60 days. Most banks go further with zero-liability policies — meaning you get everything back — if you report promptly. I reported within 10 minutes and got the full $847.13 back. But if you wait months, you could lose everything. Act fast.

How long does it take to get my money back after a hack?

Banks typically investigate within 10 business days. You may get a provisional credit sooner — I saw mine in 5 days — but full resolution can take up to 90 days for complex cases (like if the hacker also compromised your email). Patience is key, but follow up weekly.

Should I close my bank account after a hack?

Not always. Freezing is often enough. If you close prematurely, you might miss automatic payments or damage your credit history. Talk to your bank’s fraud team first; they’ll usually issue a new account number without closing the old one entirely.

Can hackers still access my account after I change my password?

Yes, if they have other info — like your phone number (for SIM swapping) or email access. Always enable 2FA and check for unauthorized devices or linked accounts (like Venmo or PayPal). I found a linked Venmo account I didn’t recognize; I removed it immediately.

Do I need to file a police report for a hacked bank account?

Not always required, but it helps if the bank disputes your claim or if identity theft is involved. File with local police or the FTC at IdentityTheft.gov. I filed a report online — it took 15 minutes and gave me a case number that made the bank’s fraud team move faster.

Practical Takeaway: The first 10 minutes are your best defense. Freeze your account, call the fraud department with a script, and then secure your digital life. You’ll get your money back — and sleep better knowing you stopped the hack before it got worse.