Bank Account Identity Theft, Report Fraud & Recover Money

If money is missing from your bank account, call your bank’s fraud department now, using the number on your card or statement. Ask it to secure the account, open a written error-resolution case, and give you a case number. Then file a report at IdentityTheft.gov.

Many unauthorized electronic transfers from consumer accounts are protected by the Electronic Fund Transfer Act (EFTA, 15 U.S.C. § 1693 et seq.) and Regulation E (12 C.F.R. Part 1005). Your liability can be limited, but only if you report quickly, and not every type of loss is covered. Wire transfers, forged paper checks, business accounts, and payments you personally authorized after being tricked follow different rules.

Reimbursement is not guaranteed. It depends on the type of transaction, how fast you report, and the facts.

Emergency Checklist: First 24 Hours

Do these in order. Keep notes of dates, times, names, and case numbers as you go.

Within the first hour

[ ] Call the bank’s fraud department (number from your card, statement, or official website, never from a text or email). Name the exact transactions you did not authorize.

[ ] Ask the bank to lock or freeze the account, block the debit card, stop pending transfers, and cancel unknown payees or linked accounts.
[ ] Ask for a case or reference number and ask how to submit a written error notice.
[ ] Secure your email first. Change that password and turn on multifactor authentication. Whoever controls your email can reset other passwords.

[ ] Change your online banking password, PIN, and security questions. Check whether the thief changed your phone number or email on file, and if so, tell the bank.

Within 24 hours

[ ] Send a written dispute to the bank (secure message, letter by certified mail with return receipt, or its official form). List each transaction by date, amount, and description. State that you did not authorize them and that you are giving notice of error under Regulation E. Keep a copy.
[ ] File an FTC report at IdentityTheft.gov and save the report and recovery plan.
[ ] Order your checking-account reports from ChexSystems and Early Warning Services, and your credit reports from AnnualCreditReport.com.
[ ] Place a fraud alert or security freeze on your credit files (free), and ask ChexSystems and Early Warning Services about their freezes.
[ ] Consider a police report. It is not required for Regulation E, but some banks, creditors, and credit bureaus may ask for one.
[ ] Save everything: statements, alerts, texts, emails, screenshots, and call notes.

Within the first week

[ ] Follow up on any written confirmation the bank requires, within 10 business days of an oral report (see the error-resolution section).
[ ] Review all accounts, including savings, linked payment apps, and cards, for other unauthorized activity.
[ ] Update automatic payments and direct deposits if the account number is being replaced.
[ ] If the bank has not acted correctly, submit a complaint to the CFPB at consumerfinance.gov/complaint.

Never: share one-time passcodes with anyone, pay an upfront fee to a “fund recovery” service, or move money into a “safe account” at a caller’s request.

Bank Account Identity Theft vs. Credit Identity Theft

These are related but different, and different laws and deadlines apply. Many victims need to deal with both.

	Bank account identity theft	Credit (credit card or loan) identity theft
What happens	A thief takes over your account, makes unauthorized transfers, or opens a checking or savings account in your name	A thief opens credit cards, loans, or other credit in your name, or uses your existing credit card
Whose money is lost	Often your own money is taken from your account	Typically the lender’s money, with a dispute over what you owe
Main consumer law	EFTA and Regulation E (electronic transfers); UCC Articles 3, 4, and 4A and state law (checks, wires)	Truth in Lending Act and Regulation Z (credit cards: 15 U.S.C. §§ 1643, 1666)
Typical liability cap	Regulation E tiers: $50, $500, or more if you delay (see below)	Credit cards: generally up to $50 for unauthorized use
Reporting window	60 days from the statement showing the problem (key trigger); 2 business days for the lowest cap when an access device is lost or stolen	Billing error notice generally within 60 days of the statement
Reports to check	ChexSystems and Early Warning Services, plus credit reports	Equifax, Experian, TransUnion
Freeze that helps	ChexSystems and Early Warning Services freezes	Credit bureau freeze (does not stop a checking account from being opened)

Quick Facts

Question	Answer
What is bank account identity theft?	Someone uses your identity or credentials to open an account, take over your account, or move your money without permission
First step	Call the bank’s fraud department and secure the account
Where to report	Your bank, IdentityTheft.gov, and the CFPB if the bank fails to resolve the problem
Main federal law	EFTA and Regulation E
Lowest liability tier	$50, if you report within 2 business days after learning of a lost or stolen access device
60-day rule	Report within 60 days after the bank sends the statement showing the unauthorized transfer
Bank investigation time	Generally 10 business days, extendable to 45 days with provisional credit (up to 90 days for certain transactions)
Wire transfers	Generally not covered by Regulation E
FDIC insurance	Protects deposits if a bank fails. It does not reimburse fraud losses
Is a refund guaranteed?	No

What Is Bank Account Identity Theft?

Bank account identity theft happens when someone uses your personal information or banking credentials to commit financial fraud. It generally takes one of four forms.

1. A new account opened in your name

A criminal uses your name, Social Security number, date of birth, and address to open a checking or savings account. They may use it to deposit stolen checks, move stolen money, or run up a negative balance. You may not learn about it until a bank, debt collector, or another bank’s account denial tells you.

An unfamiliar account is not always fraud. It can be a data-entry error or a mix-up with someone with a similar name. Ask the bank to investigate before accepting responsibility.

2. Account takeover

A criminal gains access to your existing account through stolen credentials, a SIM swap, phishing, or a compromised email. They may change your email, phone number, or password, add payees, and move money.

3. Unauthorized electronic transfers

A thief uses your debit card, card number, account and routing numbers, or online banking login to make ATM withdrawals, debit card purchases, ACH payments, bill payments, or payments through apps such as Zelle, Cash App, or Venmo.

4. Misuse of your check or account numbers

Criminals can use your account and routing numbers to create counterfeit checks or set up unauthorized debits. Forged paper checks fall under different rules than electronic transfers.

Bank Account Identity Theft, Emergency Steps, Your Legal Rights, and How to Recover Your Money

Warning Signs

On an existing account

Withdrawals, transfers, or payments you did not make, including small “test” amounts
Password, phone, email, or address changes you did not request
Password-reset emails, one-time passcodes, or login alerts you did not trigger
Locked out of your online account
A debit card declined because your balance was drained
Missing mail, statements, or an unexpected replacement debit card

Signs of a fraudulent new account

Debit cards, checks, or welcome packets from a bank where you have no account
A collection notice for an overdrawn checking account you do not recognize
Another bank denies a checking account application because of a ChexSystems or Early Warning Services report
Unfamiliar accounts or inquiries on a banking-screening report or credit report

Do not ignore small unfamiliar charges. Criminals sometimes test access with a small transaction first.

Your Legal Rights for Unauthorized Electronic Transfers

Which transactions Regulation E covers

For consumer accounts, EFTA and Regulation E generally cover electronic fund transfers such as debit card purchases, ATM withdrawals, ACH debits and credits, and many electronic transfers made through payment apps.

What Regulation E generally does not cover

Domestic wire transfers, which are generally excluded from EFTA (12 C.F.R. § 1005.3(c)(3)) and governed by UCC Article 4A, Federal Reserve rules, and your account agreement. Report immediately and ask the bank to attempt a recall. Time matters even more with wires.
Paper checks, which are governed by UCC Articles 3 and 4 and state law. Banks generally may charge your account only for “properly payable” items, and you have duties to review statements and report forgeries promptly. State deadlines vary, and UCC § 4-406 can bar claims after one year.
Business and commercial accounts, which are generally outside Regulation E’s consumer protections and depend on your agreement and UCC rules.
Credit card fraud, which falls under the Truth in Lending Act (see the table above).

What counts as an “unauthorized” transfer

Under Regulation E (12 C.F.R. § 1005.2(m)), an unauthorized electronic fund transfer is one initiated by someone without actual authority, from which you receive no benefit. It generally does not include a transfer by someone you gave access to, until you notify the bank that this person is no longer authorized.

The CFPB’s official interpretation says a transfer can still be unauthorized if a thief obtained your access device or credentials through fraud or robbery and then initiated the transfer. That matters in many phishing and account-takeover cases.

Liability limits (12 C.F.R. § 1005.6 and 15 U.S.C. § 1693g)

Situation	Your maximum liability, generally
You notify the bank within 2 business days after learning your card or access device was lost or stolen	The lesser of $50 or the amount of unauthorized transfers
You notify after 2 business days (but within 60 days of the statement)	Up to $500
You do not report within 60 days after the statement showing the unauthorized transfer is sent	Potentially unlimited liability for unauthorized transfers made after the 60 days and before you notify, if the bank shows they would not have occurred with timely notice

Important details:

The two-business-day rule is tied to learning of the loss or theft of an access device. The 60-day rule is tied to the statement that shows the unauthorized transfer. They are not interchangeable.
The bank may extend these time limits if extenuating circumstances, such as a long hospital stay or extended travel, kept you from notifying it.
Under Regulation E, a bank generally cannot hold you responsible for more than these limits just because you were careless.
Missing the 60-day mark does not erase all rights. Report the moment you find the problem.
Your bank agreement can offer better protection than the legal minimum, such as zero-liability policies, but not worse.

Error resolution: how the bank must investigate (12 C.F.R. § 1005.11; 15 U.S.C. § 1693f)

Notice of error. You can notify the bank orally or in writing. The bank can require written confirmation within 10 business days of an oral notice. If you miss that, it may not have to provide provisional credit.
Timing. The bank must investigate and determine within 10 business days whether an error occurred.
Extension with provisional credit. If it needs more time, it can take up to 45 days, but must generally give you provisional credit for the disputed amount (with interest if the account earns interest) within the 10 business days and let you use the funds.
Longer timelines. For transfers on new accounts (open less than 30 days), point-of-sale debit transactions, and foreign-initiated transfers, the bank can take up to 90 days. For new accounts, provisional credit may take up to 20 business days.
If the bank finds an error. It generally must correct it within 1 business day of that determination and report the results within 3 business days after completing its investigation.
If the bank finds no error. It must give you a written explanation, tell you that you can request the documents it relied on, and give you those documents on request. If it reverses provisional credit, it must tell you the date and amount, and honor certain items for 5 business days after notice.

Provisional credit is temporary. It can be reversed if the bank concludes, after a proper investigation, that the transfer was authorized.

Can you sue the bank?

EFTA allows a private civil action under 15 U.S.C. § 1693m for actual damages, statutory damages, and attorney’s fees. Treble damages may be available in limited situations, for example where a bank did not conduct a good-faith investigation or knowingly concluded no error occurred without a reasonable basis (§ 1693f(e)). The general limitation period is one year from the violation (§ 1693m(g)). If a significant loss remains unresolved, consult a consumer-law attorney promptly.

What If You Sent the Money Yourself After Being Tricked?

This is harder. If a thief logs into your account or uses stolen credentials to send money, Regulation E may apply. If you approve or send a payment after a scammer deceives you, such as in an imposter scam, a fake “fraud department” call, or a romance scam, the outcome depends on the payment method, how the transfer was initiated, and the facts. Do not assume it is treated the same as unauthorized access.

Still do these right away:

Report to the bank and ask for a written decision explaining how it analyzed the transaction under applicable law.
Ask the bank to try to recall the funds or contact the receiving bank.
Report to the FTC and the FBI’s Internet Crime Complaint Center (ic3.gov) if it involved online fraud.
Check your bank agreement, since some banks provide extra protection beyond the law.

If Someone Opened a Bank Account in Your Name

Step 1: Dispute the account with the bank

Contact the bank’s fraud department. Ask it to investigate, restrict or close the account, and confirm in writing that the account is fraudulent, that you are not responsible for its balance, and that any information it reported about you will be corrected or removed.

Step 2: File an FTC identity theft report

Use IdentityTheft.gov. It creates an Identity Theft Report and personalized recovery plan that you can send to banks and credit bureaus. For a step-by-step guide, read How to Report Identity Theft to the Federal Trade Commission?.

Step 3: Request records of the fraudulent account

Under the Fair Credit Reporting Act, 15 U.S.C. § 1681g(e), identity theft victims can generally request copies of application and business records for fraudulent accounts from the business, free of charge, and the business generally has 30 days to provide them after receiving proof of identity and an identity theft report or affidavit.

Step 4: Check banking-screening reports

Banks often screen deposit-account applicants through ChexSystems or Early Warning Services, not just Equifax, Experian, or TransUnion. Request your reports and dispute inaccurate entries. Under the FCRA, a reporting company must generally investigate within 30 days (45 days in some cases) and the bank that supplied the information has duties to investigate and correct inaccurate data (15 U.S.C. §§ 1681i, 1681s-2).

Official guides:

Step 5: Use FCRA identity theft tools

Identity theft block (15 U.S.C. § 1681c-2): A consumer reporting company must generally block fraudulent information within 4 business days after receiving proof of identity, a copy of an identity theft report, and identification of the information to be blocked.
Fraud alerts (15 U.S.C. § 1681c-1): An initial alert lasts one year, and an extended alert lasts seven years if you provide an identity theft report. Alerts and freezes at the three credit bureaus are free.
Security freeze: A credit freeze prevents new credit from being opened but does not stop a checking account from being opened. Ask ChexSystems and Early Warning Services about their freezes, and confirm each company’s current process and any fees on its official site.

Step 6: Review your credit reports too

Request your reports at AnnualCreditReport.com and dispute unfamiliar accounts. Thieves often use the same stolen information to open credit accounts as well.

Criminal Laws That Apply to Bank Identity Theft

These laws punish the thief. You usually do not need to prove them to get a refund from your bank.

Law	What it covers
18 U.S.C. § 1028(a)(7) (identity theft)	Knowingly transferring, possessing, or using another person’s identification with intent to commit unlawful activity
18 U.S.C. § 1028A (aggravated identity theft)	Using another person’s identity during certain felonies; carries a mandatory 2-year consecutive sentence
18 U.S.C. § 1029 (access device fraud)	Fraud involving counterfeit or unauthorized access devices, including card and account numbers
18 U.S.C. § 1344 (bank fraud)	Schemes to defraud a financial institution or obtain its money by false pretenses; up to 30 years
18 U.S.C. § 1343 (wire fraud)	Fraud using interstate wire communications; up to 20 years
18 U.S.C. § 1030 (Computer Fraud and Abuse Act)	Unauthorized access to protected computers and systems
Identity Theft and Assumption Deterrence Act of 1998	Federal law that made identity theft a federal crime and directed the FTC to assist victims
18 U.S.C. § 3663A (Mandatory Victims Restitution Act)	Court-ordered restitution to victims in qualifying federal offenses

Most states also have their own identity theft and financial fraud laws, and some provide additional victim remedies or record-clearing procedures. Check your state attorney general’s website.

Who to Report to

Organization	What it helps with
Your bank or credit union	Securing accounts, investigating transfers, and disputing fraudulent accounts
IdentityTheft.gov (FTC)	Official identity theft report and recovery plan
ChexSystems and Early Warning Services	Banking-screening reports, disputes, and freezes
Equifax, Experian, TransUnion	Credit reports, fraud alerts, freezes, and blocks
CFPB complaint portal	Complaints when a bank or reporting company fails to resolve the problem
Bank’s regulator (OCC, Federal Reserve, FDIC, NCUA, or state agency)	Complaints about institutions it supervises
Local police	Police report, which some institutions request
FBI IC3 (ic3.gov)	Online and wire fraud reports
State attorney general	State identity theft protections and consumer complaints

A report to the FTC or CFPB does not guarantee repayment. Keep following your bank’s formal dispute process.

What If the Bank Denies Your Claim?

Ask for the denial in writing, with the reasons and the documents it relied on. For covered electronic transfers, you have the right to request them.
Submit more evidence: your FTC report, police report, proof that your credentials were changed or compromised, device or location information, and any messages from the fraudster.
Be accurate about anything you shared voluntarily. Inaccurate statements can damage a valid claim.
Ask for reconsideration or escalation within the bank.
File a CFPB complaint and, where appropriate, a complaint with the bank’s regulator.
Consider a consumer-law attorney for large losses or if you believe the bank ignored Regulation E’s investigation requirements.

How to Protect Your Accounts

Use unique passwords and a password manager.
Turn on multifactor authentication, preferably an authenticator app or security key.
Never share one-time passcodes. Banks do not ask for them.
Set alerts for withdrawals, transfers, logins, and profile changes.
Review statements monthly. Regulation E’s 60-day clock starts when the statement is sent.
Secure your email account and mobile account (add a carrier PIN to prevent SIM-swap takeover).
Contact your bank only through verified numbers and websites.
Freeze or lock your credit files, and ask ChexSystems and Early Warning Services about freezes.
Shred documents with account numbers and keep your Social Security number private.

For more prevention steps, read How to Limit or Prevent Identity Theft and Fraudulent Charges?.

Key Deadlines at a Glance

Deadline	What it means
Immediately	Call the bank and secure the account
2 business days	After learning a card or access device was lost or stolen, notifying within this period gives the lowest liability tier ($50)
10 business days	Bank must investigate (or give provisional credit); also the generally allowed window for written confirmation after an oral notice
60 days	Report an unauthorized transfer within 60 days after the statement showing it is sent
45 / 90 days	Maximum investigation time for most transfers / certain transactions (new accounts, point-of-sale, foreign-initiated)
4 business days	Consumer reporting company’s deadline to block fraudulent data after receiving required identity theft documents
30 days	Typical FCRA dispute investigation period; business’s deadline to provide fraudulent-account records after a proper request
1 year	General limit to file an EFTA lawsuit; also relevant to some UCC check-claim bars

Frequently Asked Questions

Can I get my money back if someone steals it from my bank account?

Possibly. If the transaction is an unauthorized electronic fund transfer on a consumer account, Regulation E may require the bank to investigate and refund the money, subject to the liability limits. Wires, checks, and business accounts follow different rules.

How long do I have to report unauthorized bank transfers?

Report immediately. For covered transfers, notifying within 2 business days after learning of a lost or stolen card gives the lowest liability cap, and you should report within 60 days of the statement showing the transfer. Waiting longer can increase your liability.

Will my bank automatically refund me?

No. The bank must follow error-resolution procedures, but the outcome depends on the facts. Provisional credit may be available during the investigation but can be reversed.

Does Regulation E cover Zelle and other payment apps?

It can cover certain electronic transfers made through apps, particularly when a fraudster uses stolen or fraudulently obtained credentials. A payment you personally authorized after being deceived is analyzed differently and may be harder to recover. The answer depends on the specific transaction.

Does Regulation E cover wire transfers?

Generally no. Domestic wires are excluded from EFTA and governed by UCC Article 4A and your account agreement. Report immediately and ask for a recall.

Is my money insured by the FDIC if it is stolen?

No. FDIC insurance protects deposits if the bank fails. It does not cover losses from fraud or identity theft.

Someone opened a checking account in my name. What do I do?

Dispute it with the bank in writing, file an FTC report, request the bank’s records, check ChexSystems and Early Warning Services reports, and dispute any inaccurate entries.

Will a credit freeze stop someone from opening a checking account in my name?

Not necessarily. Many banks check ChexSystems or Early Warning Services instead. Ask each about its freeze option.

Am I responsible for an overdraft on an account I never opened?

You should dispute it with the bank and any collector in writing and ask the bank to investigate and correct reporting. The outcome depends on the evidence and applicable law.

Should I close my bank account after identity theft?

Not always. Ask whether changing the account number, replacing the card, or opening a new account is safest. If credentials or the account number are compromised, replacement is often recommended. Update direct deposits and automatic payments first.

What if my bank denies my fraud claim?

Request the explanation and documents in writing, submit more evidence, ask for escalation, file a CFPB complaint, and consider consulting a consumer-law attorney.

Is a police report required?

Not for a Regulation E dispute, but some banks, creditors, and credit bureaus may request one, and it can support your identity theft report.

Sources and Further Reading

CFPB: Regulation E, 12 C.F.R. § 1005.6, Liability of consumer for unauthorized transfers
CFPB: Regulation E, 12 C.F.R. § 1005.11, Procedures for resolving errors
CFPB: How do I get my money back after an unauthorized transaction?
CFPB: Disputing an error on a checking-account consumer report
FTC: IdentityTheft.gov recovery steps
Statutes and rules: Electronic Fund Transfer Act, 15 U.S.C. §§ 1693 to 1693r; Regulation E, 12 C.F.R. Part 1005; Fair Credit Reporting Act, 15 U.S.C. §§ 1681c-1, 1681c-2, 1681g(e), 1681i, 1681s-2; Truth in Lending Act, 15 U.S.C. §§ 1643, 1666; 18 U.S.C. §§ 1028, 1028A, 1029, 1030, 1343, 1344, 3663A; UCC Articles 3, 4, and 4A (as adopted by each state)

AllAboutLawyer.com provides general legal information, not legal advice. Consumer protections depend on the type of account, transaction, timing, and circumstances. Contact your bank promptly, and consult a qualified attorney if a significant loss remains unresolved.