How to Protect Your Bank Account From Identity Theft

Protecting your bank account from identity theft comes down to two things working together: making the account hard to break into, and catching any breach fast enough to keep federal law on your side. Turn on multi-factor authentication, use a unique password, lock your phone number against SIM swaps, and set instant transaction alerts. Then, if something does slip through, report it to your bank within two business days so your maximum liability stays at $50.

Turn On Multi-Factor Authentication and Biometric Login

Multi-factor authentication adds a verification step beyond your password. After you enter your password, a temporary code arrives through a text message or an authentication app, and only that code lets you in. A thief who steals your password still cannot get into the account without also controlling your phone or authentication device.

Biometric login uses a physical characteristic (fingerprint, face, or voice) to verify your identity. Most banking apps now support fingerprint scanning or facial recognition, and both are worth enabling because a remote attacker cannot replicate your physical traits.

Authentication apps such as Google Authenticator, Microsoft Authenticator, or Authy are generally more secure than text-message codes. Text codes are vulnerable to a specific attack on your phone number.

Lock Down Your Phone Number Against SIM Swaps

A SIM swap attack happens when a criminal contacts your mobile carrier, impersonates you, and convinces the carrier to transfer your phone number to a new SIM card. Once the attacker controls your number, they receive any text-message verification codes your bank sends, which lets them reset passwords and drain accounts.

Two carrier settings blunt this risk:

Add a carrier-level PIN or passcode. Call your mobile provider and ask that a PIN be required before any change to your account, including number transfers. Verizon, T-Mobile, and AT&T all offer this.
Enable a port-out lock. This blocks your number from being transferred to another carrier until you remove the lock yourself. You can usually activate it through your carrier’s website, app, or customer service line.

Check with your carrier once or twice a year that both protections are still active. If your phone suddenly loses service for no clear reason, call the carrier right away. An unexpected loss of signal is one of the earliest signs of a SIM swap in progress.

Use Unique Passwords and Watch for Phishing

Reusing a password across sites is one of the most common ways bank accounts get compromised. When a breach exposes your credentials from a less secure site, attackers try those same credentials on banking portals. Use a different, complex passphrase for every financial account. A password manager makes that practical: it generates and stores unique credentials, and you only have to remember one master password.

Public Wi-Fi is another exposure. When you sign into your bank from a coffee shop, airport, or hotel, your traffic crosses a shared network. A virtual private network encrypts the connection between your device and the internet, which makes it far harder for anyone on the same network to intercept your login.

Phishing messages remain one of the most effective tools for stealing bank credentials. They mimic your bank’s branding and manufacture urgency: your account has been locked, a suspicious charge was detected, you need to “verify” your information. Legitimate banks do not ask for passwords, PINs, or full account numbers by email or text. When you get a message like that, don’t click the link. Open a new browser window and go directly to your bank’s site.

Set Real-Time Alerts and Read Your Statements

Most banking apps let you configure instant notifications for account activity: purchases, withdrawals, transfers, balance changes. Set the dollar threshold low. An alert on any transaction over $1 means you find out within seconds of any charge. Under federal law, how quickly you learn about an unauthorized transaction directly controls how much of the loss you have to swallow, so these alerts are one of the highest-value settings available to you.

Read your monthly statements even with alerts turned on. Some fraudulent charges are deliberately tiny (a dollar or two) to test whether the account is being watched before larger withdrawals follow. Federal law gives you 60 days from the date your bank sends a statement to report unauthorized transactions on that statement. Miss that window and your exposure on later transfers can become unlimited.

What You Actually Owe If Fraud Happens

The Electronic Fund Transfer Act and Regulation E set a tiered liability structure for unauthorized electronic transfers from your bank account. Your loss depends on how fast you report:

Report within two business days of learning about the loss or theft, and your maximum liability is $50, or the amount of the unauthorized transfers before you notified the bank, whichever is less.¹
Report between two and 60 days, and your liability can rise to $500 for the unauthorized transfers that happened after the two-day window closed but before you notified the bank.¹
Wait more than 60 days after your bank sends a statement showing the unauthorized transfer, and you face unlimited liability for any unauthorized transfers that occur after the 60-day period ends, until you finally notify the bank.²

The 60-day rule catches most people off guard. If fraudulent transactions appear on your June statement and you don’t review it and report until September, the bank is not required to reimburse you for unauthorized transfers that happened after the 60-day deadline passed.³ If your delay was caused by extenuating circumstances such as extended travel or hospitalization, the bank must extend these deadlines to a reasonable period.¹

Once you report the fraud and the bank opens an investigation, federal rules require it to provisionally credit your account for the disputed amount within 10 business days if the full investigation is going to take longer, so you generally have access to the funds while the case is worked.⁴

Prefer Credit Cards Over Debit Cards for Everyday Spending

If fraud hits a credit card instead of a debit card, your maximum liability is $50, full stop. No escalating tiers for slow reporting, no 60-day cliff to unlimited exposure.⁵ Once you report the unauthorized use, you cannot be held liable for later charges.

There is also a cash-flow difference. Unauthorized debit card transactions pull money directly out of your checking account, which can bounce payments and trigger overdraft fees while you wait for the investigation to finish. Unauthorized credit card charges sit on a statement balance; the money never leaves your bank account in the first place. A reasonable habit: use a credit card for everyday purchases, and reserve the debit card for ATM withdrawals.

What to Do the Moment You Spot Fraud

Speed is the single most important factor in limiting your losses. If you notice an unauthorized transaction or suspect someone has accessed your account, work through these steps in order.

Call your bank’s fraud department using the number on the back of your debit card or on your bank’s official website. Ask that the compromised card or account be frozen. Write down the representative’s name, the date, and any reference number you receive.
File an Identity Theft Report at IdentityTheft.gov. The FTC generates a formal Identity Theft Report and a personalized recovery plan based on your situation.⁶
File a police report. It isn’t always required to get your money back, but it strengthens your case, and some businesses require one before they will release transaction records related to identity theft under federal law.⁷
Send written notice to your bank by certified mail with return receipt. Include the date, dollar amount, and transaction ID for every unauthorized charge. This creates a verifiable record and prevents any later argument that the bank never received your report.

Pull together your documentation before you make the first call: dates, amounts, transaction IDs, and, if the card was lost or stolen, the last time you had it. Organized information moves the dispute faster.

Freeze Your Credit to Block New Accounts

Thieves who have your personal information often do more than drain existing accounts. They open new credit cards, loans, or bank accounts in your name. A credit freeze (also called a security freeze) tells the credit bureaus not to release your report to new creditors, which effectively blocks new accounts from being opened using your identity.

Federal law requires each of the three major bureaus (Equifax, Experian, and TransUnion) to place and remove credit freezes free of charge. If you request a freeze by phone or online, the bureau must place it within one business day. By mail, the bureau has three business days. Removing a freeze when you need to apply for credit yourself is also free and must happen within one hour of an online or phone request.⁸

Identity theft victims who have filed an FTC Identity Theft Report or a police report can also place an extended fraud alert that lasts seven years. It requires creditors to take extra steps to verify your identity before issuing credit, and it removes you from marketing lists for unsolicited credit and insurance offers for five years.⁹

You can also ask the bureaus to block any fraudulent accounts or debts from appearing on your credit report. Once a bureau receives your identity theft report and identification of the fraudulent information, it must block the reporting of that information within four business days.¹⁰

1
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
2
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
3
Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
4
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
5
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
6
Federal Trade Commission. IdentityTheft.gov
7
Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft
8
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Federal Trade Commission. Credit Freezes and Fraud Alerts
10
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft