Bank fraud is nothing new, but as scammers find new ways to steal information, unauthorized activity is growing. In 2023, more than 353 million people fell victim to identity theft, according to the Identity Theft Resource Center. Financial services, such as banks, are among the most targeted industries by fraudsters.

Discovering an unauthorized transaction on your bank account can be unsettling. It’s important to take action as soon as possible to report the fraud and open an investigation with your bank to get your money back and protect your account.

What to do if you discover an unauthorized transaction

There are a few steps you should take immediately after you notice a suspicious transaction on your bank account.

• Check with other authorized users of your account: If you have a joint bank account or have other authorized users on your account, ask them about unfamiliar transactions.
• Contact the merchant: You might not remember every purchase you make, and the name of a merchant listed on your bank statement may not immediately ring a bell. “Contact the merchant to get more details about the transaction to make sure it was not authorized by you,” said Jackie Cummings Koski, CFP and co-host of the podcast Catching Up to Fi. “If it was unauthorized, let the merchant know and then contact your bank.”
• Report the suspected fraud to your bank: If you still don’t recognize the transaction, call your bank or credit union right away and report the suspicious activity. Banks typically have 10 days to investigate an unauthorized charge or withdrawal. Make sure you report fraudulent charges within 60 days of receiving the bank statement that listed the charge. If you wait longer, you may be responsible for the charge.

What if I lose my debit card?

Losing your debit card can leave your account vulnerable to anyone who finds it, potentially giving them access to your account. Contact your bank or financial institution right away to report your lost card. When you do this, your customer representative will usually go over the last authorized transactions you made. If there were any others after that, you can dispute those charges to get your money back.

“Many banks now offer a lock feature where you can log onto your account online or in the app and temporarily limit or prohibit transactions on your account,” Koski said. Locking your account is a good move if you discover your card is lost.

After you report a lost card, most banks will deactivate it and immediately issue you a new card. If you can’t wait until the new card arrives — usually within seven to 10 days — you can ask your bank if there’s a temporary debit card number you can use in the meantime.

How do scammers get your bank account information?

Scammers can use many different methods to obtain your bank account information. In some cases, they may try multiple ways to steal your bank account details and make unauthorized transactions.

These are some of the most common ways scammers steal bank account information:

Posing as your bank

You might get letters in the mail or texts from a number claiming to be your bank, credit union or financial institution. The communication might provide a number to call or a link to click to verify your details. If you fall for the scam and provide the information requested, scammers can use that information to try to access your bank account.

Cashing a check

If you’ve ever been approached by someone outside your bank asking for a favor, it could be a scam. They might ask you to cash a check for them since it’s not their bank. You might cash the check and get funds immediately, but the bank may claw back the funds a few days later once it discovers you cashed a fraudulent check. The money comes out of your account, and you have no way of finding the stranger who stole it.

Job scams

People who regularly look for work, especially work-from-home jobs, might be asked to fill out paperwork with their banking information. In many cases, the job and company will appear legit. But after you enter your information you discover that your money has been stolen instead of getting paid. Never accept a job that requires you to pay any money upfront, and always research companies before applying for and accepting a job.

How long does it take to get money back after an unauthorized transaction?

Once you see an unauthorized transaction on your account and notify your financial institution, your bank or credit union has 10 days to investigate the claim. If the bank finds the error, they have one day to issue you a refund and then three more days to report their findings to you in writing.

How to keep your bank account information safe

Keeping your bank account safe is one of the most proactive things you can do to avoid getting scammed.

1. Use a unique password

It can be challenging to use difficult and unique passwords for all of your accounts. However, keeping your passwords different helps protect your personal information, and a password manager might help. There are some free and paid password managers, depending on your needs and preferences. For instance, 1Password offers a $60 family plan if you want password management for up to 5 family members.

Using a password manager is one of the best ways to keep track of your accounts without remembering the passwords for them. With password managers, you can create complex, unique passwords and manage them without memorizing them. This helps you avoid duplicating passwords across accounts, so if one of your accounts is affected by a data breach, the rest of your accounts should be safe.

Also, avoid using common passwords such as “password” or “123456.” Using passwords that many others use leaves you vulnerable to identity theft.

2. Check statements regularly

The convenience of digital banking might make it seem like you don’t need to check your statements, but it’s always a good idea to regularly review transactions.

“Look at individual transactions on your statements or activity in your banking app,” Koski said. “In the age of digital statements and auto bill pay, it may not get the same scrutiny that a paper statement would.”

Find time every couple of weeks or months to review your recent transactions. Try not to put this off too long since you may not remember every transaction you made. It might help to set reminders on your calendar to do this task, even if it just takes a few minutes to log into your accounts, check transactions and leave.

3. Set up alerts and multi-factor authentication (MFA)

You can set up alerts from your bank to receive notices of suspicious activity. You can also set up multi-factor authentication, or MFA. This is an extra layer of protection to prove that the person logging into your account is you (or someone you gave access to).

Usually, MFA requires at least two different sources of authentication, so your bank might use the term “two-factor authentication.” You can authenticate your access by using an MFA app or receiving a distinct code from your bank that you can input to log in.

Two-factor authentication can stop scammers with limited information from accessing your account. Say, for instance, someone has your username and password to your bank and can successfully log into your account. Getting a one-time log-in code sent to your phone — not the scammer’s — means the scammer won’t get access to your account, and you’ll be notified that someone is trying to get into your account.

Frequently asked questions (FAQs)

Editorial Disclaimer: Opinions expressed here are the author's alone, not those of any bank, credit card issuer, airlines, hotel chain, or other commercial entity and have not been reviewed, approved or otherwise endorsed by any of such entities.

This content is for educational purposes only and is not intended and should not be understood to constitute financial, investment, insurance or legal advice. All individuals are encouraged to seek advice from a qualified financial professional before making any financial, insurance or investment decisions.

Note: While the offers mentioned above are accurate at the time of publication, they're subject to change at any time and may have changed or may no longer be available.