This article is published by The Legal Warning India and written by Advocate Uday Singh.

Bank Account Hacked in the USA? What to Do Immediately After Account Takeover

If you suddenly see an unfamiliar withdrawal, receive a strange bank-security call, lose access to online banking, or discover that someone changed your account details, you may be dealing with account takeover fraud.

This is not simply a password problem. A compromised financial account can lead to unauthorized transfers, changes to contact information, payroll diversion, new financial relationships and further identity misuse.

The FBI has warned about criminals impersonating financial-institution support staff and using texts, calls, emails and fake websites to obtain credentials and control financial accounts. In a November 2025 alert, the FBI said IC3 had received more than 5,100 account-takeover complaints since January 2025, with reported losses exceeding $262 million. FBI/IC3 account-takeover warning.

What Is Bank Account Takeover Fraud?

Account takeover, often called ATO, occurs when a criminal obtains unauthorized access to an online account and uses that access to steal money or information.

According to the FBI’s IC3 guidance, criminals can use phishing, fraudulent websites, social engineering, stolen credentials, malware and information obtained from previous data breaches to gain access. IC3 Account Takeover Fraud guidance.

How a Bank Account Gets Taken Over

1. Fake Bank Security Call

You receive a call from someone claiming to be your bank’s fraud department. The caller says a suspicious transaction has occurred and asks you to “verify” your username, password or one-time code.

2. Fake Bank Text Message

A text may claim that your account has been locked or that a transaction needs immediate confirmation. The message contains a link to a fake login page.

3. Search-Engine Phishing

A person searching for a bank’s customer-service number may click a fraudulent advertisement or website that imitates the genuine bank. The FBI has warned about SEO poisoning being used to place fraudulent financial-institution websites in front of users searching for legitimate services.

4. Stolen Password Reuse

If you reuse a password across websites and one service suffers a data breach, criminals may try the same credentials against financial accounts.

5. Social Engineering

The criminal may know some personal information about you and use it to sound convincing. Caller ID can also be manipulated, so the appearance of a familiar number is not proof that the caller is genuinely from your bank.

Bank Account Hacked? Do These Steps First

Step 1: Contact Your Bank Through a Trusted Channel

Do not use the phone number or link provided by the suspicious caller or message.

Use the number printed on your bank card, a verified bank statement, the official banking app or a website address you already know is genuine.

Tell the bank that you suspect account takeover or fraud. Ask what emergency security measures are available and whether suspicious transfers can be recalled or reviewed.

The FBI specifically recommends contacting the financial institution as soon as fraud is recognized and requesting recall or reversal where applicable. See FBI guidance.

Step 2: Change Compromised Credentials

If your username, password, PIN or other authentication information was exposed, reset the compromised credentials.

If the same password was used on other websites, change those passwords too. Use unique passwords and enable multi-factor authentication where available.

Step 3: Review Recent Account Activity

Look for:

• Unauthorized withdrawals
• Unfamiliar wire transfers
• New payees or recipients
• Changes to your phone number or email
• Unexpected password-reset notices
• New cards or accounts
• Unfamiliar login notifications
• Changes to direct-deposit information

The Consumer Financial Protection Bureau recommends closely monitoring account activity and promptly reporting suspicious transactions to the bank or card provider. CFPB guidance on hacked card/account information.

What If Money Has Already Been Transferred?

Report the fraudulent transaction to the bank immediately and ask what recall, reversal or dispute procedures are available for that specific transaction.

For certain unauthorized electronic fund transfers, federal protections may apply. The exact rights and deadlines can depend on the type of transaction and the circumstances. The CFPB’s guidance, last reviewed August 28, 2026, explains important reporting and investigation rules for unauthorized transactions. CFPB: unauthorized transaction guidance.

Do not assume every scam payment has the same legal treatment. An unauthorized transaction can raise different issues from a payment that a victim was deceived into authorizing.

What Evidence Should You Preserve?

Create an evidence folder immediately.

• Bank statements
• Transaction IDs and reference numbers
• Fraudulent wire-transfer details
• Emails and message screenshots
• Phone numbers used by the suspected scammer
• Caller-ID information, if available
• Fake websites and URLs
• Screenshots of login or payment pages
• Bank complaint/reference numbers
• Security alerts received from the bank
• A chronological timeline of the incident

Do not publish passwords, OTPs, recovery codes, full account numbers or other sensitive information online while asking for help.

How to Report a Bank Account Takeover in the USA

FBI Internet Crime Complaint Center (IC3)

Internet-enabled account-takeover fraud can be reported to the FBI’s IC3 at ic3.gov. The FBI recommends providing detailed information about the impersonated financial institution, phone numbers, email addresses, websites, software and financial accounts involved.

Federal Trade Commission

Consumer scams can also be reported to the FTC through ReportFraud.ftc.gov.

Identity Theft

If your Social Security number or other identity information was misused, IdentityTheft.gov provides a federal recovery pathway for identity-theft victims.

Should You Freeze Your Credit?

If your personal information has been exposed or identity theft is suspected, a credit freeze can make it harder for someone to open new credit accounts in your name.

The FTC explains that credit freezes are free, do not affect your credit score and can be placed with all three nationwide credit bureaus: Equifax, Experian and TransUnion. A fraud alert is another protection that can require businesses to verify your identity before opening new credit. FTC credit freeze and fraud alert guidance.

What If You Are Locked Out of Your Bank Account?

Being locked out can be a sign that the attacker changed credentials or account-recovery information, but it does not by itself establish exactly what happened.

Contact the bank through a trusted channel and explain that you suspect an account takeover. Do not continue communicating with a suspected scammer who claims they can restore your account.

Watch Out for the Second Scam

After a bank-account fraud, victims can become targets for a second scam.

Someone may claim to be an FBI investigator, bank investigator, recovery specialist or government employee and say that they can recover your money if you first pay a fee or transfer your funds to a “safe account.”

The FBI has warned about scammers impersonating IC3 personnel, including the use of spoofed websites and AI-generated material. FBI warning about IC3 impersonation.

Do not transfer money merely because someone says it will protect or recover your funds.

Common Mistakes That Can Make the Situation Worse

• Calling a phone number supplied by the suspected scammer.
• Giving an OTP to someone claiming to be bank support.
• Allowing remote access to a computer or phone.
• Deleting messages before preserving evidence.
• Using the same password on multiple financial accounts.
• Waiting before reporting suspicious transfers.
• Sending money to a supposed “safe account.”
• Paying a recovery agent who promises guaranteed recovery.

When Legal Advice May Be Relevant

Legal advice may become relevant where the incident involves substantial financial loss, identity theft, business or payroll accounts, contractual disputes, multiple jurisdictions, threatened litigation or complicated evidence issues.

The appropriate legal route depends on the facts and the relevant U.S. state or federal framework. This article cannot determine the legal remedy for an individual case.

USA Jurisdiction Disclaimer

Read Also

• USA Online Scam: What to Do After a Cyber Fraud or Payment Scam
• USA OAuth Consent Phishing Scam: How Fake Login Links Can Give Attackers Account Access
• How to Preserve Digital Evidence After an Online Scam

Image Disclaimer: Any image used with this article is for general legal-awareness and educational purposes only. It does not depict an actual victim, bank investigation, court proceeding, government notice or legal document.

Disclaimer: This article is for general legal information and awareness purposes only. It does not constitute legal advice or solicitation. Communication is purely informational, in compliance with Bar Council of India Rule 36.