Understanding and preventing bank account fraud

A debit card can be a useful tool for accessing money in your bank account, but you should be mindful of where and when you use it.

If you're a victim of identity theft or bank account fraud, you may be liable for significant losses. You may be able to recover from identity theft by reporting it quickly to the necessary institutions.

Common types of bank account fraud

Stolen debit card

Debit card fraud occurs when an unauthorized person uses your card without your permission.

A criminal can most easily access your card information if your debit card is lost or stolen.

In the first quarter of 2025, the Federal Trade Commission Sentinel Network received about 25,000 fraud reports where a debit card was used as a payment method. This resulted in a total loss of $54.8 million for consumers.

"Debit card fraud, unfortunately, is all too common," says John Breyault, National Consumer League vice president of public policy, telecommunications, and fraud.

ATM and card skimming

Criminals may also be able to access your debit card information through a process called card skimming.

Card skimming can happen anywhere — a shop, a restaurant, or an entertainment venue. People will utilize devices to capture card information, which they can later use to clone a card or make online purchases.

Phishing and identity theft

Phishing emails, texts, and phone calls look like they're coming from a person or organization you trust, such as your bank. They're really coming from a clever scammer who is trying to get you to share identifying information, such as your bank log-in credentials, so they can gain access to your account.

Never access your bank via a link provided in an email or text message. If you receive a phone call from someone purporting to be a bank representative, tell them you're going to hang up and call back. Find the official customer service phone number on the back of your debit card.

Automatic withdrawals

Chances are you have set up ACH payments for at least some of your bills. This allows your mortgage servicer, internet provider, and other companies to debit your account when your bill is due. But scammers can also take advantage of this bank account feature.

If a scammer is able to get their hands on your bank account number and routing number, they may be able to set up automatic withdrawals from your checking account that can go undetected if you don't regularly monitor your transaction activity or bank statements. Often the withdrawals will be small to avoid triggering a fraud alert.

In a common scheme, fraudsters claim that you have won a free prize but they need your bank details to deposit your winnings. Never provide your bank account and routing number to a person or company you have not verified as legitimate. If you're unsure, call your bank and ask for help.

Unsolicited checks

If you receive an unexpected check, be wary. The Federal Trade Commission warns that fake check scams are rampant, and they come in several varieties.

One scheme leverages the rise of online marketplaces. A fraudster will offer to buy an item and send a check for more than the agreed-upon purchase price, then ask you to refund them the overpayment. In the process they can get access to your bank details. The FTC says you should never accept a check that doesn't match the sale price, adding "you can bet it's a scam."

Similarly, you may receive a check out of the blue that resembles a legitimate check with a note that you've won a prize or sweepstakes. Often, you'll be asked to deposit the check and send money to cover fees or taxes — don't do it. You'll lose your money and put your accounts at risk.

Preventing bank account fraud

Review bank statements monthly and online transaction activity at least once a week to see if there's any unusual activity on your account. In doing so, you can minimize risk and prevent any unauthorized person from making debit card transactions.

Common places where fraud can occur

Be extra careful when using a debit card in the following situations:

• Gas stations: Breyault warns that gas stations are a common place for card skimming. You also may be asked to swipe your card instead of inserting it or using a contactless tap, which isn't as secure.
• Restaurants/bars: At a sit-down restaurant or bar, you want to be mindful of your payment method. If the waitstaff walks away with your card, Breyault says you might consider using a credit card instead, since it offers more protection.
• While traveling: If you're traveling to an unfamiliar place or outside the U.S., you'll want to be mindful of card skimming and older card readers. It's also generally advised to notify your bank that you're traveling so your cards won't be declined. It may be suitable to exchange currency if you want to have extra payment methods abroad.

What to do if you're a victim

Call your bank immediately, ideally within two business days of the fraudulent transaction.

Your financial institution will conduct an investigation. Funds in your bank account may be frozen while the bank investigates.

The investigation may take anywhere from a few days to a few weeks, however, the best banks typically conduct investigations more quickly than community banks.

If the bank determines that fraud occurred, you may have access to those funds again. However, be aware that you may not get all your money back.

Consider setting up a fraud alert with one of the credit bureaus to prevent the offender from opening a line of credit in your name.

The Office of the Comptroller also has additional resources for reporting and learning about fraud. There's also information about protecting against phishing and identity theft.

The role of banks in fraud prevention

Your debit card agreement will define specific conditions of fraud protection, but generally, financial institutions refer to the Electronic Funds Transfers Act, also known as Regulation E. The Electronic Funds Transfers Act outlines debit card protections for consumers.

If your debit card is lost or stolen, timeliness will be an important factor in determining how much money you may be liable for in the fraud loss.

If an unauthorized person obtained your debit card information through card skimming, you have 60 days to notify your bank of debit card fraud. You won't be liable for any unauthorized transactions within the first 60 days of realizing debit card fraud occurred.

There are three primary circumstances covered in the law, which are dependent on when you notify your bank. Here's a quick overview of how the law will protect you as a consumer:

• Circumstance 1 ($50 maximum loss): You may be liable for up to $50 in fraud losses if you notify your financial institution within two business days of a fraudulent charge.
• Circumstance 2 ($500 maximum loss): If you notify your financial institution after two business days have passed but before 60 business days have passed, you may be liable for up to $500 in fraud losses.
• Circumstance 3 (Unlimited maximum loss): Your bank isn't required by law to reimburse you for any fraud losses that occur after 60 business days. You'll also still be liable for up to $500 in fraud losses for unauthorized transactions that happened during the first 60 days.

Credit card companies offer more fraud protection under the Credit Billing Act. Many credit cards have zero-liability protection, which means you won't be held responsible for fraud or unauthorized use of the card. At some banks, you can also avoid credit card fraud on online purchases by using temporary virtual credit card numbers.

Bank account fraud FAQs