When you spot a charge you did not make, a missing debit card, or a login you do not recognize, the clock starts. The faster you cut off access and put your claim on the record, the less you lose and the stronger your dispute. Freezing the account is the emergency brake: it stops new debits, withdrawals, and transfers while you and the bank sort out what happened.
This guide is the emergency playbook — what to do in the first hour, how a freeze differs from closing the account or just locking your card, exactly how to dispute unauthorized transactions, and what federal law (the Electronic Fund Transfer Act and its Regulation E) guarantees you. Get the timelines right and you are protected; miss them and your liability climbs. Closing an account for good is a different, slower process — see how to close a bank account the right way once the emergency is over.
What do I do first if I think my account is compromised?
Move in this order. The first three steps are about stopping the bleeding; the rest build the paper trail that protects you.
- Call the bank's fraud department now. Use the number on the back of your card or the bank's official website — not a number from a text or email that may itself be the scam. Tell them you suspect fraud and ask them to freeze the account and lock your debit card immediately.
- Lock the card in-app as a stopgap. Most banking apps have an instant "lock card" toggle. It is not a full account freeze, but it blocks new card transactions in seconds while you reach a human.
- Change your online-banking password and PIN, and turn on two-factor authentication. If credentials were exposed, a freeze on the account does not help if the attacker can still log in and lift it.
- Write down names, times, and reference numbers. Note who you spoke to, when, and any case or claim number the bank gives you. This timestamps your notice — which is what the law keys off.
- List every unauthorized transaction. Pull up your statement and flag each charge, transfer, or withdrawal you did not authorize, with dates and amounts, so your written dispute is complete.
- Report it at IdentityTheft.gov if your identity was stolen. The FTC's site generates a personalized recovery plan and an official identity-theft report you can give creditors and the bank.
A phone call freezes the account fast, but a written request is what protects you later. The FTC's recovery guidance is to "call the fraud department" of your bank and "ask them to close or freeze the accounts" — then follow up in writing. A short, dated account freeze request letter that names the account, states what you suspect, and asks the bank to halt all activity gives you proof you notified them and when, which matters if a charge is disputed down the line.
Freeze vs. close vs. card lock — which one do I need?
These three actions are easy to confuse, and using the wrong one wastes time. Here is what each does:
- Card lock — disables your debit or credit card for new transactions, usually instantly from the app, and is reversible with a tap. It stops card fraud but does not stop ACH debits, checks, or wire transfers hitting the account. Best as a 30-second stopgap.
- Account freeze (hold) — the bank suspends debits, withdrawals, and transfers on the whole account while keeping it open, so deposits can still land and the account is not torn down. This is the right move during an active fraud investigation: it stops the loss without the fallout of closing.
- Account closure — permanently shuts the account, after which you reopen a clean one with new numbers. This is for after the dust settles, especially if your account number itself is compromised. It is a deliberate, multi-step process, not an emergency reflex — closing while deposits or autopays still point at the account causes its own mess.
For an active emergency, freeze first. If the account number itself leaked and fraud keeps coming, the longer-term fix is to close the compromised account and open a new one with a fresh number — but do that in sequence, moving your direct deposits and autopays first, as covered in our closing guide.
What are my rights — and the deadlines that protect me?
Regulation E caps how much you can lose to unauthorized electronic transfers, but the cap depends entirely on how fast you report. The tiers, straight from the CFPB's rule:
- Report within 2 business days of learning your card or access device was lost or stolen, and your liability is the lesser of $50 or the unauthorized transfers made before you reported.
- Report after 2 business days but within 60 days of the statement, and your liability can rise to the lesser of $500 or the transfers that a timely report would have prevented.
- Wait more than 60 days after the statement showing the first unauthorized transfer is sent, and the law lets the bank hold you liable for everything that happens after that 60-day window — potentially with no cap.
The single number to remember is 60 days from the statement date — that is the outer deadline to report an unauthorized electronic transfer and keep your protections. Report within two business days of noticing a lost card and your exposure is capped at $50. Many banks voluntarily offer $0 liability for promptly reported fraud, but the law's protection still hinges on speed. The lesson is simple: freeze fast, dispute in writing, and never let an unrecognized charge sit past a statement cycle.
Once the fraud is contained and disputes are filed, decide whether to keep the frozen account or close it for a clean one. If you go the closure route, follow the safe sequence so a stray autopay does not bounce or reopen the account.