How to Protect Your Accounts From Online Fraud

Give every financial account its own long password, use two-factor authentication that doesn't run through text messages, and turn on bank alerts for transfers, new payees and password changes. If money goes missing, call your bank within two business days, because Consumer Financial Protection Bureau rules cap what you can be held responsible for at $50 at that point and remove the cap entirely 60 days after the statement. Federal Trade Commission data shows most fraud now starts with someone impersonating your bank rather than breaking into it, and money you send yourself after being tricked carries no federal right to a refund.

Key Takeaways

• Imposter scams are the most reported fraud in the country. The FTC counted them in nearly one in three fraud reports in 2025, with $3.5 billion in reported losses.

• Reporting a stolen debit card within two business days caps what you owe at $50. Consumer Financial Protection Bureau rules raise that to $500 after two days, and past 60 days from the statement there's no cap at all.

• Money you send yourself after being tricked has no federal reimbursement right. Zelle's operator says participating banks have had to reimburse qualifying imposter scams since June 2023, so it's always worth asking.

• The government stopped recommending scheduled password changes. In guidance finalized in July 2025, NIST dropped both forced rotation and required symbols in favor of longer passwords.

• A credit freeze is free at all three bureaus. Under the FTC's rules, a bureau has to place your freeze within one business day and lift it within one hour.

Summary generated by AI, verified by MoneyLion editors

MoneyLion offers a service to help you find personal loan offers. Based on the information you provide, you can get matched with offers for up to $100,000 from our top providers. You can compare rates, terms and fees from different lenders and choose the best offer for you.

How Scammers Get Into Your Accounts

Most account fraud starts with a text, an email or a phone call. Imposter scams were the most reported fraud category of 2025 according to the Federal Trade Commission, showing up in nearly one in three fraud reports and costing people $3.5 billion. The same FTC data found bank impersonators drove the biggest share of the roughly $1 billion lost to business impersonation, and that scams starting on social media cost people $2.1 billion.

• Fake fraud alerts from your bank. A caller or text flags a suspicious charge on your account, then walks you through moving your money into a "safe account" the scammer controls.

• Texts about an unpaid toll, a stuck package or a locked account. The link opens a copy of the real login page and saves your username, password and card number as you type them.

• Reused passwords from an old data breach. Scammers take an email and password from one company's breach and try that pair on banks, email accounts and shopping sites until one opens.

• Requests for the code your bank just texted you. Someone posing as the fraud department asks you to read it back, which lets them finish logging in with the password they already stole.

• SIM swaps. A scammer talks your phone carrier into moving your number onto their device, then collects every text code your bank sends.

How to Create Passwords That Actually Protect Your Accounts

Make each password long and use it on one site only. Length is what slows down someone trying to crack it, and using it once means a breach at one company can't open your bank account.

• Create long passwords. Four or five unrelated words beat a short password with a zero standing in for an O.

• Change a password only when you have a reason to. A breach notice, a login you don't recognize or a password you reused elsewhere all count.

• Let a password manager do the remembering. It creates a different password for every site, so one company's breach can't open your other accounts.

• Make up your security question answers. Your mother's maiden name and first street are often public. Store the fake answers in your password manager.

How to Turn On Two-Factor Authentication That Scammers Can't Intercept

Two-factor authentication keeps a stolen password from being enough on its own.

• Passkeys and hardware security keys. These tie your login to the real site, so a lookalike page gets nothing it can use. When your bank offers a passkey, take it.

• An authenticator app. Your phone generates the codes, and they never travel over the cell network, which puts them out of reach of a SIM swap.

• Text message codes. Weaker than the other two, but still far better than a password by itself. Use them wherever nothing else is offered.

• Nobody legitimate will ask you to read a code out loud. A code proves you're you, so anyone asking for it over is a scammer.

How to Spot a Fake Text or Email From Your Bank

Your bank will never ask you to move money, share a code or type your password into a link. Any message that does is a scam.

• Any request to move money to a "safe" or "protected" account. Banks don't have one, and that line drives many of the largest losses the FTC tracks.

• A request for a one-time code, a password or your full card number. Your bank has your account details already and never needs you to supply them.

• Pressure to act right now, or to keep it quiet. Scammers use urgency to stop you from hanging up and calling the number on your card.

• A sender address or link that's almost right. Check what comes after the @ sign, and where the link actually points rather than what it says.

When a text, email or call warns you about a suspicious charge or a locked account, don't reply and don't tap the link. Open your bank's app yourself or call the number printed on your card to determine if the message was real.

Which Bank Alerts to Turn On

Turn on alerts for money leaving your account and for changes to the account itself. Both live under security or notification settings in your banking app.

• Any transaction over a low amount, set low enough to catch the small test charges scammers run before the big one.

• Online and card-not-present purchases, where scammers use a stolen card number first.

• A new external account, payee or transfer recipient, since a scammer has to add one before pulling money out.

• Changes to your password, email address or phone number, because scammers rewrite contact details so the alerts stop reaching you.

• Failed login attempts, a sign someone is working through passwords on your account.

What to Do if Someone Already Has Access to Your Account

Call the number on the back of your card first, because reporting starts the clock that caps how much you owe.

• Lock the card while you're on the phone. Freezing it in your app stops new charges before anyone picks up.

• Change the password and sign out all devices. Most banking apps have an option to end every other session, which cuts off anyone using your old password.

• Check what else the scammer changed. Look at your email, phone number, mailing address, linked accounts and saved payees, since changed contact details stop alerts reaching you.

• Put the dispute in writing. A written notice pins down the date you reported and gives you a record if the bank denies the claim.

• Report it at IdentityTheft.gov. The FTC site gives you an Identity Theft Report and a recovery plan you can use to dispute accounts opened in your name.

• Freeze your credit at all three bureaus. This keeps one drained account from turning into new loans and cards.

• Write down every call. Dates, names and claim numbers let you escalate to a supervisor or a regulator if the first person says no.

FAQ

How often should I change my passwords?

Change a password when something prompts it, like a breach notice, a login you don't recognize, or realizing you reused it somewhere. NIST, the agency that writes federal password standards, stopped recommending scheduled changes in July 2025, since routine rotation mostly produces small predictable edits rather than new passwords.

Can I get my money back if I sent it to a scammer myself?

Federal law doesn't guarantee reimbursement when you started the transfer, even though a scammer deceived you into it. Your bank may still refund you under its own policies, and Zelle's operator says participating banks have to reimburse qualifying imposter scams, so file the claim, explain who the scammer was pretending to be, and escalate if the first person you speak to says no.

Does freezing my credit hurt my credit score?

A freeze has no effect on your score and doesn't limit the cards and loans you already have. It only stops new lenders from pulling your report, and under FTC rules you can lift it within an hour when you're ready to apply for something.

How do I know if an email is really from my bank?

Start with what it's asking for, since real banks never request codes, passwords or transfers by email. Instead of judging the message itself, open your bank's app or call the number on your card and ask whether anyone there tried to reach you.

What's the first thing to do if my bank account is hacked?

Call the number on the back of your card and report it, because the date you report sets your liability cap. Then change the password, sign out all devices, and check whether the scammer changed your contact information or linked accounts.

Key Terms

• Two-factor authentication. A second proof that you're you, beyond your password, like a code, an app approval or a physical key.

• Passkey. A login credential your device stores and ties to one specific website, which makes it useless on a lookalike page.

• Phishing. A fake message from a company you trust, which scammers send to collect your login or payment details.

• Imposter scam. Fraud where someone poses as your bank, a government office or a business to get you to send money or share credentials.

• Unauthorized transfer. Money someone else moved out of your account without your permission, which your bank has to investigate.

• Authorized transfer. Money you sent yourself, which counts as authorized under federal law even when a scammer talked you into it.

• Credit freeze. A block on new lenders seeing your credit file, free to place and lift at all three bureaus.

• Fraud alert. A one-year flag on your credit file that makes lenders verify your identity before opening an account.

Sources

• Federal Trade Commission. FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025

• National Institute of Standards and Technology. Digital Identity Guidelines, Authentication and Authenticator Management, SP 800-63B-4

• Consumer Financial Protection Bureau. Regulation E, Section 1005.6 Liability of Consumer for Unauthorized Transfers

• Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?

• Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts

• Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports

• NBC News. Payments App Zelle Begins Refunds for Customers Hurt by Imposter Scams