You typed your password into a website you thought was your bank. Or you read it to someone on the phone who sounded exactly like a fraud-prevention agent. Or you entered it into a pop-up window that appeared while you were already logged in.
And then, a few seconds or a few hours later, the realization hit: that wasn’t your bank.
I spent 17 years investigating account takeovers inside a bank’s fraud department. I’ve read the case files where victims gave a scammer their credentials and then watched their accounts empty out. I’ve also seen the cases where the victim acted within the first hour — and the money never moved.
The difference between those two outcomes is almost never about how much money you have or how sophisticated the scammer was. It’s about what you do in the next 60 minutes.
“Your password is the key to the front door. If you’ve handed it over, the first move is to change the lock.”
— Rebecca Harlow
Key Takeaways
Change your online-banking password immediately. Then change the password for every other account that uses the same or a similar password — especially your email, which is the recovery key for everything else.
Call your bank’s fraud department using the number on your card or statement. Do not use any number the scammer provided.
The CFPB has clarified that fraudulently induced credential sharing can qualify as unauthorized under Regulation E. If the scammer used your credentials to initiate a transfer, you may have liability protections.
Check for forwarding rules, recovery-email changes, and unauthorized sessions. Scammers often leave backdoors so they can regain access even after you change the password.
Report to IdentityTheft.gov and place a fraud alert or credit freeze. Your banking credentials may be the first step in a larger identity-theft attempt.
What’s Happening Right Now on the Other End
Before you do anything, understand what the scammer is doing with the access you gave them.
A stolen online-banking password is not valuable on its own. What makes it valuable is the access it unlocks. The scammer’s first priority is to use that access before you realize what happened.
Here is what they typically do in the first hour:
They log in from a different device. They may be using a VPN or proxy to mask their location. Your bank’s fraud system may flag the unfamiliar login — or it may not, if the scammer is sophisticated enough to mimic your typical behavior.
They change your contact information. This is the most dangerous step. Scammers often change the email address or phone number on your account so that when the bank tries to alert you, the alert goes to them instead. They may also add a forwarding rule to your email so they can intercept password-reset messages.
They add a new payee. Once inside, they add themselves as a payee or change an existing payee’s account details. Then they initiate a transfer.
They move the money. The method depends on what’s available in your account. ACH transfer, wire, Zelle, or bill payment. The fastest methods are the hardest to reverse.
The FBI’s IC3 has noted that account takeover fraud often follows a predictable pattern: a password reset, followed by a contact-detail change, followed by a new payee. If you can interrupt that sequence before the transfer happens, you have a chance. If the transfer has already occurred, your options narrow.
The First 15 Minutes: Change the Lock
Step 1: Change Your Online-Banking Password Right Now
Open a browser or app on a device you trust — your own phone, your own computer. Do not use a device the scammer may have remote access to.
Log in to your bank account. If you can still get in, change your password immediately. Use a password you have never used before. Long, random, and unique. Use three random words if that helps you remember it — the length matters more than the complexity.
If you cannot log in — the scammer already changed your password — use your bank’s official account recovery process. Go directly to the bank’s website by typing the address yourself. Do not click any link the scammer sent you.
While you are logged in, do these three things before you log out:
Sign out of all active sessions. Most banks have a “security” or “devices” section where you can see all devices currently logged in. Sign out of every device that is not yours.
Check your account’s contact information. Verify that the email address and phone number on file are yours. If they have been changed, change them back immediately.
Check for scheduled or pending transfers. Look for any transfer that has not yet been completed. If you see one, call the bank immediately to stop it.
Step 2: Change Your Email Password
Your email account is the master key. If the scammer has access to your email, they can intercept password-reset messages for every other account you own — including your bank account.
Change your email password now, before you do anything else. Then check your email settings for:
Forwarding rules. Scammers often set up automatic forwarding so they continue receiving your messages even after you lock them out of the inbox.
Recovery email or phone number. Verify that your account recovery information is correct and remove anything you do not recognize.
Connected apps. Revoke access for any third-party app you do not recognize.
Step 3: Change Passwords on Every Account That Uses the Same Credentials
If you reused that password anywhere — and most people do — change it now. Start with:
Other financial accounts (credit cards, investment accounts, payment apps)
Your primary email account
Your phone carrier account
Any account with stored payment information
A password manager can help you generate and store unique passwords. If you do not use one, write the new passwords down and keep them somewhere physically secure.
The First 30 Minutes: Call Your Bank
Once you have secured the digital front door, call your bank’s fraud department.
Use the number on the back of your card or on your bank statement. Do not use any number the scammer gave you. Scammers frequently set up fake customer-service lines that mimic legitimate institutions.
When you get through, say this: “I gave my online-banking password to someone who I now believe is a scammer. I have changed my password, but I need you to flag my account for suspicious activity and review all recent transactions.”
Then ask these specific questions:
“Can you see any logins from unfamiliar devices or locations?”
“Has my contact information been changed?”
“Are there any pending or scheduled transfers that have not yet been completed?”
“Can you place a fraud alert or security hold on my account?”
If the scammer has already initiated a transfer, ask whether it can be stopped. If it has posted, ask about the dispute process.
The Regulation E Protection You May Have
Here is the part that many scam victims never hear.
The CFPB has clarified that if a third party fraudulently induces you into sharing account access information — your login credentials, a one-time code, your debit card number — and then uses that information to initiate an electronic fund transfer from your account, that transfer can qualify as an unauthorized electronic fund transfer under Regulation E.
Examples from the CFPB guidance include a scammer calling and pretending to be a bank representative and then tricking you into providing your account login information, a texted confirmation code, or your debit card number. The CFPB’s answer is based on Regulation E commentary stating that an unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery.
This matters because of what Regulation E requires of your bank. If the transfer is classified as unauthorized:
Your liability is capped at $50 if you report within 2 business days of learning of the loss.
Your liability is capped at $500 if you report within 60 days of the statement showing the error.
After 60 days, your liability may be unlimited.
The bank must investigate and determine whether an error occurred within 10 business days. If it cannot, it may take up to 45 calendar days — but only if it provisionally credits your account within 10 business days of receiving your notice.
And here is a critical point from the CFPB: your negligence cannot be used as the basis for imposing greater liability than Regulation E allows. Even if you should have known better, even if you ignored a warning, even if you reused a password — your liability caps still apply if the transaction qualifies as unauthorized.
When you call your bank, use this language: “I was fraudulently induced into sharing my account credentials. The scammer used those credentials to initiate a transfer from my account without my authorization. I need to file a Regulation E dispute for an unauthorized transaction.”
The First 60 Minutes: Secure Everything Else
Check Your Other Financial Accounts
The scammer may have used your banking password to access other accounts or to reset passwords on accounts linked to your email. Check:
Credit card accounts. Look for unauthorized charges and change your password.
Investment and retirement accounts. Contact your broker or plan administrator and flag the account.
Payment apps. Check Zelle, Venmo, Cash App, and PayPal for unauthorized activity. Unlink any bank accounts or cards you do not recognize.
Insurance and loan accounts. Contact your providers and flag your accounts.
Place a Fraud Alert or Credit Freeze
If your banking credentials were compromised, your personal information may be at risk. Contact one of the three credit bureaus and place a free fraud alert. That bureau must notify the other two.
An initial fraud alert requires creditors to take reasonable steps to verify your identity before opening new accounts in your name. It lasts for one year and can be renewed.
A credit freeze is stronger. It prevents creditors from accessing your credit file entirely until you lift the freeze. You must place a freeze with each credit bureau separately. Both fraud alerts and credit freezes are free.
Report to IdentityTheft.gov
Go to IdentityTheft.gov and report what happened. The FTC’s system will create a personalized recovery plan with step-by-step instructions tailored to your situation. You will receive an FTC Identity Theft Report, which is a legally recognized document you can use to dispute fraudulent accounts and work with institutions.
If you create an account on IdentityTheft.gov, the system will walk you through each recovery step, update your plan as needed, and pre-fill forms and letters for you.
File Reports with the FTC and IC3
File a report with the FTC at ReportFraud.ftc.gov. This creates a record and helps the FTC track patterns.
If the scam involved online communication — email, a fake website, a social media message — also file with the FBI’s Internet Crime Complaint Center at ic3.gov. The IC3 collects reports and may be able to help freeze funds if certain criteria are met.
The Backdoor Checklist
Changing your password is not enough. Scammers often leave backdoors so they can regain access even after you lock them out. Check these settings on both your bank account and your email account:
Setting | What to Check | Why It Matters |
|---|---|---|
Forwarding rules | Any email address you do not recognize | Scammer can continue receiving your messages |
Recovery email/phone | Any contact info that is not yours | Scammer can reset your password again |
Security questions | Answers that have been changed | Scammer can use them to regain access |
Connected apps | Third-party apps you do not recognize | Scammer can maintain access through OAuth |
Active sessions | Devices you do not recognize | Scammer may still be logged in |
Account alerts | Alerts turned off or redirected | You may miss notification of further fraud |
What If the Money Is Already Gone?
If the scammer has already transferred money out of your account, you are now in dispute territory. Here is what to do.
Call your bank immediately. If you have not already, tell them the transfer was unauthorized. The fact that you gave the scammer your password under false pretenses may qualify the transfer as unauthorized under Regulation E. Use the language from the section above.
Ask specifically: “Is this being processed as an unauthorized transaction? If not, why?” The classification determines your protections. If the bank classifies it as an authorized payment, ask about their scam reimbursement policy. Some banks have voluntary policies for impostor scams. Many do not.
Request written confirmation of your dispute and a reference number. Follow up in writing within the timeframes required by your bank.
If the bank denies your claim, appeal. Request the bank’s findings, the documents it relied on, and its investigation notes. Identify any weaknesses in the investigation. Submit a written appeal with additional evidence or a clearer statement. If the appeal is denied, file a complaint with the CFPB at consumerfinance.gov/complaint.
Watch for the second scam. The moment you start reporting, your information enters systems that scammers know how to exploit. Recovery scammers specifically target people who already lost money. They may claim to be from the FTC, the FBI, or a “consumer protection agency” and offer to recover your funds for a fee. Real agencies never do this.
No comments yet.