I gave a scammer my bank account information. What now?

First, what exactly did you share?

"Bank information" can mean very different things. The steps below get more urgent as you go down this list.

• Account and routing number (from a check or a form): a real risk, but usually slower-moving. The scammer may try to pull money out electronically or by a fake check.
• Online banking username and password: Urgent. They may log in, add themselves as a payee, or send money.
• A one-time code from your bank: Most urgent. A code read out on a call usually means they were logging in or approving a payment at that moment.
• You moved money yourself because a "bank" or "fraud department" told you to: see Scammed out of money? The first hour.

What a scammer can do with your account and routing number

• Make a check that pulls from your account. The FTC has warned that someone with your account number can create a check that takes money out without you signing anything.
• Set up electronic withdrawals that look like bill payments or memberships.
• Send you a fake check or deposit and then ask you to send part of it back. By law banks must make deposits available quickly, but a fake check can take weeks to bounce. Then you owe the bank.
• Use your details to sound like your bank on the next call. A caller who reads your account number back to you is not proof they're real.

Free recovery checklist

Get the step-by-step plan in your inbox

Email addressEmail me the checklist

The printable C.A.L.M. checklist and who to call. No sales pitch. Or open the checklist now (PDF).

Do this now

1. Call the fraud line on the back of your card

   Not a number from a text, email, or caller. Tell them what you shared and when. Ask for a fraud note on the account.

2. Ask about a new account number

   Many banks will close the exposed account and open a new one. Ask what they recommend. Ask how they'll move your direct deposits and automatic bills.

3. Change your online banking password and turn on two-step verification

   Do it from a phone or computer the scammer never touched. Check that the email and phone number on the account are still yours.

4. Check for new payees, transfers, and linked apps

   Look in online banking for Zelle recipients, bill-pay payees, or external accounts you didn't add. Ask the bank to remove them.

5. Write down the call

   Name, date, time, and any case number. Then follow up in writing if the bank asks you to.

What to say to your bank

If money comes out that you didn't approve

Federal rules protect you against electronic transfers you didn't authorize, but the clock matters. If only your account number was stolen, you aren't responsible for unauthorized transfers you report within 60 days after the statement showing them is sent. Wait longer and you could lose more.

If a company you once agreed to pay keeps pulling money, the CFPB says to tell both the company and your bank that you've withdrawn permission, in writing. After that, new payments from that company are errors you can ask the bank to refund. Your bank may also suggest a stop payment order, which usually costs a fee.

The next 60 days

• Check your account every few days, not just when the statement comes.
• Turn on text or app alerts for every withdrawal, if your bank offers them.
• Don't deposit any check or accept any transfer from a stranger, and don't send "extra" money back.
• If you also shared your Social Security number, freeze your credit. See I gave a scammer my Social Security number.
• Report the scam at ReportFraud.ftc.gov, and at ic3.gov if it happened online.

Questions people ask