Bank data breach: what the FTC and CFPB say to do

The two entries on the FTC page that name the bank

This page is about the United States and is not legal advice. It rests on the FTC’s step-by-step page for lost or exposed information, two FTC consumer alerts from 2022, the Consumer Financial Protection Bureau’s pages and rules on unauthorized bank transfers, and general pages from three banks. The FTC page on lost or stolen information and data breaches, at IdentityTheft.gov, divides its steps by the kind of data: a Social Security number, a password, a card number, a bank or investment account, a driver’s license, a passport and others. It begins by asking whether someone has already used your information. If so, it points to a report at IdentityTheft.gov; if not, or if you do not know, it lists steps.

The bank appears in two entries. For a debit or credit card number, the FTC says to contact the bank or card company, cancel the card and request a new one. For bank or investment account information it says to tell the bank or investment company what happened, close the account and open a new one. It gives the reason in one sentence: an identity thief could try to use an account number to access or withdraw funds. The two entries differ, then: a card is cancelled and replaced, while an account is closed and replaced by another. The pages we read do not say who decides whether an account number is changed, whether a bank must change it on request or how long a new account takes.

Citi, a bank writing for general education on a page dated 16 April 2026, says an account number may open the door to unauthorized transactions. It lists unauthorized ACH transfers, forged or altered checks, unauthorized deposits or withdrawals made with account and routing numbers, and phishing. The first of its steps is to contact the bank at once to report the fraud and freeze any affected accounts. Bank of America’s page says to contact your bank immediately if you suspect information related to your account has been compromised, and adds that its material is not updated regularly. These are statements by banks about banking in general; what your own bank does depends on your bank.

On which number to call, the FTC is specific. It says to use a phone number or website address you know is real, such as the number on your account statements, to avoid scammers, and for a card, the number on the back of the card. An archived CFPB blog post from 9 September 2014 adds that banks and credit unions never ask for account information through calls or emails that they start themselves, and that if you get one you should call your provider on a number from a different source.

When the first step is a password, not the bank

The FTC page has a separate entry for a password or account login. It says to log in and change the password, to change the username too if possible, to make the new password long, and to consider two-factor authentication. If you use the same password anywhere else, change that as well. If the site is financial or has your card number stored, it says to check for charges you do not recognize and for account changes such as a new address. The FTC page lists a bank step only under the card and account entries, not under this one. The pages we read do not say outright that a password alone needs no call to the bank, so that is a reading of how the page is laid out, not a sentence in it.

The FTC’s consumer alert of 24 October 2022 is about the notice a company sends after a breach. It says to change at once the password you use with that company and on any account with a similar password, and to turn on multi-factor authentication. It also warns that you may be tempted to ignore a notice about an old account, but that hackers know there is a good chance the password was reused elsewhere, and it names a bank account as an example. So a breach at another company can reach a bank through a reused password, and the advice on that page for that case is to change passwords and check what was exposed.

A second alert, from 26 September 2022, covers an email saying your personal information is for sale on the dark web. It says not to click a link or use a number in the message, because it could be phishing, and to contact the company through a website or number you know is real. It says to change passwords starting with the email account, since password resets for other accounts go to the email. It also says to consider a credit freeze, which it calls free to place and remove and the best protection against new accounts being opened in your name, or else a free fraud alert. Chase’s general page on data breaches has no entry about a bank account. It says you might need to change passwords, alert your bank or get a new credit card, and that the right response depends on the information compromised.

The clocks that start with you

The CFPB page separates three situations. If a debit card is lost or stolen and you tell the bank within two business days of discovering it, your loss is capped at the amount of the unauthorized transactions or $50, whichever is less. After two business days you could be responsible for up to $500. If your security code or PIN is stolen, the page says to notify within two business days, and that doing so protects you from paying for transactions over $50. If a withdrawal appears on a statement but you still have your card, code and PIN, you should notify the bank right away and at the latest within 60 days after the bank sends the statement that shows it. Wait longer and you could have to pay the full amount of transactions that happened after the 60 days and before you notify, and the bank would have to show that earlier notice would have prevented them. In unusual circumstances such as lengthy travel or hospitalization, the page says the periods must be extended.

The rule text agrees on the 60 days. Section 1005.6 says a consumer must report an unauthorized electronic transfer that appears on a statement within 60 days of the institution sending that statement, to avoid liability for later transfers. Its commentary gives an example for a transfer made without a card: an electronic debit of $200, reported within 60 days of the statement showing it, leaves the consumer with no liability. If a $400 debit follows on the 61st day and the first is not reported until the 62nd, the consumer may be liable for the full $400. The CFPB says these protections cover electronic transfers such as ATM transactions, debit card purchases, some online bill payments and automatic deductions. Our page on whether banks refund scammed money also covers the Regulation E clocks.

Both the page and the rule tie the 60 days to the statement, not to the breach notice. The pages we read do not say that a breach notice on its own starts a clock, or how often breaches lead to fraud on an account. What they do say is that the 60-day count runs from the statement that shows the transfer.

What to say to the bank, and what the pages tell you to ask

The pages do not supply a script. Put together, they point to these items for the call:

• Card or account. Whether the card is cancelled and replaced, or, for account details, whether the account is closed and a new one opened, which is what the FTC says.
• Charges already there. The FTC says to review transactions regularly and, for fraudulent charges or withdrawals, to call the fraud department and get them removed.
• Automatic payments. The FTC says to update them with the new card number or new account information.
• Alerts. The archived CFPB post says to consider email or text alerts if your provider offers them, and to check transactions as often as you can.
• Small charges. The same post says to report even small problems right away, because a thief may try a small debit and return for more if it goes through, and that fraudulent charges might appear many months after a breach.
• The PIN. It says to consider changing it even if you are not sure it was taken.
• Freezing. Citi lists freezing any affected accounts among its first steps.
• Writing it down. The archived post says to follow up with a letter if the provider asks, keep a copy, and note the dates of follow-up calls.

After the call, the CFPB page reviewed on 28 August 2026 gives the bank’s side of the clock. Once you tell the bank about an unauthorized transaction, it generally has ten business days to investigate, or 20 if the account has been open under 30 days. It must correct an error within one business day after determining that one occurred, and then has three business days to report its findings. If it cannot finish in that time, it must generally issue a temporary credit for the disputed amount, minus at most $50, while it goes on. It can require written confirmation if you first reported by phone, and if you do not send it within ten business days it need not credit the account in the meantime. The final answer is due in 45 days, or up to 90 for transactions in another country, within 30 days of opening the account or at a debit card point of sale. If the bank decides the transactions were authorized, it must give written notice before taking back the temporary credit.

Regulation E, section 1005.11, fills in detail. It covers oral or written notices, and a notice works without an account number if the bank can identify the account, with a Social Security number given as an example. The bank may ask for a written, signed statement but, the rule’s commentary says, may not delay its investigation while waiting for it. It may also require notice only at a telephone number or address it has disclosed, provided it keeps reasonable procedures to refer you there if you give notice another way. The 2014 post gave the debit card timings in looser words, generally ten business days to investigate and three to take action; where it and the 2026 page differ, we follow the 2026 page and the rule text.

Beyond the bank: credit, reports and complaints

The FTC page puts its credit steps first, as Step 1, and its card and account entries send you back to them. It says to get free credit reports from AnnualCreditReport.com, and that you can check them online every week for free. It says a credit freeze is free to place or to lift and stops people getting into your report, so new credit accounts cannot be opened while it is in place, and that you set it at Experian, TransUnion and Equifax. It also describes a free fraud alert that lasts one year, placed through one of the three bureaus, under which a business has to verify your identity before opening an account. And it says to accept free credit monitoring if a company offers it. The entry for a password alone does not repeat these steps.

For reporting, the FTC page sends identity theft to IdentityTheft.gov and fraud, scams or bad business practices to ReportFraud.ftc.gov. Citi gives the same direction for identity theft, and notes that banks and law enforcement may focus more on recovering funds and strengthening security than on finding the person responsible. The archived CFPB post says you can submit a complaint about a bank account or credit card to the CFPB online or by phone.

Citi lists a fraud alert with the three major bureaus next to its bank steps, and asks that you review your credit report, bank statements and card statements to catch unauthorized activity and file disputes.

What we did not use

This page does not name any breached bank: it read no incident lists or news stories about specific breaches, only the FTC, CFPB and bank pages listed below. The Citi, Bank of America and Chase pages are general statements from banks, and the Bank of America page warns that it is not updated regularly. The CFPB blog post of 2014 is archived and describes itself as possibly outdated, so we used it only for steps and attributed it. We did not check state law or any bank’s own terms, which can differ from the federal rules described here. The September 2022 FTC alert says free weekly credit reports ran through December 2023, while the current FTC page says you can check them every week for free, so we took the credit report point from the current page.