If you think someone has accessed your bank account, contact your bank immediately using the number on a statement or contact details you independently verify on its official website or app. Report suspicious transactions and ask the bank to secure access and explain its recovery steps. Do not follow instructions from an unexpected caller or text, even if the person claims to be bank fraud staff.
What to do first if someone got into your bank account
- Contact the bank through a trusted channel. Use the phone number on a bank statement or independently navigate to the bank’s official website or app. Do not trust caller ID or call a number provided in an unsolicited message. Tell the bank you suspect account access by someone else, identify any unfamiliar activity, and ask what restrictions, credential resets, or transaction controls it can apply.
- Act quickly on unauthorized transfers. If a wire transfer was fraudulent, contact the originating financial institution promptly and ask it to recall or reverse the transfer. The FBI’s Internet Crime Complaint Center (IC3) also advises reporting the incident to IC3. A recall is not guaranteed, so contact the bank as soon as possible. See IC3’s account takeover guidance.
- Secure the login. If you can still sign in, change the bank password to a strong, unique one and use the bank’s option to sign out other devices or sessions, if available. If you cannot sign in, follow the bank’s official account-recovery process and contact it directly. The FTC gives additional steps for recovering a compromised account in its guide to recovering a hacked email or social media account.
- Check account recovery details. Confirm that the email address and phone number registered with the bank are yours. Secure the email account used for password resets and financial notices. If you reused the exposed password on other services, change it there too.
- Review activity and keep a record. Check recent transactions and account changes for anything unfamiliar. Record dates, amounts, recipients, alerts, and communications; report suspicious transactions to the bank promptly.
How to avoid a second scam
Scammers may pose as bank fraud or support staff and say you must move money to protect it. The Federal Trade Commission says, “Never move or transfer your money to ‘protect’ it,” and “Never share a verification code. Ever.” If a caller or message raises an alarm, end the conversation and contact the bank using a number from a statement or its independently verified website. The FTC explains how these bank-impersonation scams work.
As an Amazon Associate I earn from qualifying purchases.
Do not share passwords, one-time passcodes, or verification codes with an unexpected caller or message sender. Caller ID can be misleading, and a convincing alert or link can lead to a phishing site. Independently look up the institution’s contact details rather than using links or phone numbers in an unsolicited message. The FBI also warns about criminals impersonating financial institution support staff: read the FBI alert.
Strengthen authentication after you regain access
Turn on the multi-factor or two-factor authentication options your bank offers. Also protect the email account that receives bank recovery messages or security codes. Available methods differ by bank, so check the bank’s own settings and recovery instructions. The FTC’s guide Use Two-Factor Authentication To Protect Your Accounts explains common options.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A security key for two-factor authentication can be a strong option, but only if your bank supports it. Before choosing a method, consider whether the bank accepts it, how well it protects against phishing or stolen credentials, how you will keep it available for recovery, and what happens if you lose the device. The guidance does not establish that every bank supports security keys.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where to report identity theft or a fraudulent wire in the United States
If personal information may have been stolen, the FTC directs U.S. consumers to IdentityTheft.gov to report identity theft and get a recovery plan. For a fraudulent wire, contact the bank immediately and report it to IC3. Reporting steps, deadlines, and legal protections depend on the country and the type of transaction; check with your financial institution and relevant local authorities about the rules that apply to you.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
