A Bank Account Was Compromised: The First-Hour Response

lock first, fraud line second, passwords after

The bank breach first hour

The signs of a compromised account are quiet: logins that stop working, charges the parent did not make, a card declined for no reason. The first hour has a strict order.

1. The signsQuieter than a scam callLogins that do not work though the password is right, charges or small test charges the parent did not make, a card declined for no reason, or alerts about a new device or a password reset never requested.
2. First hour, step 1Lock the card and the accountThe banking app and the card issuer both offer a freeze or lock: do that first, from the app if it still works, to stop new charges while the rest of the hour runs.
3. Step 2-3The fraud line on the back of the cardCall the number printed on the card, never any number from a message or email. Let the fraud team run their process, list the unauthorized charges, and write down the case number.
4. Step 4-5 + the familyNew password, two-factor, check the restChange the bank password to a new unique one, turn on two-factor, then check the other bank, card, email, and investment accounts in the same hour: reuse is how one breach becomes five. If new accounts appear, it is identity theft and IdentityTheft.gov is the plan.

Send this Print this

The signs that the account is compromised

• Logins that do not work even though the password is right, or security questions the parent did not change.
• Charges or transfers the parent did not make, including small test charges that scammers use to confirm a card works.
• The card declined for no reason, which can mean the bank froze it after suspicious use.
• Alerts about a new device or a password reset the parent never requested.

The first hour, in order

1. Lock the card and the account. The banking app and the card issuer both offer a freeze or lock. Do that first, from the app if it still works. It stops new charges while the rest of the hour runs.
2. Call the fraud line on the back of the card, not any number from a message or an email. If the parent cannot find the card, use the number from the bank's own website, typed in, or the app's help section. See the fraud alert call-back trap for why the number in the message is never the number to call.
3. Let the bank's fraud team run their process. They will verify the parent, list the unauthorized charges, issue a new card, and usually reverse the fraud. Write down the case or reference number they give.
4. Change the password on the bank account to a new, unique one, and store it in the family password vault. If the parent reused that password anywhere else (and most parents have), change it on those sites too. Reuse is how one breach becomes five.
5. Turn on two-factor authentication if it is not already on. See two-factor for parents for the setup that sticks.

Check the rest of the family's accounts

Scammers rarely stop at one account. In the same hour, check the other bank and card accounts, the email account (it is the reset hub for everything), and any investment or retirement accounts. If the email was part of the breach, treat it as compromised too: the compromised-account workflow covers the family response.

When it becomes identity theft

If new accounts appear that the parent never opened, or the damage spreads beyond one bank, it has crossed from account fraud to identity theft. The official recovery plan is a single place: IdentityTheft.gov, run by the FTC, which generates the step-by-step plan and the pre-filled letters. The identity theft response guide walks the same order.

Watch the follow-ups

An account breach puts the parent on a list. Expect fake "we are helping you recover" calls, fake bank texts, and phishing emails referencing the breach. The parent's real bank will never ask for the password or the code by phone. See when a parent keeps getting targeted.

Related

• Your parent's account was hacked: the 60-minute family workflow.
• Identity theft response: when the damage spreads.
• Two-factor authentication: the layer that stops most of this.
• Family password vault: where the new unique password lives.

Sources

• FTC: What to know about identity theft (retrieved August 2026)
• FTC: What to do if you were scammed (retrieved August 2026)
• FTC: IdentityTheft.gov (retrieved August 2026)

Found an error? Report it.