New on FinoLib · Volume V: Personal Finance
I have added a new article to FinoLib, my finance education website: Bank Account Hacked? What to Do in Ten Steps, part of Volume V: Personal Finance. It is part 1 of a 2-part guide. This page gives you the core of the topic in expert but plain language; the full article goes much deeper.
The idea in plain words
If someone hijacks your money or identity, speed is your best defense. Freeze your cards and call the fraud number on the back of your card. Then take back your email and phone number, because every other account resets through them. Report each unauthorized debit within two business days and confirm it in writing, read every statement within 60 days, and freeze your credit. The law limits what you lose according to how fast you report, not how careful you were.
Key points
■Reporting a stolen debit card on day 2 costs at most $50; on day 20, up to $500; after the 60-day statement window, $500 plus everything taken after that window closes.
■Carelessness, such as writing a PIN on the card, cannot raise your liability; delay can.
■Text-message codes stopped 76% of targeted takeovers in Google’s study; security keys stopped all of them.
■Business accounts, brokerage accounts, paper checks and wires sit outside the consumer debit rules.
A closer look
Discovering a compromise — an unfamiliar charge, a password-reset email you didn’t request, a phone that suddenly has no signal, a letter about an account you never opened — produces panic, and panic produces mistakes. The order below is built around one idea: close the doors an attacker can still use before cleaning up what they already did. Your email and phone number are the master keys to almost every other account, because password resets go through them.
A worked example
Worked Example — The Deadlines Banks Must Meet
You report an unauthorized $600 debit-card transfer on a Monday. Under Regulation E the bank has 10 business days to investigate. If it needs longer — up to 45 days, or 90 for point-of-sale debit and some other transfers — it must provisionally credit the $600 within those 10 business days, so you are not without the money while it decides. On a credit card, the billing-error rules let you withhold payment of the disputed amount, bar the issuer from reporting it as delinquent while it investigates, and require a resolution within two billing cycles and no more than 90 days.
Under the hood
Under the Hood: Why Email and Phone Are the Master Keys
Nearly every account has a “forgot password” door, and it opens with a link sent to your email or a code sent to your phone. Whoever controls those two channels can reset the bank, the brokerage and the payment apps without ever knowing a password, then change the recovery details so you cannot get back in. That is why steps 2 and 3 come before changing any other password: a new password set while the attacker still reads your email can be reset again within minutes.
What the Research Says About Second Factors
Google, with researchers from New York University and UC San Diego, measured how well each second step blocked account takeovers (published May 17, 2019). A text-message code blocked 100% of automated bot attacks, 96% of bulk phishing and 76% of targeted attacks; a prompt on a phone you were already signed in to blocked 100%, 99% and 90%; and no user who relied only on a physical security key fell to targeted phishing during the study.
More from the article
■1. Stop the bleeding. Freeze or lock affected cards in your banking app, then call the fraud line using the number printed on the back of your card or on the bank’s official website — never a number from a text, email or caller.
■2. Secure your email first. From a device you trust, change the password, sign out all other sessions, and check for forwarding rules, recovery addresses or phone numbers the attacker may have added. Whoever controls your email can reset everything else.
■3. Secure your phone number. If your phone lost service unexpectedly, call your carrier from another phone: this is the sign of a SIM swap or port-out. Set an account PIN and turn on the carrier’s free number-lock or port-out protection.
■4. Change credentials and revoke sessions. Use a password manager to give every financial account a unique, long password. Sign out of all devices. Turn on phishing-resistant multi-factor authentication — passkeys or a hardware security key — where offered, and an authenticator app elsewhere; text-message…
■7. Report it. File at IdentityTheft.gov, the FTC’s site, which produces an official Identity Theft Report and a personal recovery plan; report online fraud to the FBI at ic3.gov.
What the full article covers
The full article includes worked examples, a look under the hood at the mechanics, a recap, a reveal-on-click quiz and the official sources behind every figure.
Volume V: Personal Finance
Read the full article on FinoLib
The complete article, Bank Account Hacked? What to Do in Ten Steps, with every worked example, diagram, quiz and source, is free to read in Volume V, Personal Finance on finolib.com.
Explore the Finance Education Series: Vol. II — Capital Markets · Vol. I — Global Economy · Vol. III — Finance Encyclopedia · Vol. IV — Finance Careers · Vol. V — Personal Finance