Account Takeover: Signs Someone Is Inside Your Bank Account
New devices, changed contact details, unknown payees and small test payments can mean someone is inside your bank account. The warning signs, and the first steps to take.
Account takeover rarely starts with a big withdrawal. Criminals often change settings first, so alerts go to them and you do not notice until it is too late. Knowing the early signs gives you time to act.
Warning signs
- Alerts about a new device or login you did not make.
- Changed contact details: email, phone number or address.
- New payees you did not add.
- Small test payments to unknown accounts.
- Codes arriving that you did not request. See one-time passwords.
- Your phone losing signal suddenly. See SIM swap fraud.
- Being locked out of your banking app.
First steps
- Call your bank on the number on your card and ask them to freeze online access.
- Change your banking password from a device you trust.
- Check and remove unknown devices and payees with the bank.
- Secure your email, which can reset banking access. See securing your email.
- Report the fraud. See reporting financial fraud.
Turn on every alert your bank offers. See bank alerts and limits.
Related: the first hour after an account takeover. For more, see the complete guide to financial scams.
Frequently asked questions
What is the most common sign?
An alert about a new device, login or payee that you did not set up.
What should I do first?
Call your bank on the number on your card and ask them to freeze online access and payments.
How did they get in?
Usually through phishing, a shared code, malware, a SIM swap or reused passwords. Your bank can help work out which.
Sources
- What To Know About Identity Theft, US Federal Trade Commission
- Take Five to Stop Fraud, Take Five (UK Finance)
- Recovering a hacked account, UK National Cyber Security Centre
