Money Can Be Stolen From Your Bank Account: Here’s How to Lower Your Risk

Customers need to be vigilant as thefts from personal accounts become more common

a hand is reaching into a bank and stealing money

iStock/Getty Images

Christina Ianzito,

AARP

En español

Published October 21, 2022

When Nicole Brandes, 54, did a routine check of her three linked Bank of America accounts online recently, she noticed something alarming: $10,000 was missing.

The Washington, D.C., art teacher looked closer to find that $9,300 from her business account and $700 from her personal checking account had first been transferred to a fourth account in her name that she’d never opened. It was then promptly withdrawn by the cybercriminal.

“I’m worried, I don’t have any explanations,” Brandes said a week before the bank compensated her for the loss. “It’s totally confusing and disorienting.”

And it’s all too common.

There was a 90 percent increase in account takeover fraud and a 109 percent increase in new account fraud — when a criminal opens an account in a victim’s name — in 2021, according to a report from Javelin Strategy & Research. Total combined losses for traditional identity fraud and scams related to identity fraud totaled $52 billion and affected 42 million consumers in the United States.

“These kinds of account takeovers have been increasing over the last number of years,” says Mark Solomon, vice president of the International Association of Financial Crimes Investigators, who notes that chip technology has made it more difficult to make counterfeit credit cards, so criminals will “steal the person,” meaning their identity, “instead of the card.” They’ll then use that identity theft to, among other crimes, access or open bank accounts and steal money.

And because they generally have built up more savings than their younger counterparts, older people are often the target.

How criminals can access your account

There’s a reason that choosing smart passwords — and using a different one for each of your accounts — is one of the top rules (if not the top rule) for protecting yourself from identity theft and fraud.

Websites are frequently hacked, compromising sometimes millions of passwords, as occurred with LinkedIn last year in a data breach that compromised the personal information of 700 million users. Once stolen, usernames and passwords are often sold on underground markets to cybercriminals, who can then test them on bank login pages.

Criminals know that many people use the same or similar passwords across dozens of accounts. “Every time I talk to people, I hear the same story when I ask, ‘Is your pet store account password the same as your Citi account, the same as your coffee shop account?’ ” says Mike Steinbach, a former federal law enforcement officer and head of Citi’s fraud prevention unit. “You hear, ‘Well, yeah.’ Or people will say, ‘For the coffee shop I have Fido123, but for Citi I have Fido321.’ Modern tools can hack through that in a matter of seconds.”

Criminals will also send phishing emails — advertising a product, telling you you’ve won a prize, you name it — with a link that, when clicked, can infect your computer with credential-stealing malware, says Laurie Iacono, an associate managing director at the business services and cyber risk firm Kroll. This allows them to harvest all of your saved login credentials. Or they might try to obtain identifying information through a survey or quiz. The more personal information they have, the easier it is for them to impersonate you and access your accounts without the bank flagging their transactions as suspicious.

These criminals are incredibly adept at using the latest technology to achieve their ends — more so than the general public, says Steinbach, “because they’re not constrained by laws or morality, so therefore fraud is occurring at a speed and scale that we’ve never seen before.”

"People will say, 'For the coffee shop I have Fido123, but for Citi I have Fido321.' Modern tools can hack through that in a matter of seconds."

— Mike Steinbach, head of Citi’s fraud prevention unit

How to prevent account theft

“Unfortunately, there are a lot of different ways to commit fraud,” Solomon says, “and nothing’s 100 percent foolproof to be able to lock down your information and prevent fraud completely.”

Although banks have the highest-tech cybersecurity systems, there’s not much they can do to stop a criminal who is able to assume your identity from accessing your account. “I think they do a really awesome job at cybersecurity in general,” Iacono says. “But when someone gets total information or access to a machine, then there is a possibility of them bypassing that.”

As Steinbach puts it: “Fraudsters will go after the weakest link,” and because banks’ security systems are so advanced, “in a large portion of cases,” that weak link is the customer.

The best way to protect your money is to consider yourself in a theft-prevention partnership with your bank, he says.

Here are more ways to lower your risk of becoming the victim of an account takeover:

1. Never reuse passwords. Don’t use the same password on every single site — particularly if you’re one of the many who opt for “123456” and “password” (two of the most commonly used passwords, according to the password management company NordPass). Use unique, long passphrases (think 40-plus characters) for each, and subscribe to a password manager, such as LastPass or Keeper, to store them all. You’ll just need to have a single, very strong and memorable passphrase for the password manager. Choose something that’s “relevant to you but as random as possible,” suggests Neil Grant, AARP’s senior identity and access manager architect.

2. Use a unique username, too. “If you don’t have to use an email address as a username, don’t,” Steinbach says.

3. Set up multifactor authentication (MFA) on your accounts. Banks increasingly use MFA to add an extra layer of security. You’ll log in using your username and password, then be prompted for some second stage of verification, such as a one-time code sent by text. Facial recognition is another form of MFA that can be used to verify your identity (though it has not been implemented by banks).

"If a criminal can get you to reveal things such as your mother’s maiden name or the year you graduated from high school. They aren’t going to even bother with your bank password, they’re just going to reset it."

— Neil Grant, AARP’s senior identity and access manager architect

4. Check your accounts frequently. If you notice any irregular charges or activity, call your bank. Keep an eye out for very small transactions, such as $1 — tests criminals will do to see if the transaction goes through before stealing larger amounts, Iacono says. (An AARP colleague recently had $12,000 stolen from her account; the theft began with a 5-cent withdrawal).

5. Set up alerts for every transaction made. A lot of financial institutions have this feature, Solomon says, allowing the customer to immediately identify suspicious transactions, which, again, is crucial. “The fraudsters act quickly,” he says. “They’re going to transfer the money quickly, and they’re going to pull the money out quickly.”

Note that if you get a message purportedly from your bank with a scam alert with a link, you shouldn’t reply to it directly or click the link. Contact the bank separately using the direct line on the back of your bank card or its standard 800 number. (See tip number 7, below.)

6. Check your credit score regularly. Solomon suggests checking in with the three major credit bureaus every three to four months to assure yourself that nobody has used your personal information to take out a loan or credit card in your name, for instance.

7. Think twice before responding to unsolicited emails, texts or calls. And definitely don’t click on any links included in those emails or texts. “Even if it seems like it’s coming from a brother or sister,” Grant says, “unless they’re standing right next to you saying check out this link,” don’t click. He doesn’t even give his birthdate when his doctor’s office calls: “They say, ‘Can you verify your date of birth?’ I say, ‘No, you called me, I shouldn’t have to verify anything,’ and I call them back,” in case it’s a hacker after his personal information.

That’s often the goal of phishing; if a criminal can get you to reveal things such as your mother’s maiden name or the year you graduated from high school, Grant says, “they aren’t going to even bother with your bank password, they’re just going to reset it.”

8. Learn about the latest scams and frauds. The more you educate yourself on how these criminals operate, the better prepared you’ll be for the next phishing attempt or scam call. For example, Steinbach says, “If you know that there’s the ability for the bad guys to call your phone and spoof the incoming number, you’re more wary.”

Many banks have helpful fraud-prevention information sites, including Citi, Bank of America and Wells Fargo.

You can also stay up on the latest scams by checking out AARP’s Fraud Watch Network (FWN) and getting regular updates by signing up for the FWN’s biweekly Watchdog Alerts or text FWN to 50757 to receive text alerts.

9. Embrace the digital age. Some older people may be wary of using banking apps and websites, Steinbach says, “but if you were to ask me what’s the safest way to bank, it’s online.” If you only rely on the paper banking statement that arrives by mail once a month, he notes, it could be weeks before you realize money has been stolen.

3 Ways to Stay Safe From Online Banking Scams

What to do if money is stolen from your account

Contact your bank. Your first step should be to immediately contact your financial institution and report the fraudulent transaction, so it can immediately freeze that account and start an investigation. “The quicker you can report it to the financial institution,” Solomon says, “the better chance you have of getting good evidence and getting your money back.”

Contact law enforcement. It’s important to have a record of the crime, even if “in some cases, it will be difficult for law enforcement to dedicate the resources necessary to pursue these cases,” Steinbach says. “There are just so many account takeovers going on, law enforcement has to sort of triage.”

File reports with the federal government. The Federal Trade Commission (FTC) and the Federal Bureau of Investigation’s Internet Crime Complaint Center use fraud reports to target their investigations; the more information they have, the better they can identify patterns, link cases and ultimately catch the criminals. Contact the FTC at reportfraud.ftc.gov and the FBI at IC3.gov.

Run a credit check with the three major credit bureaus (Equifax, Experian and TransUnion). You want to make sure there are no accounts out there that don’t belong to you, Solomon notes.

Getting payback

Bank are required to reimburse you for fraudulent transactions, with the maximum amount of liability capped at $50 if the theft is reported promptly — within two days of the customer’s noticing the unauthorized transaction — and $500 if it’s not (there are nuances to this; read more here). The Consumer Financial Protection Bureau notes that, according to the Electronic Fund Transfer Act (EFTA), even if a consumer’s behavior could be considered negligent, “such as writing the PIN on a debit card or on a piece of paper kept with the card,” the consumer is not responsible if the bank determines that the electronic fund transfer (EFT) was unauthorized. But “depending on the circumstances regarding the unauthorized EFT and the timing of the reporting, a consumer may or may not have some liability for the unauthorized EFT.”

It’s rare for a customer who has been the legitimate victim of an account takeover not to be reimbursed, according to Solomon. “Those victims are usually not going to be held responsible, as long as they didn’t participate in the crime,” he says, noting that there are fraudsters who participate in “identity give-ups,” in which they give a fellow criminal their login information, then split the proceeds when funds are reimbursed.

Victims sometimes find it stressful trying to get their money back, however.

Brandes called her bank immediately to report the loss and was told that it would investigate and get back to her in 10 days. Ten days later, with no word from the bank, she called back — waiting on hold for four hours — to find that her claim had been denied. Turned out that was an error, so the bank reinstated her claim and finally reimbursed her money, with no explanation as to what happened. Though Brandes is pleased the problem was resolved, she says, “It’s still egregious. Just the stress and the confusion.”

She contacted the District of Columbia’s police department, and a detective came to her home immediately to help her file a criminal report. She also reported the incident to the FTC — all correct steps, as explained above.

Brandes has since opened up new accounts at two different banks, one for her personal use and another for her business. She still has no idea how the criminals obtained her login information. “I don’t have any explanations,” she says.

%{postComment}%