Your Account Was Hacked and Charged: How to Secure It and Dispute the Charges

When someone takes over an online account that has your card saved, the damage often shows up as charges: ads bought from a hacked Facebook account, orders from a shopping account, or purchases through an app store or payment app. You’re dealing with two problems at once: getting your account back, and getting your money back.

The short answer: secure your email and the hacked account first, then report the charges to your card issuer or bank right away and confirm in writing. Federal law limits what you owe for unauthorized charges, but for debit cards, how quickly you report matters.

Step 1: Lock down your email first

Your email account is usually the key to everything else, because password resets go there. If a hacker controls it, they can take back any account you recover. Start by securing the email account linked to the hacked account, then follow the FTC’s recovery steps (FTC):

1. Update the security software on your computer and run a scan. Delete anything suspicious and restart.
2. Use the provider’s official recovery process if you’re locked out.
3. Change your password to a strong one you don’t use anywhere else.
4. Sign out of all devices so anyone else logged in is removed.
5. Check settings for changes you didn’t make, including email forwarding rules and the recovery email address and phone number.
6. Turn on two-factor authentication.

Step 2: Recover the hacked account

Repeat the same steps on the account that was charged, using the platform’s official recovery or hacked-account page. Go to it directly from the platform’s website or app, not through a link in an email, text, or search ad, since fake “account recovery” services are common.

• Remove saved payment methods you don’t recognize, and consider removing your own card until the account is secure.
• Check for added users, admins, or devices. On business and ad accounts, hackers often add themselves as an admin so they can return later.
• Report the charges to the platform through its billing or payment support. A platform refund can be faster than a card dispute, but don’t wait on it before contacting your bank.
• Tell your contacts not to click links or send money in response to messages from your account (FTC).

If the account is gone and someone has set up a new profile pretending to be you, see our guide on a fake profile using your photos.

Step 3: Dispute the charges with your card issuer or bank

Call the issuer as soon as you see the charges, or use its app. The FTC advises following up immediately in writing with your account number, when you noticed the problem, and when you first reported it, and keeping a copy (FTC). Ask for a new card number, since the old one is saved in an account someone else accessed.

What you can be responsible for

Payment method	Your protection	Deadline to know
Credit card	If your card number was used but the card wasn’t lost or stolen, the FTC says you aren’t responsible for charges you didn’t authorize. In any case, federal law caps liability for unauthorized use at $50.	For a written billing-error dispute, your letter must reach the issuer within 60 days after the first bill showing the charge was sent.
Debit card	If your account number was used but the card wasn’t lost or stolen, the FTC says you aren’t responsible if you report within 60 days after your statement was sent.	60 calendar days after the statement showing the charge is sent. After that, you could lose the money taken from your account, and possibly more.
Lost or stolen debit card	$0 if you report before it’s used; up to $50 within two business days of learning of the loss; up to $500 after that, within 60 days of the statement.	Two business days after you learn of the loss, and 60 days after the statement.

Sources: FTC, Lost or Stolen Credit, ATM, and Debit Cards; FTC, Using Credit Cards and Disputing Charges; 12 CFR 1026.12; 12 CFR 1005.6.

For a credit card billing-error dispute, send your letter to the address the issuer gives for billing inquiries, not the payment address. The issuer must acknowledge it within 30 days and resolve it within 90 days (FTC).

Expect questions about how it happened

The issuer will look at how the charges were made. Charges a hacker ran up after taking over your account without your permission are generally unauthorized. Explain clearly that you didn’t make the charges, didn’t give anyone your login, and secured the account as soon as you found out. Save screenshots of the charges, any login alerts, and your reports to the platform. Our guide to preserving evidence of online fraud covers what to keep.

If the bank or card issuer says no

Ask for the reason in writing and for the documents it relied on, then ask it to reconsider with your evidence. If that fails, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. Our guide on what to do when a bank denies a reimbursement request walks through each step.

You can also report the hack and any fraud to the FTC at ReportFraud.ftc.gov.

Check whether more was exposed

A hacked account can expose more than a saved card: your address, date of birth, ID documents, or other accounts that used the same password. Change the password on any account where you reused it. If the hacker could have seen your Social Security number or financial details, consider a credit freeze or fraud alert. If someone opens new accounts in your name, follow our first steps after identity theft.

Protect yourself going forward

• Use two-factor authentication on key accounts. Start with email, banking, credit cards, social media, and payment apps. The FTC says an authenticator app is safer than text codes, which can be stolen through a SIM swap, and calls a security key “the strongest method of two-factor authentication” (FTC).
• Use a unique password for each account, so one breach doesn’t unlock the others.
• Turn on transaction alerts with your bank and card issuer so you see charges as they happen.
• Limit saved cards. Store payment details only on accounts you use often and have secured.

Frequently asked questions

Will I get my money back if my account was hacked and charged?

Often, yes. Federal law limits your responsibility for unauthorized credit card charges, and the FTC says you aren’t responsible when only your card number was misused. For debit cards, you need to report within 60 days after the statement showing the charge is sent.

Should I contact the platform or my bank first?

Secure your accounts first, then contact both. Don’t wait on the platform’s answer before reporting the charges to your card issuer or bank, because the debit card deadlines keep running.

My Facebook account was hacked and charged for ads. What should I do?

Recover the account through Facebook’s official hacked-account process, remove any admins or payment methods you don’t recognize, report the charges to Meta’s billing support, and dispute them with your card issuer.

Do I need to cancel my card?

Ask the issuer for a new card number. Your current number was stored in an account someone else accessed and could be used again.

Does a hacked account mean my identity was stolen?

Not necessarily. But if the account held personal details such as your Social Security number, consider a credit freeze or fraud alert and check your credit reports.

Sources

• Federal Trade Commission, How To Recover Your Hacked Email or Social Media Account
• Federal Trade Commission, Lost or Stolen Credit, ATM, and Debit Cards
• Federal Trade Commission, Using Credit Cards and Disputing Charges
• Federal Trade Commission, Use Two-Factor Authentication to Protect Your Accounts
• Regulation Z, 12 CFR 1026.12 (liability for unauthorized credit card use)
• Regulation E, 12 CFR 1005.6 (liability for unauthorized transfers)
• Consumer Financial Protection Bureau, Submit a Complaint

This guide is general information, not legal or financial advice. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Scams & Fraud.