[disjhshava]

>No, they'll say it is your fault because the bad guys had your username and password.

This sort of claim requires evidence. Many people have had money fraudulently taken out of their accounts, so there is a wealth of experiences to draw from out there. Lots of people are getting hacked via credential stuffing due to password reuse. If the normal response from banks were to blame the customer, everyone would be talking about it.

[jdc]

Right. I've heard what actually happens is the bank does an investigation (which obviously costs them). One thing they'll want to figure out is if the account holder is trying to defraud them.

During this investigation the money is not available. And they do not guarantee it will be over quickly. This could result in all kinds of unpleasantness, including eviction, repossession, etc.