Yes, someone can steal money from your checking account, but the method matters for how you recover it

Money leaves a checking account without your permission through a few specific routes: someone uses your debit card number, logs into your account with your password, sets up an unauthorized transfer, or convinces your bank to move funds. The bank's responsibility to refund you depends entirely on which one happened and how quickly you report it. Federal law protects you differently depending on the theft method, and your bank's own policies may offer more protection than the law requires.

The key difference is between unauthorized transactions (someone used your card or account details without permission) and social engineering (someone tricked you or the bank into moving money). The first is usually refunded in full. The second is murkier, and you may not get your money back.

Key Takeaways

  • Debit card fraud and unauthorized account access are covered by federal law, which limits your loss to $50 if you report within two days and $500 if you report within 60 days.
  • Wire transfers and ACH transfers sent from your account are harder to recover because they are treated as authorized payments once they leave, even if someone else initiated them.
  • If someone tricks you into sending money or tricks the bank into releasing it, you may have no legal right to a refund, though some banks refund it anyway.
  • Report suspected theft to your bank immediately by phone, not email or chat, and follow up in writing within 60 days to preserve your legal protections.
  • Freezing your credit and monitoring your accounts for weeks after theft helps catch secondary fraud before it spreads.

Debit card fraud and how the bank refunds it

If someone uses your debit card number to make a purchase or withdrawal, Regulation E (the federal rule governing electronic fund transfers) limits your liability. If you report the card stolen or the fraudulent transaction within two business days, you lose at most $50. If you wait longer than two days but report within 60 days, you lose at most $500. After 60 days, you may lose everything.

The bank's refund timeline varies. Most banks credit your account within one to three business days of your report, though they may investigate for up to 10 business days before making it permanent. During the investigation, the money sits in a provisional credit — you can use it, but the bank can take it back if they find the transaction was actually authorized.

Report debit card fraud by calling your bank's fraud line, not by email or online chat. The phone call creates a record with a timestamp, which matters if the bank later disputes when you reported it. Ask the representative to document the exact time you called and the transactions you are reporting as fraudulent.

Unauthorized account access and password theft

If someone logs into your checking account using your username and password, the same Regulation E protections apply — $50 liability within two days, $500 within 60 days. However, the bank's investigation is more complicated because they have to determine whether the login itself was unauthorized or whether you authorized the login but someone else used the account afterward.

Banks often ask whether you shared your password, wrote it down, or used it on other websites. If they find evidence you were careless with the password, they may argue the access was not truly unauthorized and refuse to refund you. This is why the phone call matters: tell the representative clearly that you did not share the password and did not authorize the access, and ask them to note that in your file.

Change your password immediately after reporting the theft, and do not reuse the old password on any other account. If the thief had access to your email address too, change that password as well, because a compromised email is the gateway to resetting passwords on every other account you own.

Wire transfers and ACH transfers sent without permission

Wire transfers and ACH transfers are treated differently from debit card transactions. Once the money leaves your account, the bank considers it an authorized payment, even if you did not authorize it. Regulation E does not cover these transfers the same way it covers card fraud.

If someone set up a wire transfer or ACH transfer from your account, you have a narrower window and a harder case. You must report it within 60 days, but the bank is not required to refund you — they are only required to investigate and attempt to recover the funds from the receiving bank. If the receiving bank has already released the money to the thief, recovery is unlikely.

Some banks have their own policies that go beyond federal law and will refund unauthorized wire or ACH transfers if you report quickly. Call your bank's fraud line and ask directly whether they cover unauthorized transfers. If they do, ask what their timeline is and whether they will attempt to recall the transfer from the receiving bank.

Scams where you authorize the transfer yourself

If a scammer convinced you to send money or authorize a transfer, the legal picture changes dramatically. You authorized the payment, even though you were tricked into doing it. This is called authorized fraud or social engineering, and Regulation E does not protect you the same way.

The bank may still refund you if they can show they failed to follow their own security procedures or if they ignored obvious red flags. For example, if you sent $10,000 to a new recipient and the bank did not call to verify, they may have been negligent. But if you authorized the transfer yourself and the bank followed normal procedures, you have no legal right to a refund.

Some banks refund social engineering fraud anyway, treating it as a customer service decision rather than a legal obligation. Call your bank and explain what happened. Be honest about the fact that you authorized the transfer but were deceived. Some banks will refund part or all of it; others will not. There is no may provide, and the decision rests with the bank.

What to do immediately after discovering the theft

Call your bank's fraud line by phone as soon as you notice unauthorized transactions. Have your account number, recent statements, and a list of the fraudulent transactions ready. Tell the representative the exact date you discovered the theft and the date you believe it started. Ask them to freeze your account temporarily to prevent further unauthorized access.

Request a new debit card with a new number. The old card number is compromised and should not be used again, even if the fraudulent transactions stop. Ask whether the bank will waive any fees for the replacement card.

Follow up your phone call with a written report within 60 days. Send a letter to your bank's fraud department (the address is usually on your statement or website) that includes your account number, the date and time of your phone call, the representative's name, the transactions you reported, and the date you discovered the fraud. Keep a copy for your records. This written documentation preserves your legal protections under Regulation E.

Monitoring your account and credit after theft

Check your checking account daily for at least two weeks after reporting the fraud. Thieves sometimes make multiple small transactions to test whether the account is still active, or they may have set up recurring transfers that continue even after you report the initial theft.

Request your credit reports from all three bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com, which is the only free, official source. Check for accounts you did not open or inquiries from lenders you did not contact. If you find fraudulent accounts, dispute them with the credit bureau and the lender.

Consider placing a fraud alert on your credit file. This tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert by calling any of the three credit bureaus; they will notify the other two automatically. A fraud alert lasts one year and is free.

If the theft involved your Social Security number or personal information, you may want to place a credit freeze, which prevents anyone from opening new accounts in your name without your explicit permission. A freeze is stronger than an alert but requires you to unfreeze temporarily if you want to open new accounts yourself.

Frequently Asked Questions

How long does it take to get my money back after I report debit card fraud?

Most banks credit your account within one to three business days as a provisional credit, which you can use immediately. The bank then investigates for up to 10 business days. If they confirm the transaction was fraudulent, the credit becomes permanent. If they cannot confirm, they may reverse the credit, though this is rare if you reported within 60 days.

Can the bank refuse to refund me if I was careless with my password?

The bank can argue that carelessness means the access was not unauthorized, but federal law still requires them to investigate and often requires them to refund you if you report within 60 days. If they refuse, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. Do not accept a refusal without asking why.

What if the thief emptied my account and I need money now?

Ask your bank for an emergency advance or temporary credit while they investigate. Many banks will do this as a courtesy, especially if you have been a customer for a while. If your bank refuses, ask to speak to a supervisor. You can also file a complaint with the CFPB if the bank denies you a provisional credit without good reason.

Do I have to pay bills that were supposed to come out of my account while it was frozen?

Contact each biller (your mortgage lender, utility company, insurance company, etc.) and explain that your account was compromised and frozen. Most will work with you to reschedule the payment or accept a payment from a different account. Do this before the due date to avoid late fees.

Can someone steal money from my account if I only gave them my routing and account number?

Yes. Your routing and account number are enough to set up an ACH transfer or authorize a payment from your account. This is why you should not share these numbers with anyone you do not trust completely. If someone you do not know asks for them, assume it is a scam.