A third party can access your bank account only if you give them permission, or if a court or government agency orders it
Your bank account is protected by law. A stranger cannot walk in and withdraw money. But permission comes in many forms—some you give knowingly, some you give without realizing it, and some are taken by legal process. A spouse, parent, or adult child on your account has full access. A person you name as power of attorney can access it. A creditor with a court judgment can freeze it or take money. A tax authority can seize it. A scammer who steals your login credentials can drain it. The difference between each scenario matters because what you can do to stop it—or prevent it—is different every time.
Understanding who has legal access and how to revoke it protects you from both intentional misuse and fraud. This guide walks through each type of access, what you can do about it, and how to prevent it from happening in the first place.
Key Takeaways
- Anyone whose name is on the account as an owner or authorized user can access it fully, and the bank will not stop them.
- A power of attorney document you sign gives someone legal permission to access your account, and you can revoke it in writing at any time.
- A creditor, tax authority, or child support agency can freeze or seize your account only with a court order or legal judgment.
- If a scammer accesses your account, contact your bank immediately and file a report with the Federal Trade Commission; your liability is capped at $50 if you report within two business days.
- You can prevent unauthorized access by using a strong password, enabling two-factor authentication, and reviewing your account activity regularly.
People you authorize to access your account
If you add someone's name to your account as a joint owner or authorized user, they have the same access you do. They can withdraw money, make transfers, close the account, or change the account settings. The bank will not stop them, and you cannot later claim they stole from you—legally, they had permission. This is different from giving someone power of attorney, which is narrower and can be revoked.
A joint account is common between spouses, parents and adult children, or business partners. Before you add someone, understand that you are giving them full control. If you want to limit what they can do—for example, allowing them to see the balance but not withdraw—most banks cannot do that. You would need a separate account or a different legal arrangement. Think carefully about whether the person truly needs full access or whether a power of attorney would be safer.
If you want to remove someone from your account, contact your bank in person or by phone. You will need to provide your ID and sign a form. The person being removed does not have to agree. Once they are removed, they lose access immediately, though it may take one business day for the bank to process the change. Notify the person in writing so there is no confusion about when access ended.
Power of attorney and what it actually lets someone do
A power of attorney is a legal document you sign that gives someone permission to act on your behalf—usually for financial or medical decisions. It is not the same as adding them to your account. A power of attorney is narrower: it lasts only as long as you say it does, and you can cancel it anytime by writing to your bank and the person holding it.
There are different types. A general power of attorney gives broad access to your finances. A limited power of attorney restricts what they can do—for example, only to pay bills or sell a specific property. A durable power of attorney stays in effect even if you become incapacitated. A springing power of attorney only takes effect if you become incapacitated. You choose which type fits your situation when you create the document.
To revoke a power of attorney, write a letter to your bank, the person holding it, and any other institution where they have been using it. Keep a copy for your records. The revocation is effective immediately, though it may take a few business days for the bank to process it. If the person continues to use the power of attorney after you revoke it, that is fraud, and you can report it to police and your bank. Some states require you to file the revocation with the court as well, so check your state's rules.
Court orders and government seizures
A creditor cannot simply take money from your account. They must first win a lawsuit against you and get a judgment. Once they have a judgment, they can ask the court for a garnishment order, which tells your bank to freeze part of your account and send the money to the creditor. Your bank will notify you when this happens, usually by mail within one business day.
The amount that can be garnished varies by state and by the type of debt. Wages are easier to garnish than bank accounts. Some money is protected: Social Security, disability payments, unemployment benefits, and child support payments are usually exempt from garnishment in most states. If your account contains only protected funds, you can file a claim with the court to get the freeze lifted. You will need to provide documentation showing the source of the money in your account.
The IRS and state tax authorities can seize your account without a court order if you owe back taxes. They send a levy notice to your bank, and the bank freezes the account. You have the right to appeal, but you must act quickly—usually within 30 days. Contact the IRS or your state tax authority immediately if this happens. You can request a payment plan or an offer in compromise to resolve the debt and get the levy lifted.
Child support agencies can also seize accounts without a court order in some states if you owe back support. The process and your rights to appeal vary by state. Contact your state's child support enforcement office to understand your options if this happens to you.
Scammers and what to do if your account is compromised
If someone accesses your account without permission—through phishing, malware, password theft, or social engineering—that is fraud. Your liability is limited. Under federal law, if you report unauthorized transactions within two business days of discovering them, you are liable for no more than $50. If you wait longer, your liability can be higher, up to $500 or more depending on how long you wait and whether the fraud involved your debit card.
Contact your bank immediately by phone. Do not use email or the bank's website, because a scammer may have changed your contact information. Ask to speak to the fraud department. Tell them which transactions were not yours. The bank will freeze your account, cancel your debit and credit cards, and issue new ones. They will also begin an investigation. Ask the bank how long the investigation will take and when you can expect a decision on whether the transactions will be reversed.
File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help if the fraud is part of a larger identity theft scheme. You can also file a police report, though police rarely investigate individual account fraud unless it is part of a pattern. Keep copies of all documentation from your bank and the FTC for your records.
Change your password immediately on a different device (not the one that may be compromised). Use a password that is at least 12 characters long and includes uppercase, lowercase, numbers, and symbols. Enable two-factor authentication if your bank offers it—this requires a code from your phone or email every time someone logs in from a new device. Check if any other accounts use the same password and change those too.
Preventing unauthorized access before it happens
Use a strong, unique password for your bank account. Do not reuse passwords from other websites. A password manager like Bitwarden, 1Password, or KeePass can generate and store strong passwords for you. This way you only have to remember one master password.
Enable two-factor authentication on your bank account. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Text message codes are better than nothing, but an authenticator app is more secure because scammers cannot intercept it as easily. Most banks offer this feature for free.
Review your account activity regularly—at least weekly. Most banks let you set up alerts for large transactions or transfers. If you see something you did not authorize, report it immediately. Many banks also let you set spending limits or restrict transfers to certain accounts, which can slow down a scammer even if they get your password.
Do not share your login credentials with anyone, even family members. If you want to give someone access to your account, add them as an authorized user or create a power of attorney instead. This gives you more control and a clear way to revoke access if needed.
Be cautious of phishing emails and texts that claim to be from your bank. Banks do not ask for passwords or PINs by email or text. If you receive a suspicious message, do not click any links. Instead, call your bank using the number on your debit card or statement.
What happens if someone dies and leaves you their account
If you are named as a beneficiary on a bank account, the bank will transfer the money to you after the account holder dies. You will need to provide a death certificate and proof of your identity. This process bypasses probate and is faster than inheriting through a will. Contact the bank as soon as possible after the death to start the process.
If you are a joint owner on an account and the other owner dies, the account automatically becomes yours in most states (this is called right of survivorship). You can continue using it immediately, though you may need to notify the bank and provide a death certificate. The money does not go through probate, so you have access right away.
If someone dies and you are not named as a beneficiary or joint owner, you cannot access the account. The money becomes part of their estate and is distributed according to their will or state law. If you believe you should have been named as a beneficiary, you may have grounds to challenge the will, but this requires a lawyer and can be expensive.
Frequently Asked Questions
Can my spouse access my bank account without my permission?
Only if their name is on the account as a joint owner or authorized user. If the account is in your name alone, they cannot access it legally. However, in a divorce, a court can order you to disclose account information and may divide the money. If you suspect your spouse is accessing your account without permission, change your password and contact your bank.
Can my bank freeze my account without telling me?
Your bank can freeze your account if a court order or government agency demands it (garnishment, tax levy, or child support). The bank must notify you, usually within one business day. If your account is frozen and you believe it is a mistake, contact your bank immediately and ask for the reason. You have the right to challenge the freeze in court.
What if I gave someone my password and now I want to stop them?
Change your password immediately. If they are a joint owner or authorized user, contact your bank to remove them from the account. If they have a power of attorney, revoke it in writing to your bank and the person holding it. If they are a scammer, report it to your bank and the Federal Trade Commission.
Can a debt collector access my bank account?
No, not without a court judgment. A debt collector cannot freeze or seize your account on their own. They must sue you, win the case, get a judgment, and then ask the court for a garnishment order. Only then can your bank freeze the account. If a debt collector claims they can access your account without a court order, they are lying and may be breaking the law.
Does my bank have to tell me if someone else accesses my account?
Your bank does not have to notify you every time someone with permission accesses your account. But if there is unauthorized activity, the bank should notify you as soon as they discover it. You are responsible for reviewing your statements and activity regularly to catch fraud early.