Yes, but not everyone and not in every way

Money can leave your bank account without your permission through several routes: someone with your account number and routing number, a person who has physical access to your debit card, a thief who knows your online login, or someone you gave permission to and then revoked it. Your bank's fraud protection covers some of these scenarios completely and others only partially. The speed of your response matters more than anything else—the first 24 to 48 hours after you notice unauthorized activity are when you have the most leverage to recover money.

Not every person who touches your financial information can actually move money. A merchant who sees your card number during a purchase cannot drain your account. A data breach that exposes your Social Security number does not automatically give someone access to your funds. But someone with your online banking password, or someone who has stolen your debit card, can move money quickly—sometimes within minutes.

Key Takeaways

  • Unauthorized transfers from your account can happen through stolen debit cards, compromised passwords, ACH fraud, or wire fraud, but your bank's fraud liability rules limit your loss in most cases.
  • You must report unauthorized activity within two business days to limit your liability to $50; after that, you can lose up to $500 or more depending on the type of fraud.
  • Debit card fraud has different protections than ACH or wire fraud, and the speed of your report determines whether you recover the full amount.
  • Freezing your credit and monitoring your accounts weekly are the most effective ways to catch fraud early, before large sums move.

How someone gets access to steal from you

The most common entry points are a stolen or compromised debit card, your online banking password, or your account number paired with your routing number. A thief with your debit card can make purchases or withdraw cash at an ATM. A person with your online login can transfer money to another account or pay bills in your name. Someone with just your account and routing number can set up an unauthorized ACH transfer—a bank-to-bank transfer that pulls money out over a few days.

Phishing emails and texts that look like they come from your bank are a common way thieves get your password. They direct you to a fake login page that captures what you type. Malware on your computer or phone can record your keystrokes or intercept your banking session. Data breaches at retailers, employers, or other companies expose your card number or personal information, which criminals then buy and use.

Someone you know—a family member, roommate, or person with access to your mail—can also steal from you. They might use your debit card without permission, intercept a check, or call your bank pretending to be you to change your password or add themselves as an authorized user.

What your bank will and won't cover

Debit card fraud is covered under Regulation E, a federal rule that limits your liability. If you report the theft within two business days of discovering it, you lose no more than $50. If you wait longer than two business days but report it within 60 days, you can lose up to $500. If you wait more than 60 days, you may lose the entire amount stolen—your bank has no obligation to refund you.

ACH fraud (unauthorized bank-to-bank transfers) is covered under different rules. You have 60 days from the date your statement shows the unauthorized transfer to report it. Your bank must investigate and refund you if they find the transfer was not authorized. However, if you were negligent—you wrote your account number on a check to a stranger, for example—your bank may not refund you.

Wire fraud (money sent through the Federal Reserve's wire system) has almost no protection. Once a wire leaves your account, it is nearly impossible to recover. Your bank is not required to refund you unless they failed to follow your specific instructions. This is why wire transfers are used by scammers targeting large sums.

Unauthorized online bill payments from your bank's bill pay system are covered under Regulation E if you report them within 60 days. Your bank must investigate and refund you if the payment was not authorized.

The critical 24-to-48-hour window

The moment you notice money missing or a transaction you did not make, call your bank's fraud line—not the general customer service number. The phone number is on the back of your debit card or on your bank's website. Tell them the specific transaction, the amount, and the date. Do not wait until the next business day if you discover it on a weekend; many banks have 24-hour fraud lines.

Your bank will place a temporary hold on your account and begin an investigation. They will ask whether you recognize the transaction, whether anyone else has access to your card or login, and whether you have noticed any suspicious activity on your credit report. Answer these questions as specifically as you can—vague answers slow down the investigation.

Within two business days, your bank must either refund the money or tell you they are investigating and will refund you within 10 business days. If you reported within the two-day window and the fraud is confirmed, you are protected up to $50 of your own liability. If you reported late, your liability jumps to $500 or the full amount stolen, depending on the type of fraud.

Steps to take immediately after you discover fraud

First: Call your bank's fraud line and report the unauthorized transaction. Have your account number and the transaction details ready. Ask them to freeze your debit card and issue a new one.

Second: Change your online banking password immediately, using a computer or phone that is not the one you normally use (in case malware is present). Make the new password at least 16 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used before.

Third: Check your credit report for accounts you did not open. You can view your report free once per year at annualcreditreport.com. If you see fraudulent accounts, file a dispute with each credit bureau (Equifax, Experian, TransUnion) and consider placing a credit freeze.

Fourth: If your debit card was physically stolen or you suspect malware, file a report with the Federal Trade Commission at reportidentitytheft.gov. This creates an official record that helps with disputes and may be required by your bank.

Fifth: Monitor your account weekly for the next three months. Set up account alerts through your bank's app so you are notified of any transaction over a certain amount (often $1 or $25, depending on your bank).

How to prevent theft before it happens

Use a strong, unique password for your online banking—one you do not use anywhere else. A password manager like Bitwarden or 1Password can generate and store these for you. Enable two-factor authentication on your bank account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app.

Do not use public Wi-Fi to access your bank account. Public networks are easy for thieves to intercept. If you must bank on the go, use your phone's cellular data or a VPN (virtual private network) like Mullvad or ProtonVPN.

Check your bank and credit card statements every week, not once a month. The sooner you spot fraud, the more money you recover. Many banks let you download transactions into a spreadsheet so you can search for patterns.

Do not carry your Social Security number in your wallet, and do not write it on checks. Shred documents with personal information before throwing them away. Do not give your account number or routing number to anyone unless you initiated the contact and you are certain they are legitimate.

What to do if your bank refuses to refund you

If your bank denies your fraud claim, ask them in writing for the reason. They must provide a written explanation within 10 business days. Common reasons for denial are that you were negligent (you shared your password or left your card unattended), that you authorized the transaction and then changed your mind, or that the transaction fell outside the reporting window.

If you disagree with their decision, file a complaint with your bank's regulatory body. If your bank is a national bank (has "National" in its name or "NA" after its name), contact the Office of the Comptroller of the Currency at occ.gov. If it is a state bank, contact your state's banking regulator. If it is a credit union, contact the National Credit Union Administration at ncua.gov. These agencies can force your bank to reconsider.

You can also file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB does not refund you directly, but they investigate complaints and can order your bank to pay if they find wrongdoing.

Frequently Asked Questions

Can someone steal from my account if they only have my account number?

Yes, if they also have your routing number. With both pieces of information, someone can set up an ACH transfer to pull money from your account. However, ACH transfers take one to three business days to process, giving you time to notice and report the fraud before the money leaves. Your bank must refund you if you report within 60 days.

What if I gave someone permission to access my account and now I want to revoke it?

Call your bank immediately and tell them to remove that person's authorization. If they have already moved money after you revoked permission, report it as unauthorized. Your bank will investigate whether the person had the right to access the account at the time of the transaction. If you revoked permission first, the transaction is unauthorized and you should be refunded.

Can my bank hold me responsible if I was careless with my password?

It depends on the type of fraud. For debit card fraud, your liability is capped at $50 if you report within two days, regardless of how the card was stolen. For ACH fraud, your bank can deny your claim if you were negligent—for example, if you wrote your account number on a check to a stranger. For online banking fraud, your liability depends on whether you took reasonable steps to protect your password.

How long does it take to get my money back?

Your bank must refund you within 10 business days of confirming the fraud, though many refund within two to three business days. If your bank is still investigating, they have up to 45 days to complete the investigation and refund you. During this time, the money is usually credited back to your account provisionally, so you can use it while they investigate.

What if the fraud happened on a weekend or holiday?

Call your bank's fraud line anyway—most banks have 24-hour fraud support. Your report will be timestamped, and the two-business-day clock starts from the next business day. Reporting on a Saturday counts as reporting on Monday for the purposes of your liability limit.