What bank employees can and cannot do with your account

Bank employees can see your account information as part of their job — tellers, loan officers, and customer service staff access accounts daily to process transactions, answer questions, and verify balances. But they cannot withdraw money, transfer funds, change your password, or make decisions about your account without your explicit permission. The line between "seeing" and "using" is where your legal protection sits.

Your account is protected by federal law, primarily the Gramm-Leach-Bliley Act, which requires banks to keep customer financial information private and limits how employees can use it. State laws add additional protections. If an employee accesses your account for a reason unrelated to their job — to look at your balance out of curiosity, to help a friend, or to commit fraud — that is a violation, and the bank is liable.

The practical reality is that most banks have internal controls: access logs that show who looked at which account and when, role-based permissions that prevent a teller from initiating wire transfers, and audit trails that flag unusual activity. These exist partly to protect you and partly to protect the bank from employee theft.

Key Takeaways

  • Bank employees can view your account information as part of their job duties, but cannot move money, change settings, or access your account for personal reasons.
  • Unauthorized access by an employee is a federal crime under the Gramm-Leach-Bliley Act and can result in criminal charges and civil liability for the bank.
  • Banks maintain access logs and audit trails that record which employee viewed or changed your account and when, creating a record if misuse occurs.
  • If you suspect an employee has accessed your account improperly, report it to the bank's compliance department and file a complaint with your state banking regulator or the FDIC.

How banks control what employees can do

Most banks use role-based access controls, meaning a teller's login credentials only allow them to perform teller functions — deposits, withdrawals, balance inquiries. A loan officer has different permissions. A manager has broader access. An employee trying to perform an action outside their role gets blocked by the system itself, not by a policy they choose to follow.

Access logs are the second layer. Every time someone logs into the system and views or modifies an account, the bank records the employee's ID, the timestamp, and what action was taken. If a teller looks at your account, that lookup is logged. If they initiate a transfer, that is logged. Banks use these logs to audit for suspicious patterns — for example, an employee repeatedly accessing accounts they do not serve, or accessing accounts outside business hours.

Larger banks also employ compliance teams that run automated checks for red flags: an employee accessing a family member's account, accessing the same account multiple times in a short window, or accessing accounts with large balances when that employee normally handles small transactions. These systems catch most internal theft before money leaves the bank.

What happens if an employee accesses your account without permission

If an employee views your account out of curiosity or for a reason unrelated to their job, that is a violation of the Gramm-Leach-Bliley Act. It is also often a violation of the bank's internal policies and can result in termination. If the employee uses the access to steal money, transfer funds, or commit fraud, they have committed a federal crime — wire fraud, identity theft, or theft from a financial institution, depending on the specifics.

The bank itself is liable to you for damages if an employee misuses your account. You can sue the bank for the money stolen, plus damages for the harm caused. You can also file a complaint with the bank's compliance department, your state banking regulator, or the Federal Deposit Insurance Corporation (FDIC) if your bank is FDIC-insured. The regulator can fine the bank, require it to reimburse you, and take enforcement action against the institution.

In practice, most cases of employee theft are caught quickly because of the access logs. The employee is identified, arrested, and prosecuted. The bank reimburses the customer. The bank may also face regulatory fines for failing to prevent the theft or for inadequate internal controls.

How to know if someone accessed your account improperly

The most obvious sign is money missing or transactions you did not authorize. Check your account regularly — at least weekly — for withdrawals, transfers, or changes you do not recognize. Set up account alerts through your bank's app or website so you are notified of large transactions, balance changes, or login attempts from new devices.

Some banks offer transaction history that shows not just what happened, but which employee or channel processed it. If you see a withdrawal and the description says "Teller: John Smith" or "Branch: Downtown," you know which employee to ask about. If you do not recognize the employee or the transaction, ask the bank to investigate.

You can also request an access log from your bank — a record of every time your account was viewed or modified and by whom. Not all banks make this easy, but you have the right to request it. If you see access you did not authorize, that is evidence of a violation.

Steps to take if you suspect unauthorized access

First, contact your bank immediately. Call the number on the back of your card or go to a branch in person. Tell them you suspect an employee accessed your account without permission or that you see unauthorized transactions. Ask them to freeze your account, cancel your debit card, and change your online banking password.

Request a written explanation of any transaction you did not authorize. The bank should provide details: the date, time, amount, and which employee or channel processed it. If the bank cannot explain it, ask them to reverse the transaction and credit your account.

File a formal complaint with the bank's compliance or fraud department. Put it in writing — email or a letter sent to the compliance office, not just a phone call. Keep copies of everything: your complaint, the bank's response, transaction records, and any correspondence.

If the bank does not resolve it to your satisfaction, file a complaint with your state banking regulator or the FDIC. You can find your regulator through the Conference of State Bank Supervisors website. Include copies of your bank correspondence and a clear description of what happened. The regulator can investigate and compel the bank to reimburse you.

Your rights under federal law

The Gramm-Leach-Bliley Act gives you the right to privacy of your financial information. Banks must have a privacy policy, must limit employee access to what is necessary for their job, and must keep your information secure. If a bank violates this, you can sue for damages.

The Electronic Funds Transfer Act protects you if someone uses your debit card or account number without permission. If you report unauthorized transactions within 60 days of the statement date, the bank must investigate and reverse the charge. If you wait longer, your liability increases — after 60 days, you may be responsible for the full amount.

State laws vary, but most states have additional protections for identity theft and unauthorized account access. Some states allow you to place a fraud alert on your credit file, which makes it harder for someone to open new accounts in your name.

How to reduce the risk of employee access abuse

Use strong, unique passwords for your online banking account — at least 12 characters, with uppercase, lowercase, numbers, and symbols. Do not share your password with anyone, including bank employees. Legitimate bank employees will never ask for your password.

Enable two-factor authentication if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or email. It makes it much harder for an employee to access your account remotely.

Monitor your account regularly. Set up alerts for transactions over a certain amount, balance changes, or login attempts from new devices. The sooner you spot a problem, the sooner you can report it and limit the damage.

If you have a large balance or frequent transactions, consider using a bank with strong security features and good compliance ratings. You can check a bank's regulatory history through the FDIC's website or your state banking regulator.

Frequently Asked Questions

Can a bank employee see my account balance without asking me?

Yes, as part of their job. A teller can see your balance when you ask for it, and a loan officer can review your account when processing a loan. But they cannot access your account for personal reasons — to check your balance out of curiosity or to help a friend. If they do, that is a violation.

What if a bank employee is related to me — can they access my account?

Not without your permission, even if they are family. Banks have policies against employees accessing accounts of relatives unless there is a legitimate business reason and proper authorization. Many banks flag these relationships and require extra approval. If a relative who works at your bank accesses your account without permission, report it to the compliance department.

Can I see who accessed my account and when?

You can request an access log from your bank, though not all banks provide detailed logs to customers. Ask your bank's customer service or compliance department for a record of account access. If they refuse, you can file a complaint with your regulator. You can also see transaction history in your online banking portal, which usually shows which channel processed each transaction.

What if my bank says an employee accessed my account but did not steal anything?

Unauthorized access is still a violation, even if no money was taken. Report it to the bank's compliance department and ask what disciplinary action was taken against the employee. File a complaint with your state regulator. You may also have grounds to sue the bank for the violation of your privacy rights, though damages may be limited if no money was stolen.

How long does it take for a bank to investigate unauthorized access?

Banks typically have 10 business days to acknowledge your complaint and begin an investigation. The full investigation can take 30 to 90 days, depending on complexity. For transactions, the bank must resolve disputes within 45 days under federal law. If the bank is slow, file a complaint with your regulator, which can pressure the bank to move faster.