Bank employees cannot access your account without a legitimate business reason, and doing so without permission is a fireable offense and a crime
A bank employee who logs into your account to look around, move money, or change settings without your consent or a documented business need is committing unauthorized computer access. Most banks have internal audit trails that log every employee login and what they viewed or changed. If an employee accesses your account outside their job duties, the bank's security team will catch it. The employee faces termination, criminal prosecution under the Computer Fraud and Abuse Act, and civil liability to you.
That said, some employee access is normal and legal. A teller helping you reset your password, a fraud investigator reviewing transactions after you report a dispute, or a loan officer pulling your account details to process a mortgage application—these are all legitimate reasons. The difference is that the access serves a documented business purpose and the bank has systems in place to track who accessed what and when.
If you suspect an employee accessed your account without permission, you have concrete steps to take. You can request your account's access log from the bank, file a complaint with your state banking regulator, and report the incident to the FBI's Internet Crime Complaint Center if money was stolen.
Key Takeaways
- Banks maintain detailed logs of every employee login and action, so unauthorized access is almost always discovered during internal audits or when you report suspicious activity.
- Employees accessing accounts outside their job duties face criminal charges under federal computer fraud law, termination, and civil lawsuits from the bank and the customer.
- Legitimate employee access—helping with a password reset, investigating fraud, processing a loan—is documented and tracked by the bank's security systems.
- If you believe an employee accessed your account without permission, request your access log, contact your bank's fraud department, and file a complaint with your state banking regulator.
- Banks are liable for employee theft or unauthorized access, so reporting the incident protects both you and the bank's legal standing.
How banks track employee access to accounts
Every major bank uses role-based access controls. This means an employee can only see or do what their job title allows. A teller might be able to process withdrawals and deposits but cannot change your password or transfer funds to another bank. A loan officer can pull your credit report and account balance but cannot initiate transactions. These restrictions are built into the bank's software, not left to employee judgment.
On top of role restrictions, banks log every login. The log records the employee's ID, the timestamp, which account they accessed, what screens they viewed, and what actions they took. These logs are stored separately from the main banking system and are reviewed by the bank's compliance and security teams on a regular schedule. If an employee logs in during their off-hours, accesses an account they have no business reason to touch, or performs an action outside their role, the log flags it.
When you report suspicious activity—a withdrawal you did not make, a password change you did not authorize—the bank's fraud team pulls the access log for that specific time window. If an employee made the unauthorized change, their ID and timestamp are right there. The bank then escalates to its legal and HR departments, and the employee is typically suspended pending investigation.
What counts as legitimate employee access
Your bank's employees need to access your account in several normal scenarios. If you call to report a lost debit card, the representative who helps you freeze it needs to log in. If you dispute a charge, the fraud investigator reviewing the transaction needs to see your account. If you apply for a credit card or loan, the underwriter needs to pull your credit report and account history. If you ask for a wire transfer, the employee processing it needs to confirm your identity and account details.
In each case, the employee's access is tied to a documented request or transaction. The system records why they logged in—"customer called to report lost card," "fraud dispute filed," "loan application submitted." This documentation is what separates legitimate access from snooping. If an employee logs in with no documented reason, that is a red flag.
Some banks also allow employees to access accounts for training purposes, but only on test accounts or with explicit customer consent and documentation. A bank cannot use your real account to train a new employee without your knowledge.
What happens if an employee accesses your account without permission
If an employee steals money or changes your account settings without authorization, the bank is liable. Federal law and most state laws hold banks responsible for employee theft and fraud. You are not on the hook for the loss—the bank is. This is why banks have such strict internal controls and audit trails. They are protecting themselves as much as they are protecting you.
The employee themselves faces criminal charges. Unauthorized computer access is a federal crime under the Computer Fraud and Abuse Act, which carries fines up to $250,000 and up to 10 years in prison depending on the damage caused. Many states also have their own computer fraud and theft statutes. If the employee stole money, they also face wire fraud charges, which carry separate penalties.
Beyond criminal liability, the employee can be sued civilly by both the bank and you. The bank will sue to recover the stolen funds and the cost of the investigation. You can sue for damages, emotional distress, and the cost of restoring your credit if the employee opened new accounts in your name or changed your contact information.
How to check if someone accessed your account without permission
Start by reviewing your account statements and transaction history. Look for withdrawals, transfers, or purchases you do not recognize. Check your account settings—password, security questions, email address, phone number, mailing address. If any of these changed without your action, someone accessed your account.
Next, request your account's access log from your bank. Call the fraud department or visit a branch and ask for a printout of all logins and actions on your account for a specific date range. The bank may charge a small fee, but most waive it if you are investigating suspected fraud. The access log will show the date, time, employee ID, and what was accessed or changed. If an employee made an unauthorized change, you will see their ID number and the exact timestamp.
If the access log shows an employee accessed your account without a documented business reason, or if money was stolen, file a formal complaint with your bank's fraud department in writing. Include the access log printout, the dates and amounts of suspicious transactions, and a clear statement that you did not authorize the access. Keep a copy for your records.
Reporting unauthorized access to regulators and law enforcement
If your bank does not take your complaint seriously or if the employee is still working there after you report the theft, escalate to your state banking regulator. Each state has a banking commissioner or department of financial regulation. You can file a complaint online or by mail. The regulator will investigate and can fine the bank, revoke the employee's banking license, or require the bank to take corrective action.
If money was stolen, you can also report the crime to local police and the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. The IC3 does not investigate individual cases but compiles data on cybercrime and fraud. If the employee stole a large amount or targeted multiple customers, the FBI may open an investigation.
Keep documentation of everything: your written complaint to the bank, the access log, your account statements showing the unauthorized transactions, emails or letters from the bank, and the case number if you filed a police report. This documentation protects you if the bank disputes your claim or if the case goes to court.
Protecting your account from employee access
Use a strong, unique password—at least 12 characters with uppercase, lowercase, numbers, and symbols. Do not share your password with anyone, including bank employees. Legitimate bank staff will never ask for your password. If someone claiming to be from your bank asks for it, hang up and call the bank's main number yourself.
Enable multi-factor authentication if your bank offers it. This means logging in requires both your password and a code sent to your phone or generated by an app. Even if an employee somehow got your password, they could not log in without also having your phone.
Review your account settings regularly. Check that your email address, phone number, and mailing address are correct. Set up account alerts so you are notified of large withdrawals, transfers, or password changes. Many banks let you set these alerts in your online banking settings.
Monitor your credit report. You can get a free report from each of the three major credit bureaus—Equifax, Experian, and TransUnion—once per year at annualcreditreport.com. If an employee opened accounts in your name, you will see them on your credit report. Dispute any accounts you did not open.
Frequently Asked Questions
Can a bank employee see my account balance without my permission?
Not without a documented business reason. If they do, the access log will show it. If you notice an employee accessed your account and you did not ask them to, contact the bank's fraud department immediately and ask why that employee logged in.
What if a bank employee says they need my password to help me?
Hang up and call your bank's main customer service number. Legitimate bank staff never ask for your password. If someone claiming to be from your bank asks for it, they are either a scammer or an employee acting outside their authority. Either way, do not give it to them.
How long does the bank keep access logs?
Most banks keep access logs for at least one to three years, though the exact period varies by bank and is governed by federal banking regulations. If you suspect unauthorized access, request the log as soon as possible. The longer you wait, the more likely the log has been archived or deleted.
Can I sue the bank if an employee stole from my account?
Yes. The bank is liable for employee theft. You can sue the bank for the amount stolen plus damages. Many cases settle without going to court. Contact a consumer protection attorney or your state's attorney general's office for guidance on how to proceed.
What if the bank says the access was legitimate but I did not authorize it?
Ask the bank to show you the documented business reason for the access. If they cannot produce one, escalate to your state banking regulator. The regulator can compel the bank to provide documentation and investigate whether the access was truly authorized.