Yes, someone can access your bank account without your permission, and it happens more often than most people realize

Unauthorized access to your bank account falls into two categories: someone uses your login credentials or payment card information, or they use your personal information to impersonate you and gain access through the bank itself. The first is faster and more common. The second is slower but harder to detect. Both can drain your account, open new accounts in your name, or redirect your deposits before you notice anything is wrong.

Your bank is not automatically liable for every unauthorized transaction. Whether you get your money back depends on how the access happened, how quickly you reported it, and which type of account or payment method was used. The law protects you differently depending on whether someone stole your debit card, hacked your online login, or convinced your bank to transfer funds by pretending to be you.

Key Takeaways

  • Unauthorized access usually happens through stolen login credentials, phishing emails, malware on your device, or someone physically stealing your debit card or checkbook.
  • You must report unauthorized transactions within 60 days of receiving your statement to have the strongest legal protection under federal law.
  • Debit card fraud has different protections than unauthorized ACH transfers or wire fraud, and your liability depends on how quickly you report the theft.
  • Your bank may reverse fraudulent transactions, but they can also deny your claim if they find you were negligent — such as sharing your password or writing your PIN on your card.
  • Freezing your credit and monitoring your accounts for new unauthorized activity is the fastest way to stop ongoing access and prevent identity theft.

How someone gains access to your account in the first place

The most common entry points are phishing emails that look like they come from your bank, malware that logs your keystrokes when you type your password, or data breaches at retailers or other websites where you reused the same password. Someone may also gain access by stealing your physical debit card, checkbook, or mail containing account statements or new cards. Less commonly, they may call your bank impersonating you, using personal information (your Social Security number, date of birth, mother's maiden name) to pass security questions and convince the bank to reset your password or add themselves as an authorized user.

Once inside, an unauthorized person can transfer money out via ACH (Automated Clearing House), wire it to another bank, use your debit card to make purchases or withdraw cash, write checks from your account, or set up automatic bill payments to themselves. They can also change your contact information so you do not receive alerts, or add themselves as a joint account holder so the access becomes permanent.

What federal law says about your protection

The Electronic Funds Transfer Act (EFTA) covers debit card fraud and unauthorized ACH transfers. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you report it between three and 60 days, your liability can be up to $500. If you wait longer than 60 days after your statement arrives, you may lose all protection and be liable for the full amount stolen.

Wire transfers and checks have weaker protections. Once a wire leaves your bank, it is nearly impossible to recover. Checks written by someone else in your name are technically forgeries, and your bank is supposed to catch them — but if they do not, the burden of proof falls on you to show the signature was not yours. The bank may require you to file a police report and sign an affidavit before they will reverse the transaction.

If someone opened a new account in your name using your Social Security number and personal information, that is identity theft, not account fraud. It is covered under the Fair Credit Reporting Act (FCRA) and the Identity Theft Enforcement and Restitution Act, which give you the right to dispute fraudulent accounts and place a fraud alert on your credit report.

Steps to take immediately if you discover unauthorized access

Call your bank's fraud line right away — do not use the number on your card or website, because scammers sometimes intercept those. Look up the number on your statement or the back of an old card you have in a safe place. Tell them which transactions are not yours and ask them to freeze your account temporarily to stop further unauthorized activity.

Change your online banking password from a different device (not the one you normally use, in case it has malware). Use a password that is at least 12 characters long and includes numbers, uppercase and lowercase letters, and symbols. Do not reuse passwords across different banks or websites.

If your debit card was stolen or compromised, ask your bank to cancel it and issue a new one. If your checkbook was stolen, stop payment on all outstanding checks and request new checks with a different account number if possible. If your login credentials were compromised, enable two-factor authentication on your account — this requires a code sent to your phone or generated by an authenticator app before anyone can log in, even if they have your password.

Documenting the fraud for your bank and law enforcement

Your bank will ask you to sign a Fraud Affidavit — a sworn statement that you did not authorize the transactions. Keep copies of everything: your signed affidavit, the bank's written response, your account statements showing the fraudulent transactions, and any correspondence with the bank about the dispute.

File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov. This creates an official record and gives you a recovery plan specific to your situation. You can also file a police report with your local police department, though many will not investigate bank fraud unless the amount is very large. Get a copy of the police report number — some banks require it before they will reverse transactions.

If the fraud involved checks or wire transfers, also file a complaint with your bank's Office of the Comptroller of the Currency (OCC) or the Consumer Financial Protection Bureau (CFPB). These agencies can investigate whether your bank failed to catch obvious signs of fraud or failed to follow their own security procedures.

How to prevent unauthorized access going forward

Use a unique, strong password for each bank and financial account. A password manager like Bitwarden, 1Password, or KeePass stores encrypted passwords so you only have to remember one master password. Never write your PIN on your card, share your password with anyone (including bank employees), or use easily guessed information like your birth date or pet's name.

Enable two-factor authentication on every account that offers it. This is the single most effective defense against unauthorized access, because even if someone steals your password, they cannot log in without the second factor — usually a code texted to your phone or generated by an authenticator app.

Monitor your account regularly — weekly is better than monthly. Set up account alerts through your bank's app or website so you receive a notification whenever a transaction over a certain amount occurs, or whenever your balance drops below a threshold. Review your statements as soon as they arrive, and report any unfamiliar transactions within 60 days.

Freeze your credit with the three major credit bureaus — Equifax, Experian, and TransUnion — if you suspect your personal information was compromised. A credit freeze prevents anyone from opening new accounts in your name without your permission. You can place a freeze for free at each bureau's website, and it takes effect within one business day.

What happens if your bank denies your fraud claim

Banks sometimes deny fraud claims if they believe you were negligent — for example, if you shared your password, wrote your PIN on your card, or failed to report the fraud within the required timeframe. If your bank denies your claim, you have the right to dispute it. Send a written letter to the bank's dispute department (not just an email) explaining why you believe the transaction was unauthorized and why you reported it within the legal window. Include copies of your affidavit, the bank's response, and any other documentation.

If the bank still refuses to reverse the transaction, you can file a complaint with the CFPB or your state's banking regulator. The CFPB investigates complaints and can order banks to refund money if they find the bank violated consumer protection laws. Complaints are free and can be filed online at consumerfinance.gov.

Frequently Asked Questions

How long does it take for my bank to reverse a fraudulent transaction?

Banks have up to 10 business days to investigate and up to 45 days to resolve the dispute, though many resolve it faster. During the investigation, the bank may provisionally credit your account so you have access to the money while they investigate. If they find the transaction was unauthorized, the credit becomes permanent.

Can my bank hold me liable for fraud if I did not notice it for months?

Yes, if you wait longer than 60 days after your statement arrives to report it. After 60 days, you lose federal protection and may be liable for the full amount. Some banks have shorter reporting windows in their terms of service, so check your account agreement.

What if someone used my account information to open a new bank account?

That is identity theft, not account fraud. Contact the bank that opened the fraudulent account and ask them to close it. File a report with the FTC at IdentityTheft.gov and place a fraud alert on your credit report. You may also want to freeze your credit to prevent additional accounts from being opened.

Will my bank refund me if I fell for a phishing email and gave someone my password?

Maybe. Banks sometimes deny claims if they find you were negligent, but phishing is so common that many banks now refund victims even if they gave away their password. Report the fraud immediately and explain that you received a phishing email. The bank will investigate whether the email actually came from them or a scammer.

What should I do if I see a transaction I do not recognize but I am not sure if it was me?

Contact your bank and ask them to explain the transaction — they can often tell you the merchant name, location, and time. If you still do not recognize it after they explain, report it as unauthorized. It is better to dispute a legitimate transaction (which the merchant can help resolve) than to miss a fraudulent one and lose your protection window.