Who can actually access your bank account

Yes, someone else can access your bank account — but only if you give them permission, or if they have legal authority to do so. The most common ways are: you add them as an authorized user or joint account holder; they have your login credentials (username, password, security questions); they obtain a court order; or they are a creditor with a judgment against you. A stranger cannot simply walk into your account without one of these.

The risk is real but manageable. Banks have fraud protections, but those protections work best when you act quickly. If someone accesses your account without permission, the speed of your response determines how much of your money you can recover.

Key Takeaways

  • Joint account holders and authorized users can access your account fully or partially depending on what permissions you granted them.
  • If someone logs in using stolen credentials, federal law (Regulation E) requires your bank to refund unauthorized transfers within a specific window, but only if you report it promptly.
  • A creditor with a court judgment can freeze your account or garnish funds, but only after serving you with legal papers.
  • Changing your password, enabling two-factor authentication, and monitoring your account regularly are your strongest defenses against unauthorized access.

Authorized access: joint accounts and added users

If you opened a joint account or added someone as an authorized user, they have legal access to your money. A joint account holder owns the account equally with you and can withdraw, transfer, or close the account without your permission. An authorized user has more limited rights — they can typically withdraw and transfer, but cannot close the account or change ownership. The exact permissions depend on what you selected when you set up the account.

This matters because if you added someone and later want to remove them, you cannot simply call the bank and ask them to be deleted. You must go to the bank in person (or follow your bank's specific removal process) and remove them yourself. The other person does not have to agree. However, if the account is truly joint, removing one person may require closing the account and opening a new one.

If you are concerned about someone you added, review your account agreement or call your bank to understand exactly what access they have. Then decide whether to remove them or move your money to a separate account.

Unauthorized access: stolen passwords and fraud

If someone logs into your account without your permission using stolen credentials, your bank is required to investigate and refund the money — but only if you report it within a specific timeframe. Under Regulation E (a federal rule), you have 60 days from the date your bank statement shows the unauthorized transaction to report it. If you report within that window, the bank must refund the full amount while they investigate.

If you report after 60 days, the bank may still refund you, but they are not required to. Some banks extend this window voluntarily, but do not count on it. The key is to check your account regularly — weekly is safer than monthly — and report anything suspicious immediately.

When you report fraud, the bank will freeze the account, issue you a new debit card, and change your online login credentials. They will also ask you to confirm which transactions were yours and which were not. Keep records of everything: the date you reported it, who you spoke to, and what they said they would do.

Legal access: court orders and creditor garnishment

A creditor or government agency can access your account if they have a court judgment against you. This is called garnishment or levy. The process requires them to win a lawsuit against you, get a judgment, and then serve your bank with a legal order to freeze or seize funds. You will receive notice of the lawsuit before this happens — usually a summons and complaint delivered to your home or workplace.

If you receive a court summons, do not ignore it. Responding (or having a lawyer respond) gives you a chance to dispute the debt or negotiate a payment plan. If you ignore it and lose by default, the creditor can then pursue garnishment.

Once a garnishment order reaches your bank, the bank will freeze the account for a set period (usually 21 days) to give you time to object. If you do not object, the bank releases the funds to the creditor. Some funds are protected from garnishment — Social Security, disability payments, and certain other government benefits — but your bank may not automatically protect them. You may need to file a claim with the court to prove the money is protected.

How to prevent unauthorized access

Start with your password. Use a password that is at least 12 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is unique to your bank account — do not reuse it anywhere else. Store it in a password manager (like Bitwarden, 1Password, or Dashlane) rather than writing it down or using the same password for multiple sites.

Enable two-factor authentication (2FA) on your online banking. This means that even if someone has your password, they cannot log in without a second piece of information — usually a code sent to your phone via text or generated by an authenticator app. Most banks offer this for free. Use an authenticator app (like Google Authenticator or Authy) rather than text messages if your bank supports it, because text messages can be intercepted.

Monitor your account weekly. Set up account alerts through your bank's app or website so you receive a notification for every transaction over a certain amount (you choose the threshold). Review your statements as soon as they arrive, not weeks later. If you spot something wrong, report it immediately — do not wait to see if it resolves itself.

Do not share your login information with anyone, including bank employees. Your bank will never ask for your password via email, phone, or text. If someone claiming to be from your bank asks for it, hang up and call the bank's official number on the back of your card.

What to do if someone accesses your account without permission

Call your bank immediately — do not email or use online chat for this. Find the fraud or security number on the back of your debit card or on your bank's website. Tell them you have unauthorized transactions and ask them to freeze your account right away. They will cancel your card and issue a new one.

Ask the bank to send you a written summary of the unauthorized transactions. This becomes your record for the dispute. Then file a written dispute with your bank within 60 days of the statement date showing the fraudulent transaction. Use the bank's official dispute form if they have one.

If the bank refuses to refund you or takes longer than 10 business days to respond, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can force them to refund you if they violated the law.

Consider placing a fraud alert or credit freeze with the three credit bureaus (Equifax, Experian, TransUnion) if you believe your identity has been compromised. A fraud alert tells creditors to verify your identity before opening new accounts in your name. A credit freeze blocks creditors from accessing your credit report entirely. Both are free and take about 15 minutes to set up online.

Removing someone from your account

If you want to remove a joint account holder or authorized user, contact your bank directly. Most banks require you to visit a branch in person with a photo ID, though some allow it online. Ask what documents you need to bring — some banks require the account agreement or a notarized request.

If the other person is uncooperative or you are concerned about their reaction, consider opening a new account at a different bank and transferring your money there instead. This is faster than waiting for a removal process and gives you a fresh start with new login credentials that only you know.

If you are in a domestic violence situation and are concerned about an abuser accessing your account, contact the National Domestic Violence Hotline at 1-800-799-7233. They can help you create a safety plan, including steps to protect your money and open an account the abuser does not know about.

Frequently Asked Questions

Can my spouse access my bank account without my permission?

Only if you added them as a joint account holder or authorized user. If the account is in your name only, they cannot access it legally — but if they have your password, they can access it without your knowledge. If you are concerned, change your password and enable two-factor authentication immediately. If you are in a domestic violence situation, contact the National Domestic Violence Hotline for help.

What if my bank says the fraud is my fault because I shared my password?

Regulation E protects you even if you shared your password, as long as you report the unauthorized transaction within 60 days. The bank cannot refuse to refund you simply because you were careless. File a written dispute and escalate to the CFPB if the bank refuses to pay.

How long does it take to get my money back after I report fraud?

Your bank must credit your account within 10 business days of receiving your dispute, though they may investigate for up to 45 days. If they find the transaction was truly unauthorized, the credit becomes permanent. If they find it was authorized, they will reverse the credit and you will owe the money back.

Can a scammer access my account if they only have my account number?

They cannot log into your online account with just the account number, but they may be able to set up unauthorized transfers or bill payments if they also have your routing number. Report this to your bank immediately and ask them to block any pending transfers. Monitor your account closely for the next 30 days.

What should I do if I think someone is accessing my account but I have not seen fraudulent transactions yet?

Change your password and enable two-factor authentication right away. Set up account alerts for all transactions. If you suspect someone has your login information but has not used it yet, there is no fraud to report yet — but taking these steps now prevents it from happening. Monitor your account weekly for the next month.