Yes, someone can steal money from your bank account — here's how it happens

Money can leave your account without your permission through several routes: a thief uses your debit card number, someone logs into your online banking with your password, a fraudster sets up an unauthorized transfer, or a scammer convinces you to send money yourself. The method matters because it changes what happens next — who pays you back, how fast, and what you have to prove.

Not all theft looks the same. A criminal might drain your account in minutes through a wire transfer, or they might make small repeated charges that take weeks to notice. Your bank's fraud detection might catch it before you do, or you might be the first to see it. The speed of recovery depends on which type of theft happened and how quickly you report it.

Key Takeaways

  • Debit card fraud and unauthorized transfers are covered by federal law, but you must report them within specific timeframes — 60 days for most cases — or you lose protection.
  • If someone logs into your online account and transfers money out, your bank must investigate and restore funds if you report it promptly, though the timeline varies by bank.
  • Wire transfers and ACH transfers sent by a fraudster are harder to recover because they leave your bank's system immediately, but your bank can still try to recall them if you report within hours.
  • Scams where you voluntarily send money to a criminal are almost never recovered, even though the money moved through the banking system.
  • Freezing your account and changing your password stops ongoing theft but does not recover money already gone — you need to file a dispute or fraud claim for that.

Debit card fraud and how banks handle it

When someone uses your debit card number — either the physical card or just the number — without permission, that is debit card fraud. The thief might use it online, over the phone, or in person. Your bank can see the transaction and knows it was not authorized by you.

Federal law (Regulation E) requires your bank to refund unauthorized debit card charges, but only if you report them within 60 days of the statement date when the charge appeared. If you report within two business days, your liability is capped at $50. If you wait longer than two days but report within 60 days, you could be liable for up to $500 of the loss. After 60 days, you have no protection — the money is gone and the bank does not have to give it back.

The bank's investigation usually takes 10 business days. During that time, the money stays out of your account. If the bank finds the charge was truly unauthorized, they put the money back. If they find evidence you authorized it or allowed someone else to use your card, they can keep the money and close the dispute against you.

Unauthorized online banking and account takeovers

When a criminal logs into your online banking account using your username and password, they can transfer money out, change your contact information, or lock you out entirely. This is different from debit card fraud because the thief is inside your account, not just using your card number.

Your bank is required to investigate if you report unauthorized transfers within 60 days, but the timeline for getting your money back varies. Some banks credit your account within one to three business days while they investigate. Others make you wait for the full investigation, which can take 10 to 30 days. Check your bank's fraud policy or call them to ask what their standard timeline is.

To protect yourself, use a unique password for your bank account — not the same one you use for email or social media. Enable two-factor authentication if your bank offers it. This means even if a criminal has your password, they cannot log in without also having access to your phone or email. If you see a login from a location you do not recognize, report it to your bank immediately, even if no money was taken yet.

Wire transfers and ACH transfers sent without permission

A wire transfer or ACH transfer initiated by a fraudster moves money out of your account and into another bank account, usually at a different bank. Once the money leaves your bank, it is much harder to get back because it is now in someone else's account at a different institution.

If you report an unauthorized wire or ACH transfer within one business day, your bank can try to recall it. The receiving bank may freeze the account or reverse the transfer if they catch it in time. But if the criminal has already withdrawn the money in cash or moved it again, recovery becomes nearly impossible. After one business day, your bank has no obligation to try to recover the funds, though they may still investigate.

Wire transfers are especially risky because they are designed to be irreversible. Once sent, the money is gone from your bank's control. ACH transfers are slightly slower and sometimes can be stopped if you catch them within a few hours, but speed matters enormously. If you notice an unauthorized transfer, call your bank immediately — do not wait until the next business day.

Scams where you send money yourself

A scammer convinces you to send money to them — maybe they pretend to be your bank, your utility company, or someone who needs emergency help. You voluntarily authorize the transfer, wire, or payment. Even though you were tricked, the money moved through the banking system because you told it to.

Banks almost never recover money in these cases, even though the transaction is clearly a scam. Why? Because you authorized it. The bank's systems worked correctly — they moved money where you told them to move it. The fraud happened before the transaction, not during it. Your bank may file a report with law enforcement, but they are not required to refund you.

Some banks have started offering limited recovery programs for certain scams, particularly those targeting older adults. Ask your bank if they have a scam recovery program and what it covers. But do not count on getting the money back. The best protection is to hang up on any unsolicited call asking for money, verify requests by calling the organization directly using a number from their official website, and never send money to someone you have not met in person.

What to do immediately if money is missing

Call your bank right away — do not wait for business hours if the theft happened on a weekend or evening. Many banks have 24-hour fraud lines. Tell them which transactions are unauthorized and ask them to freeze your account to stop further theft. Freezing does not recover the money, but it stops a criminal from taking more.

Change your online banking password from a different device (not your phone or computer, which might be compromised). Enable two-factor authentication if you have not already. If you think your email was also compromised, change that password too and review your email recovery options.

Ask your bank for a new debit card if yours was used fraudulently. The old card will be canceled. Get the new card expedited if possible — most banks can deliver it within two to three business days instead of five to seven.

Write down the date and time you called, the name of the person you spoke with, and what they told you. Ask for a case or reference number. Request written confirmation of your dispute within a few days. This documentation matters if you need to escalate the case or file a complaint later.

Disputing charges and filing a fraud claim

A dispute and a fraud claim are not the same thing. A dispute is what you file when you say a charge is unauthorized or incorrect. A fraud claim is what you file when you believe your account was compromised or taken over. Your bank may use different forms and timelines for each.

Most banks let you file a dispute online through your account or by calling. You will need to describe what happened, which transactions are unauthorized, and when you first noticed the problem. The bank will assign an investigation number and tell you when you can expect a decision.

Keep copies of everything: your dispute letter, the bank's response, statements showing the unauthorized charges, and any communication with the bank. If the bank denies your claim, you can escalate to the bank's complaint department or file a complaint with the Consumer Financial Protection Bureau (CFPB). The CFPB does not resolve individual cases, but they track complaints and can pressure banks to change their practices.

How to reduce the risk of theft

Use a unique, strong password for your bank account — at least 12 characters, mixing letters, numbers, and symbols. Do not use your birthday, address, or pet's name. A password manager can generate and store strong passwords for you.

Enable two-factor authentication on your bank account and your email. This means a criminal needs both your password and access to your phone or email to get in. Even if they steal your password from a data breach, they cannot log in without the second factor.

Monitor your account regularly — weekly is better than monthly. Set up account alerts if your bank offers them. Many banks let you get notified when a large transaction happens, when your password is changed, or when a login happens from a new device. These alerts give you a chance to catch fraud early.

Do not use public Wi-Fi to access your bank account. Public networks are easier for criminals to intercept. Use your phone's cellular data or a home Wi-Fi network with a strong password instead.

Shred documents with your account number, routing number, or personal information before throwing them away. Do not leave bank statements or bills visible in your car or mailbox. A criminal with your account number and routing number can set up unauthorized transfers.

Frequently Asked Questions

How long do I have to report unauthorized charges before I lose protection?

You have 60 days from the date the unauthorized charge appeared on your statement. After 60 days, your bank does not have to refund you. For debit card fraud specifically, if you report within two business days, your liability is capped at $50. If you report between two days and 60 days, you could be liable for up to $500.

Can my bank refuse to refund me if I was careless with my password?

Banks can refuse refunds if they find evidence you shared your password, wrote it down where someone could find it, or allowed someone else to use your account. However, if your password was stolen in a data breach or through phishing, that is not your fault. The bank must still investigate and refund you if you report within 60 days.

What if the thief took money from my savings account, not my checking account?

The same federal protections apply to savings accounts. You have 60 days to report unauthorized transfers, and the bank must investigate. However, savings accounts sometimes have limits on how many transfers you can make per month, which might affect how quickly you can move money back in or access it during the investigation.

Can I get my money back if I sent it to a scammer myself?

Probably not. Because you authorized the transfer, the bank is not required to refund you. Some banks have started offering scam recovery programs for certain types of fraud, particularly targeting older adults. Call your bank and ask if they have one. Law enforcement can investigate, but recovery is rare.

What should I do if my bank denies my fraud claim?

Ask the bank in writing why they denied it and request copies of their investigation. If you disagree, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. You can also contact your state's banking regulator or attorney general's office. These agencies cannot force the bank to refund you, but they can investigate whether the bank followed the law.