Yes, someone can steal money from your bank account, but the path depends on how they get access

Money leaves your account without your permission through three main routes: someone uses your debit card or card number, someone logs into your account directly, or someone tricks your bank into moving money on your behalf. The first two happen when criminals get your card details or login credentials. The third happens when a scammer impersonates you to a bank employee or uses a forged check or wire instruction. Each route has different protections, different timelines for getting your money back, and different things you need to do immediately.

The speed of recovery depends on which route was used and how fast you report it. Debit card fraud reported within two business days is usually refunded within one to three days. Account takeover — when someone logs in as you — can take weeks to sort out because the bank has to prove the transaction was not authorized by you. Unauthorized wire transfers or checks are the slowest, sometimes taking 30 to 90 days.

Key Takeaways

  • Debit card fraud is refunded fastest: report it within two business days and you are typically protected for the full amount, with money back in one to three days.
  • If someone logs into your account directly, the bank must investigate before refunding, which can take 10 to 30 days even if you report immediately.
  • Unauthorized wire transfers and checks are the hardest to recover because banks treat them as completed transactions; recovery can take 30 to 90 days or longer.
  • You must report fraud to your bank in writing (not just by phone) within a specific window — usually 60 days — or you lose the right to dispute the transaction.
  • Freezing your credit with the three bureaus (Equifax, Experian, TransUnion) stops criminals from opening new accounts in your name while you sort out the theft.

Debit card and card number theft: fastest to recover

When a criminal uses your debit card number or physical card to make a purchase or withdrawal, your bank treats this as a card fraud claim. You are protected under federal law (Regulation E) as long as you report it within two business days of discovering the unauthorized transaction. If you report within that window, you are liable for zero dollars — the bank refunds the full amount.

Report by calling your bank's fraud line (the number is on the back of your card) and then follow up in writing within 10 days. The bank will issue a temporary credit within one to three business days while it investigates. A permanent refund usually follows within 10 business days. If you wait longer than two business days to report, your liability jumps to $50, and if you wait more than 60 days, you could lose the entire amount.

The bank will cancel your card and issue a new one, usually within 5 to 10 business days. In the meantime, set up a temporary payment method for bills and regular expenses — use a credit card, online banking bill pay, or a different debit card if you have one.

Account takeover: when someone logs in as you

If a criminal has your username and password and logs into your account to transfer money, withdraw cash, or change your contact information, this is account takeover or unauthorized access. It is harder to recover from than card fraud because the bank has to investigate whether the login was actually unauthorized — criminals sometimes use stolen credentials that look legitimate to the bank's systems.

Call your bank immediately and tell them your account has been compromised. Change your password from a different device (not the one you normally use, in case it is infected with malware). Ask the bank to freeze your account temporarily so no further transactions can go through. Then send a written dispute letter within 60 days, listing each unauthorized transaction with dates and amounts.

The bank has 10 business days to acknowledge your claim and 45 days to investigate. During that time, you will not have access to the disputed funds. If the bank finds the transactions were unauthorized, it refunds you within one to three business days after the investigation closes. If it finds the transactions were authorized (for example, if you had shared your password with someone), you will not get the money back. This is why account takeover disputes take longer — the bank is trying to determine whether you actually authorized the person who logged in.

Unauthorized wire transfers and checks: slowest recovery

Wire transfers and checks are treated differently because they are considered completed transactions once they leave your account. If a criminal forges your signature on a check or tricks your bank into wiring money to an account they control, recovery is not may provide and can take months.

For forged checks, report the fraud to your bank in writing within 30 days of receiving your statement. The bank then has to contact the receiving bank and ask them to freeze the account the check was deposited into. If the money is still there, it can be recovered within 30 to 60 days. If the receiving bank has already released the funds or the account holder has withdrawn the money, recovery becomes a civil matter — you may have to sue the person who deposited the check.

For unauthorized wire transfers, the timeline is even longer. Report it immediately by phone, then in writing within 60 days. Your bank will contact the receiving bank and ask them to recall the transfer. If the receiving bank cooperates and the money has not been moved, you may get it back within 30 to 90 days. If the money has already been withdrawn or transferred to another account, recovery is unlikely. Wire transfers are nearly impossible to reverse once the receiving bank releases the funds, which is why they are a favorite method for scammers.

What to do the moment you discover unauthorized transactions

The first 24 hours matter. Call your bank's fraud line immediately — do not wait until business hours if the theft happened on a weekend or holiday. Most banks have a 24/7 fraud line on the back of your card. Tell them which transactions are unauthorized and ask them to freeze your account.

Next, change your password from a device you know is secure (ideally a computer or phone that has not been used to access your banking app before). Use a password that is at least 16 characters long and includes uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used anywhere else.

Then, place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. You can do this online at any of their websites or by calling. A fraud alert tells lenders to verify your identity before opening new accounts in your name. It lasts one year and is free. If you believe your identity has been stolen (not just your bank account), you can also place a credit freeze, which blocks all credit inquiries until you unfreeze it.

Finally, send a written dispute letter to your bank within 60 days. Include your account number, the date you discovered the fraud, a list of each unauthorized transaction with dates and amounts, and a statement that you did not authorize these transactions. Keep a copy for your records and send it certified mail so you have proof of delivery.

How criminals get your bank account information in the first place

Criminals steal bank account details through phishing emails and texts that look like they come from your bank, malware on your computer or phone that captures your keystrokes, data breaches at retailers or other companies where you have used your card, and social engineering — calling your bank and pretending to be you to reset your password or add a trusted contact.

Phishing is the most common. You receive an email or text that says your account has been locked or there is suspicious activity, and it asks you to click a link and log in. The link takes you to a fake website that looks identical to your bank's site. When you enter your username and password, the criminals capture it. Never click links in unsolicited emails or texts. Instead, go directly to your bank's website by typing the address into your browser, or call the number on the back of your card.

Malware infects your device when you download an attachment from an email, visit a compromised website, or install software from an untrusted source. It runs silently in the background and records everything you type, including your banking passwords. Protect against this by keeping your operating system and antivirus software up to date, not opening attachments from people you do not know, and not downloading software from anywhere except official app stores or the publisher's website.

Protecting your account from future theft

Enable two-factor authentication (2FA) on your bank account. This means that even if a criminal has your password, they cannot log in without also having access to your phone or email. Most banks offer 2FA through an authenticator app (like Google Authenticator or Authy), text message, or push notification to your phone. Authenticator apps are more secure than text messages because they cannot be intercepted by SIM swapping — a scam where a criminal convinces your phone company to transfer your number to a new phone they control.

Set up account alerts so your bank texts or emails you whenever a transaction over a certain amount is made, your password is changed, or a new device logs in. These alerts give you a chance to catch fraud within hours instead of days. Most banks let you customize the alert threshold — you might set it to $1 for online transfers and $100 for in-person debit card purchases.

Use a credit card instead of a debit card for online purchases and subscriptions. Credit card fraud is easier to dispute than debit card fraud, and you are not spending money directly from your checking account. If a credit card is compromised, the card company refunds the fraudulent charges and you can still access your bank account while the dispute is being investigated.

Do not share your password with anyone, including family members or your bank. Your bank will never ask for your password. If someone needs to access your account on your behalf, use your bank's authorized user or power of attorney feature instead.

Frequently Asked Questions

How long do I have to report fraud before I lose protection?

For debit card fraud, you have two business days to report and keep zero liability; after that, you could be liable for up to $50. For all other unauthorized transactions, you have 60 days to file a written dispute with your bank. After 60 days, you lose the right to dispute the transaction and cannot recover the money.

Will my bank refund me while the investigation is happening?

For debit card fraud, yes — you get a temporary credit within one to three days. For account takeover and unauthorized transfers, no — your bank freezes the disputed funds during the investigation, which can take 10 to 45 days. You will not have access to that money until the investigation closes.

What if the criminal transferred my money to another bank?

Your bank will contact the receiving bank and ask them to freeze the account and return the funds. If the receiving bank cooperates and the money is still there, recovery takes 30 to 90 days. If the money has already been withdrawn or transferred again, recovery is unlikely and you may need to pursue a civil claim.

Can I get my money back if I gave my password to someone and they stole from me?

Probably not. If you voluntarily shared your password with someone — a family member, a friend, or someone you thought you could trust — the bank will likely consider the transactions authorized and will not refund you. The only exception is if you can prove the person committed fraud or theft, in which case you can pursue criminal charges or a civil lawsuit.

What should I do if my bank says the fraud was my fault?

Ask the bank to explain in writing why they believe the transaction was authorized. If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can investigate and force the bank to reconsider. You can also contact your state's banking regulator or attorney general's office.