Yes, savings accounts can be hacked, but the methods are specific and most are preventable
A hacker can access your savings account through your online banking login, by intercepting mail, by posing as you to your bank, or by stealing your debit card number. The most common route is phishing—a fake email or text that looks like it came from your bank and tricks you into entering your username and password on a fake website. Once they have those credentials, they log in as you and transfer money out. The second most common method is social engineering: calling your bank, claiming to be you, and convincing a representative to reset your password or add a new recipient to your account.
Banks are required by federal law to reimburse you for unauthorized transfers if you report them within a specific window. The catch is that the window is narrow, and what counts as "unauthorized" depends on how the money left your account. Understanding the difference between these scenarios—and what your bank will and won't cover—determines whether you lose money or get it back.
Key Takeaways
- Phishing emails and texts that trick you into revealing your login details are the most common way hackers access savings accounts, and they work because they look nearly identical to real bank messages.
- Federal law requires banks to refund unauthorized electronic transfers if you report them within 60 days, but the refund timeline and your liability depend on how quickly you notice and report the fraud.
- If a hacker uses your debit card number rather than your online login, your liability is capped at $50 if you report it within two business days, but rises to $500 if you wait longer.
- Social engineering—calling your bank and impersonating you—is harder to reverse because the bank may have followed proper verification steps, making it your word against theirs about whether you authorized the call.
- Two-factor authentication, a strong unique password, and monitoring your account weekly are the most effective ways to prevent unauthorized access in the first place.
How hackers actually get into savings accounts
The most direct route is phishing. A hacker sends you an email or text message that appears to come from your bank. The message says your account has been locked, a suspicious login was detected, or you need to confirm your identity. It includes a link to a website that looks exactly like your bank's login page. You enter your username and password. The fake site captures those credentials and either logs into your real account immediately or sells the information to someone else who does.
The second method is social engineering. A hacker calls your bank's customer service line, claims to be you, and provides enough personal information—your name, address, last four digits of your Social Security number, or recent transaction amounts—to pass the bank's verification questions. Once verified, they ask the representative to reset your password, add a new email address to your account, or authorize a wire transfer. Many banks allow password resets over the phone for this reason, which makes this method surprisingly effective.
A third method is debit card theft. If your physical card is stolen or your card number is compromised through a data breach at a store or website, a hacker can make purchases or withdrawals using that number. This is different from account takeover because the hacker doesn't have your login credentials—they only have the card number itself.
Less common but still possible: a hacker gains access to your email account first, then uses the "forgot password" feature on your bank's website to reset your banking password. This is why your email account security matters as much as your bank account security.
What federal law requires banks to refund
The Electronic Funds Transfer Act (part of Regulation E) requires banks to refund unauthorized electronic transfers—money moved out of your account via ACH transfer, wire, debit card, or online banking. The refund is not automatic; you have to report the fraud. The timeline for reporting determines both whether you get your money back and how much of it.
If you report unauthorized transfers within two business days of discovering them, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. If you report after 60 days, the bank is not required to refund you at all, though some banks do as a courtesy. The clock starts when you discover the fraud, not when it happened—so if a hacker drains your account on a Friday and you don't check until the following Wednesday, you still have time to report within two business days of discovery.
This protection applies to transfers initiated electronically: online banking, mobile app, debit card, ACH, wire transfer. It does not apply to checks, cashier's checks, or money orders, because those are not electronic transfers. If a hacker forges a check on your account, you have different protections under different law, and the timeline is longer but the process is more complicated.
Why social engineering is harder to reverse
When a hacker calls your bank and impersonates you, the bank may have followed all its verification procedures correctly. The representative asked security questions, confirmed your identity, and processed the request. From the bank's perspective, the call was authorized. From your perspective, you never made it.
This creates a dispute that is harder to resolve than a phishing case. With phishing, you can show that you never logged into your account from the IP address where the fraudulent transfer originated. With social engineering, the bank's own records show that a verified caller requested the action. You will need to file a dispute and potentially provide evidence that you were not the person on the call—a police report, proof of your location at the time, or documentation that you were traveling or otherwise unable to make the call.
Some banks will refund social engineering fraud under Regulation E anyway, treating it as an unauthorized transfer. Others will deny the claim because they followed proper procedures. This is one reason why monitoring your account weekly matters: the sooner you notice an unauthorized password change or added recipient, the sooner you can contact your bank and prevent the money from actually leaving.
What to do if you discover unauthorized access
First, contact your bank immediately by phone using the number on your bank statement or card—not a number from an email or text, which could be fake. Tell them you believe your account has been compromised. Do not use the online banking portal or mobile app to report it, because if a hacker has access to your login, they may see your report and move the money faster.
Ask the bank to freeze your account, reset your password, and review recent transactions with you. Request that they cancel any pending transfers or wire requests. If your debit card was compromised, ask them to cancel the card and issue a new one. If your email address was added to your account without permission, ask them to remove it and change your email password immediately after the call ends.
Second, file a written dispute with your bank within 60 days of discovering the fraud. Most banks have a fraud dispute form on their website or will mail one to you. Include the date you discovered the fraud, the date of each unauthorized transaction, the amount, and a description of what happened. Keep a copy for your records.
Third, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help if the bank denies your claim. You can also file a police report, though many police departments will not investigate financial fraud unless the amount is very large.
Two-factor authentication and password strength
Two-factor authentication (2FA) makes phishing much harder to exploit. Even if a hacker has your username and password, they cannot log in without also having access to your phone or email. Your bank sends a code to your phone via text or through an authenticator app, and you must enter that code to complete the login. A hacker sitting at a fake website with your credentials cannot generate that code.
Most banks offer 2FA but do not require it. You have to turn it on yourself. Log into your online banking settings and look for "security," "two-factor authentication," "two-step verification," or "multi-factor authentication." Choose the option that sends a code to your phone via text or app rather than email, because email can be compromised the same way your bank account can.
Your password should be unique to your bank account—never reuse a password across multiple websites. If a hacker breaches a retailer's database and steals your password, they will try that same password on your bank account. A unique password means they cannot. Use at least 12 characters, mix uppercase and lowercase letters, numbers, and symbols. Write it down and store it in a locked drawer at home, or use a password manager like Bitwarden or 1Password that encrypts your passwords and stores them securely.
Monitoring your account and catching fraud early
Check your savings account at least once a week, either through online banking or by calling your bank's automated line. Look for transactions you do not recognize, new recipients added to your account, or changes to your contact information. The sooner you spot fraud, the sooner you can report it and the more likely you are to recover the full amount.
Many banks offer account alerts: notifications sent to your phone or email when a transaction over a certain amount occurs, when a new recipient is added, or when your password is changed. These alerts are free and can give you hours or days of warning before a hacker actually moves money. Set up alerts for any transaction over $1, or at least over $100, depending on your comfort level.
If you have direct deposit, watch for delays. If your paycheck does not arrive on the expected day, contact your employer and your bank immediately. A hacker may have changed your account information to redirect your deposit elsewhere. If you have automatic bill payments, make sure they go through on schedule. A missed payment can signal that your account has been compromised.
What banks are not required to cover
Banks are not required to refund money you sent to a scammer yourself, even if you were tricked into sending it. If a hacker convinced you that you were sending money to your own account at another bank, or to a legitimate business, and you authorized the transfer, the bank will not reverse it. This is called an "authorized push payment" or APP fraud, and it is treated differently from account takeover.
Some banks have started offering APP fraud refunds as a competitive feature, but they are not legally required to. If you send money to what you think is a trusted recipient and later discover it was a scammer, contact your bank immediately and ask if they will reverse it. The answer depends on the bank's policy, not on federal law.
Banks are also not required to cover losses from checks or cashier's checks, because those are not electronic transfers. If a hacker forges a check on your account, you have protections under the Uniform Commercial Code and the Check 21 Act, but the timeline and process are different.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
Banks must begin their investigation within 10 business days of your report and complete it within 45 days. During that time, they must provisionally credit your account—put the money back while they investigate. If they find the transfer was truly unauthorized, the provisional credit becomes permanent. If they find you authorized it, they remove the credit. Most banks complete the process in two to three weeks.
Can a hacker drain my entire savings account?
Yes, if they have your online banking login and you do not have two-factor authentication enabled. They can transfer your entire balance out in a single transaction. This is why two-factor authentication is so important—it prevents this scenario even if your password is compromised. Federal law will refund you if you report it within 60 days, but you will be without that money for two to three weeks while the bank investigates.
What if my bank says the transfer was authorized and refuses to refund me?
File a written dispute with the bank's compliance department and reference Regulation E of the Electronic Funds Transfer Act. If the bank still refuses, you can file a complaint with your bank's federal regulator (the OCC, Federal Reserve, or FDIC, depending on the bank's charter) or with the Consumer Financial Protection Bureau. These agencies can force the bank to reconsider.
Is my money safer in a savings account or a checking account?
Both are equally vulnerable to hacking because both are protected by the same federal law. The difference is that checking accounts are used more frequently, so fraud is often caught faster. Savings accounts are checked less often, so unauthorized transfers may go unnoticed longer. The protection is the same; the risk is that you discover the fraud after 60 days and lose the refund.
Do I need to close my account if it has been hacked?
Not necessarily. Once your bank has reset your password, enabled two-factor authentication, and removed any unauthorized recipients or email addresses, your account is secure again. You can keep it open. Close it only if you want to start fresh or if the bank recommends it. If you do close it, make sure all pending disputes have been resolved first, because closing the account can complicate the investigation.