Yes, someone can steal money from your savings account, but the method matters for what happens next

Money leaves a savings account without your permission through a few specific routes: someone uses your debit card or card number, logs into your account with your password, writes a check against your account, or convinces your bank to move money on their behalf. Each one triggers different protections and different timelines for getting your money back. The speed of recovery depends on how the theft happened and how quickly you report it.

Your bank is legally required to investigate unauthorized transactions, but you have to report them first. The window for reporting matters—report within 60 days of your statement and you are protected under federal law. Wait longer and your protection shrinks or disappears entirely. If someone stole money and you did not catch it for months, you may not recover anything.

Key Takeaways

  • Debit card fraud and unauthorized account access are the most common ways money leaves a savings account without permission.
  • You must report unauthorized transactions within 60 days of your statement to receive full federal protection under Regulation E.
  • Your bank will investigate and typically refund stolen money within 10 business days if the claim is straightforward.
  • Phishing emails, shared passwords, and unattended card readers are the most common entry points for account theft.
  • Freezing your account immediately after discovering theft stops further withdrawals while the bank investigates.

How thieves access savings accounts

Debit card theft is the simplest route. A thief uses your physical card, a stolen card number, or a card number copied from a receipt or online purchase. The transaction shows up on your statement within one to three business days. Your bank can reverse it, but only if you report it.

Password compromise happens when someone obtains your online banking password through phishing (a fake email pretending to be your bank), malware on your computer, or a data breach at another company where you used the same password. Once they have your password, they can log in and transfer money out or change your contact information so you do not see the theft happening. This is harder to reverse because the bank sees it as an authorized login.

Check fraud occurs when someone writes checks against your account without permission. This requires access to your checkbook or knowledge of your account number and routing number (both printed on the bottom of every check). Checks clear more slowly than debit transactions—typically three to five business days—which gives you a window to catch it.

Social engineering means a thief calls your bank pretending to be you, provides enough personal information to pass verification, and asks the bank to move money or add a new payee. This is rare at large banks with strong verification procedures, but it happens at smaller institutions or when a thief has stolen your Social Security number and other identity details.

What federal law requires your bank to do

Regulation E is the federal rule that governs electronic fund transfers and debit card fraud. It says your bank must investigate any transaction you report as unauthorized within 10 business days. If the bank cannot complete the investigation in that time, it must refund your money temporarily while it continues looking.

The bank has up to 45 days total to finish the investigation and tell you the outcome. If it finds the transaction was truly unauthorized, you get the money back permanently. If it finds you authorized it (or cannot prove you did not), the bank keeps the money and closes the case.

Your liability for unauthorized debit card transactions depends on when you report them. Report within two business days of discovering the theft and you lose nothing. Report between two and 60 days and you can be liable for up to $50. Report after 60 days and you can lose the entire amount stolen—the bank has no obligation to refund you.

This 60-day clock starts from the date your statement was mailed or made available to you online, not from the date the theft occurred. If a thief stole money three months ago but you just opened your statement today, you still have 60 days from today to report it.

How to report theft and freeze your account

Call your bank immediately using the number on the back of your card or your statement—do not use a number from an email or search result, as scammers sometimes intercept these. Tell the bank which transactions are unauthorized and when you first noticed them. The bank will ask you to confirm recent legitimate transactions to establish what is yours and what is not.

Ask the bank to freeze your account or debit card right away. This stops the thief from making more withdrawals while the investigation happens. The bank will usually issue you a new card within five to seven business days. You can still access your account online and by phone, but no new debit transactions will go through.

Request written confirmation of your report. The bank should send you a letter within three business days that includes the date you reported the fraud, which transactions you reported, and the bank's investigation timeline. Keep this letter—you will need it if you dispute the bank's findings or file a complaint with your state banking regulator.

If the theft involved your password or online account access, change your password immediately after calling the bank. Use a password you have never used anywhere else. If you use the same password at other banks or financial sites, change those too.

What happens during the bank's investigation

The bank will contact the merchant or other bank involved in the transaction (if money was transferred out). It will ask for proof that you authorized the transaction—a signature, PIN entry, or other verification. If the merchant or receiving bank cannot provide proof, the transaction is usually reversed.

For debit card fraud, the bank checks whether the card was present at the time of the transaction, whether a PIN was used correctly, and whether the transaction matches your normal spending patterns. A $2,000 cash withdrawal at 3 a.m. when you normally spend $50 a day on groceries looks suspicious and is easier to reverse than a $40 gas station purchase.

For account access fraud (someone logged in with your password), the investigation is more complicated. The bank has to determine whether you shared your password, whether you were negligent in protecting it, or whether the thief obtained it through no fault of your own. If the bank finds you were careless—you wrote your password down, used an obvious password, or shared it with someone—it may deny your claim.

The bank will contact you during the investigation if it needs more information. Respond quickly. Delays on your end can extend the investigation timeline beyond the 10-day initial period.

What to do if the bank denies your claim

If the bank investigates and decides the transaction was authorized or that you were negligent, it will send you a written explanation. You have the right to dispute this decision. Request the bank's evidence in writing and review it carefully. Look for errors in dates, amounts, or transaction details.

File a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB) if you believe the bank investigated incorrectly. Include copies of your original fraud report, the bank's investigation letter, and any evidence that the transaction was not yours. The regulator will contact the bank and ask it to review the case.

If the theft involved identity theft beyond just your account—the thief opened new accounts in your name or took out loans—file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help you dispute fraudulent accounts opened by the thief.

Small claims court is an option if the amount stolen is within your state's limit (usually $5,000 to $10,000) and the bank refuses to budge. You will need documentation of the fraud report, the bank's denial, and evidence that the transaction was not yours. Many people win these cases because banks often fail to investigate thoroughly.

How to prevent theft in the first place

Use a unique password for your bank account—one you do not use anywhere else. If another website is breached and your password is stolen, the thief cannot use it to access your bank. A password manager like Bitwarden or 1Password can generate and store complex passwords so you do not have to remember them.

Enable two-factor authentication on your bank account if it offers it. This means logging in requires both your password and a code sent to your phone or generated by an app. Even if a thief has your password, they cannot access your account without this second code.

Check your statements weekly, not monthly. The sooner you catch unauthorized transactions, the faster you can report them and the more protection you have. Many banks offer alerts for transactions over a certain amount—set these to a low threshold so you know immediately if something unusual happens.

Do not use debit cards for online purchases if you can avoid it. Use a credit card instead—credit card fraud has different protections and is often easier to dispute. If you must use a debit card online, use a virtual card number (many banks offer this) that is linked to your account but cannot be used twice.

Shred documents with your account number before throwing them away. Do not leave statements or checks in your trash or recycling bin. Do not give your account number to anyone who calls you claiming to be from your bank—legitimate banks never ask for this information over the phone.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Your bank must refund the money within 10 business days if the fraud is straightforward (like a stolen debit card). If the bank needs more time to investigate, it must refund you temporarily while it continues. The full investigation takes up to 45 days. If the bank finds the transaction was unauthorized, you keep the refund. If it finds you authorized it, the bank takes the money back.

What if I reported the theft late—more than 60 days after my statement?

You lose federal protection under Regulation E. The bank has no legal obligation to refund you. However, many banks will still investigate and refund unauthorized transactions as a customer service gesture, especially if you have been a customer for a long time. Call and ask, but do not expect a refund. This is why checking statements regularly matters.

Can someone steal money if they only have my account number?

Yes. With your account number and routing number (both on the bottom of your checks), someone can write checks against your account or set up unauthorized transfers. They cannot use a debit card, but they can drain your account through other methods. Report this to your bank immediately and ask for a new account number.

Does my bank's insurance cover theft?

No. FDIC insurance protects your deposits if the bank fails, not if someone steals from you. Fraud protection comes from federal regulations like Regulation E, not from insurance. Your bank is required by law to investigate and refund unauthorized transactions—this is not optional.

What if the thief transferred my money to another bank?

Your bank will contact the receiving bank and ask it to freeze the account and return the money. This takes longer than a simple reversal—usually 10 to 20 business days—because two banks have to coordinate. The receiving bank may hold the money while it investigates whether the transfer was authorized. Keep reporting to your original bank throughout this process.