Yes, someone can steal your checking account — here's how it happens

A thief can drain your checking account without your permission through several routes: they can use your debit card number, log into your account with your password, set up unauthorized transfers, or convince your bank they are you and change your contact information. The damage can happen in hours. The good news is that federal law limits your liability if you report the theft quickly, and your bank has a legal obligation to investigate.

The speed of the theft depends on the method. A stolen debit card number used online can drain your account in minutes. Someone with your login credentials can transfer money out immediately. A thief who calls your bank posing as you can change your password and lock you out of your own account within one phone call. The longer you wait to notice and report it, the harder it becomes to recover the money.

Key Takeaways

  • Federal law caps your liability at $50 if you report a stolen debit card within two business days, and $500 if you report it within 60 days.
  • Unauthorized transfers initiated by someone with your login information are covered under the Electronic Funds Transfer Act, which requires your bank to investigate and restore funds.
  • A thief can change your password, add a new phone number, and lock you out of your account by calling your bank and passing security questions — this is called account takeover.
  • You must report the theft to your bank in writing within 60 days to preserve your legal protections; a phone call starts the process but does not meet the deadline requirement.
  • Checking account theft is different from credit card fraud; your bank account is the source of your money, so the stakes are higher and the recovery process is slower.

The most common ways a thief accesses your checking account

Stolen debit card number is the simplest route. A thief uses your card details to make online purchases or withdrawals. You may not notice for days. Your bank can reverse fraudulent charges, but only if you report them. The Electronic Funds Transfer Act requires your bank to investigate and restore the money if you report within 60 days.

Phishing and password theft give a thief direct login access. They receive an email that looks like it came from your bank, click a link, and enter their username and password on a fake website. The thief now has your credentials and can log in from anywhere, transfer money to another account, change your recovery email, and lock you out. This often happens without you knowing until your account is empty.

Account takeover through social engineering means the thief calls your bank, claims to be you, and answers security questions using information they found online or bought from a data broker. Once they pass verification, they change your password and phone number. You are now locked out of your own account. This is one of the fastest ways to lose access.

Malware and keyloggers record your keystrokes or take screenshots of your screen. If you log into your bank on an infected computer, the malware captures your username, password, and any codes your bank sends to your phone. The thief then logs in and transfers money out.

What your bank is required to do when you report theft

When you report unauthorized activity, your bank must acknowledge your report in writing within one business day. They then have up to 10 business days to investigate and either restore your money or explain why they believe the transaction was authorized. If the investigation is not finished by day 10, they must put the money back into your account while they continue investigating — they can take it back later only if they find evidence you authorized the transaction.

This timeline applies to unauthorized transfers and debit card fraud. The bank cannot simply tell you to wait or refuse to investigate. If they do, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator.

Your liability depends on how fast you report the theft. If you report a stolen debit card within two business days, you are liable for no more than $50 of unauthorized charges. If you report it between two and 60 days, you are liable for up to $500. After 60 days, you may lose all protection — the bank can argue you were negligent in not checking your account sooner. This is why the 60-day window is critical.

Steps to take immediately if you think your account has been compromised

Call your bank's fraud line right away — the number is on the back of your debit card or on your monthly statement. Tell them which transactions are unauthorized. The bank will freeze your account or issue a new debit card. Do this before the thief can move more money out.

Change your password from a different device — not the computer or phone you normally use, in case it is infected with malware. Use a password that is at least 12 characters long and includes numbers, uppercase letters, and symbols. Do not reuse a password you have used anywhere else.

Check your account settings for changes you did not make. Look for a new phone number, email address, or recovery contact. If the thief changed these, change them back immediately. Check your linked accounts — if you have transfers set up to another bank, make sure the destination account is still yours.

File a written report with your bank within 60 days. A phone call is not enough — you need a paper trail. Send a letter to the address on your statement or use your bank's online dispute form. Include the date you called, the name of the person you spoke to, which transactions are unauthorized, and the dollar amount. Keep a copy for your records.

Check your credit report for new accounts opened in your name. Go to annualcreditreport.com and request your report from all three bureaus — Equifax, Experian, and TransUnion. If you see accounts you did not open, file a dispute with each bureau and consider placing a fraud alert on your credit file.

How to prevent your checking account from being stolen

Use a strong, unique password for your bank account — one you do not use for email, social media, or other sites. If a thief steals your password from one website, they will try it on your bank account. A password manager like Bitwarden or 1Password can generate and store complex passwords so you do not have to remember them.

Turn on two-factor authentication if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Text-based codes are better than nothing, but an authenticator app is more secure because a thief cannot intercept it the way they can intercept a text.

Do not click links in emails or texts that claim to be from your bank. Instead, go directly to your bank's website by typing the address into your browser. Scammers create fake login pages that look identical to the real thing. If you are unsure whether an email is real, call your bank's customer service number from the back of your card.

Monitor your account regularly — at least once a week. Set up account alerts if your bank offers them. Many banks let you set a threshold, such as "alert me if a transaction over $100 is made," so you catch unauthorized activity quickly. The faster you report it, the faster you get your money back.

Keep your devices secure. Use antivirus software, keep your operating system and browser updated, and do not use public WiFi to log into your bank account. If you must use public WiFi, use a VPN service first.

What happens if your bank refuses to investigate or restore your money

If your bank does not respond to your dispute within the required timeframe, or if they refuse to investigate, you have options. File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards complaints to the bank and tracks patterns of abuse. Banks take CFPB complaints seriously because they affect regulatory ratings.

You can also file a complaint with your state's banking regulator. Each state has a department of financial regulation or similar agency that oversees banks. A quick search for "[your state] banking regulator" will give you the contact information and the process for filing.

If the amount is large enough, you may want to consult a lawyer. Some attorneys specialize in consumer banking disputes and can send a demand letter to your bank, which often prompts faster action than a complaint alone.

Keep all documentation: your written dispute letter, the bank's response, copies of your statements showing the unauthorized transactions, and any emails or letters you exchanged with the bank. This paper trail is what regulators and lawyers use to build a case.

The difference between checking account theft and credit card fraud

Credit card fraud is easier to dispute because the credit card company's money is at risk, not yours. You report fraudulent charges and the card company investigates. Your liability is capped at $50 by law, and most card companies waive even that.

Checking account theft is harder because it is your money that is gone. The bank is not out anything — you are. The bank has to investigate whether you authorized the transaction, and the burden of proof is on you to show you did not. This is why the 60-day reporting window is so important: the longer you wait, the harder it is to prove you did not authorize the transfer.

Unauthorized transfers from your checking account are covered under the Electronic Funds Transfer Act, which gives you the same protections as debit card fraud. But the investigation process is slower, and recovery can take weeks or months. During that time, you may not have access to the money, which is why prevention is so much more valuable than recovery.

Frequently Asked Questions

Can a thief drain my entire checking account in one day?

Yes. If they have your login credentials or debit card number, they can transfer or withdraw your entire balance in hours. This is why monitoring your account weekly and setting up transaction alerts matters — the faster you notice, the faster you can stop it and report it to your bank.

What if I do not report the theft within 60 days?

You lose your legal protections under the Electronic Funds Transfer Act. Your bank can argue you were negligent in not checking your account sooner and refuse to restore the money. Some banks may still help you, but you have no legal right to demand it. This is why the 60-day deadline is critical.

Will my bank give me a new account number if my account is compromised?

Usually not automatically. Your bank will issue a new debit card, but the account number stays the same. If you have automatic deposits or payments set up, they will continue going to the same account. If you want a completely new account number, you can ask your bank to close the old account and open a new one, but this is not required and can disrupt your direct deposits.

Can someone steal my checking account if they only have my account number?

They can attempt to, but it is harder. With just your account number, they cannot log into your online banking. They could try to set up an unauthorized transfer or ACH payment, but most banks require additional verification. If they succeed, you are protected by the Electronic Funds Transfer Act as long as you report it within 60 days.

What should I do if my bank says the unauthorized transaction was authorized?

Ask them to show you the evidence — the IP address, device information, or security questions answered. If you can prove you were not in that location or on that device, dispute it. If the bank still refuses, file a complaint with the Consumer Financial Protection Bureau or your state banking regulator. Do not accept a "no" without documentation.