The most common ways thieves access your account

Criminals get into checking accounts through five main routes: phishing emails and texts that trick you into handing over login credentials, malware on your computer or phone that records what you type, data breaches at companies where you've given your account number, skimming devices on ATMs or gas pumps that copy your card, and social engineering—calling your bank pretending to be you and convincing a representative to reset your password or transfer money.

The easiest theft happens when you reuse passwords across multiple sites. If a criminal buys a stolen password list from a data breach at a retailer or social media site, they try that same password on your bank's login page. If it works, they're in. They don't need to know your Social Security number or mother's maiden name—they already have the keys.

Text and email phishing is the second most common entry point. A message appears to come from your bank, PayPal, or a service you use, asking you to "verify your account" or "confirm your identity" by clicking a link. The link takes you to a fake website that looks identical to the real one. You enter your username and password thinking you're logging into your actual bank. You've just given a criminal both pieces of information they need.

Key Takeaways

  • Phishing emails and texts that mimic your bank are the fastest way criminals get your login information, and they work because the fake websites look nearly identical to real ones.
  • Reusing the same password across multiple accounts means a breach at one company gives thieves access to your bank account without any additional hacking.
  • Malware installed through email attachments, fake software updates, or compromised websites can record everything you type, including your banking passwords.
  • Your bank can reverse fraudulent transfers within a limited window, but only if you report the theft quickly—usually within 30 to 60 days of discovering it.
  • Two-factor authentication (a code sent to your phone or generated by an app) stops most account takeovers even if a criminal has your password.

Malware and keyloggers that record your keystrokes

Malware is software installed on your device without your permission that can record everything you type. A keylogger specifically captures keystrokes, so when you type your username and password into your bank's website, the malware sends that information to the criminal. You see your login succeed and think everything is normal. The criminal logs in separately and moves money out.

Malware usually arrives through email attachments you download and open, fake software updates (a pop-up claiming your Adobe Reader or Java needs updating, but it's actually malware), or websites that exploit security holes in your browser. Once installed, it runs in the background and you won't see it working.

Antivirus software catches most malware, but not all. The real protection is not opening attachments from people you don't know, not clicking links in unexpected emails even if they look like they're from your bank, and keeping your operating system and browser updated so hackers can't exploit known security holes.

Data breaches that expose your account number

When a company storing your checking account information gets hacked, criminals may obtain your account number, routing number, and sometimes your name and address. This is less immediately dangerous than having your password, because your account number alone doesn't let someone log into your online banking. But it does let them set up unauthorized ACH transfers (electronic transfers between bank accounts) or write checks against your account if they have your routing number too.

Major breaches happen regularly at retailers, healthcare providers, and financial services companies. You may not know your information was compromised until months later, when you see unauthorized charges or transfers. This is why monitoring your account regularly—at least weekly—matters more than waiting for a breach notification letter.

You cannot prevent data breaches at companies you do business with, but you can limit the damage by checking your account frequently and setting up alerts with your bank for any transfer over a certain amount. Most banks offer free alerts via text or email when money leaves your account.

Skimming devices and card cloning at ATMs and gas pumps

A skimmer is a thin device criminals attach to an ATM or gas pump card reader. When you insert your debit card, the skimmer reads the magnetic stripe and stores your card number. At the same time, a hidden camera or a fake keypad overlay records your PIN. The criminal then clones your card or uses the information to make online purchases.

Skimmers are hardest to spot at unmanned locations like gas pumps and ATMs, especially at night or in less-trafficked areas. They're designed to look like part of the machine. Some criminals also place a small camera above the keypad to record your PIN as you type it.

You can reduce skimming risk by using ATMs inside your bank branch during business hours, paying inside at gas stations instead of at the pump, and covering the keypad with your hand when you enter your PIN. If you notice a card reader that looks loose, doesn't fit flush with the machine, or feels different than usual, don't use it and report it to the business or bank.

Social engineering: when a criminal calls your bank pretending to be you

A criminal calls your bank's customer service line, provides your account number and some personal information (often obtained from a data breach or public records), and tells the representative they've lost access to their account. They ask the representative to reset the password, add a new phone number for two-factor authentication, or transfer money to a "secure account." If the representative doesn't verify the caller's identity carefully enough, the criminal gains control of your account.

This works because bank representatives handle dozens of password resets every day and may not ask enough verification questions. A skilled social engineer knows how to sound calm and credible, and they often have real information about you—your address, phone number, or recent transactions—that makes them seem legitimate.

You can protect yourself by telling your bank to add a verbal password or security phrase that only you know. When anyone calls to make changes, the bank should ask for this phrase. Also, never give your account number or personal information to someone who calls you, even if they claim to be from your bank. Hang up, look up the bank's official number, and call them back yourself.

What to do if you discover unauthorized transactions

The moment you notice money missing or transfers you didn't make, contact your bank by phone—not email or online chat. Call the number on the back of your debit card or your bank statement, not a number from a search result or email. Tell them you have unauthorized transactions and ask them to freeze your account immediately to stop further transfers.

Your bank will likely cancel your current debit card and issue a new one. They will also start an investigation into the fraudulent transactions. Under federal law (Regulation E), your bank must return your money if you report the fraud within 60 days of the statement showing the unauthorized transaction. If you wait longer, your protection shrinks or disappears entirely.

While the investigation is underway, your bank may temporarily credit your account so you can access your money. Once they confirm the fraud, the credit becomes permanent. The investigation typically takes 10 business days, though complex cases can take up to 45 days.

Two-factor authentication stops most account takeovers

Two-factor authentication (often called 2FA) requires a second piece of information beyond your password to log in. Usually this is a code sent to your phone via text, a code generated by an authenticator app like Google Authenticator or Authy, or a biometric scan (your fingerprint or face). Even if a criminal has your password, they can't log in without this second factor.

Most banks now offer two-factor authentication, and many make it mandatory for online banking. Some let you choose between text codes and an authenticator app. Authenticator apps are more secure than text because they can't be intercepted the way text messages can, but text is better than nothing.

Set up two-factor authentication on your bank account today if you haven't already. Then set it up on your email account, because if a criminal gains access to your email, they can use the "forgot password" feature on your bank's website to reset your banking password and lock you out of your own account.

Frequently Asked Questions

Can a criminal drain my checking account if they only have my account number?

They can attempt unauthorized ACH transfers or checks, but they cannot log into your online banking with just an account number. Your bank's fraud detection systems usually catch unauthorized ACH transfers quickly. Report any suspicious activity immediately so your bank can reverse it and investigate.

What if I don't notice the theft for three months?

You lose most of your protection. Federal law requires you to report unauthorized transactions within 60 days of the statement date showing the fraud. After 60 days, your bank has no obligation to refund you. Check your account at least weekly so you catch theft early.

If my debit card number is stolen, do I need to close my checking account?

No. Your bank will cancel the card and send you a new one. Your account number stays the same. Closing the account is unnecessary and can create problems with automatic bill payments or direct deposits. Just get the new card and update any merchants who have your old card number on file.

Can my bank force me to use two-factor authentication?

Yes. Banks can require two-factor authentication for online banking. If your bank offers it but doesn't require it, turn it on anyway. The small inconvenience of entering a code is far less disruptive than recovering from account theft.

What's the difference between a debit card theft and a checking account theft?

A debit card theft means someone used your card number to make purchases or ATM withdrawals. A checking account theft means someone logged into your online banking or set up unauthorized transfers directly from your account. Checking account theft is more serious because it can drain your entire balance at once, while debit card fraud is usually caught faster.