Autopay from your checking account is generally safe if you set it up with a company you trust and monitor your account regularly
Using autopay from your checking account carries real but manageable risks. The main dangers are not the payment method itself—banks protect checking accounts under federal law—but rather what happens when a payment goes wrong, when a company charges you by mistake, or when someone gains access to your account details. The safest approach is to use autopay only with companies you know, set up alerts on your account, and review your transactions weekly.
Autopay works by giving a company permission to pull money from your checking account on a schedule you set. The company stores your account number and routing number, then initiates transfers on the dates you agree to. This is different from a credit card payment, where the card company acts as a buffer between you and the merchant. With checking account autopay, the merchant has direct access to your bank account.
Key Takeaways
- Banks must refund unauthorized charges to your checking account within one to three business days if you report them, but you have to catch and report them first.
- Legitimate companies rarely make mistakes with autopay, but scams and data breaches can expose your account number to criminals who will drain your account.
- Setting up account alerts and reviewing transactions weekly catches problems before they become large or repeated.
- Autopay is safest with companies that have a clear cancellation process and that you can reach by phone if something goes wrong.
- Using a separate checking account for autopay payments, or limiting autopay to a few trusted companies, reduces your exposure if one account is compromised.
What federal law covers if something goes wrong
The Electronic Funds Transfer Act (EFTA) requires banks to refund unauthorized transfers from your checking account. If a company charges you without permission, or charges you twice by mistake, you can report it to your bank and receive a refund. The bank must investigate and return your money within one to three business days if the charge was clearly not authorized by you.
The catch is that you have to notice the charge and report it. If you never look at your account, a company could drain it slowly over months before you realize what happened. Banks are not required to catch the fraud for you—they are required to refund it once you report it. This is why monitoring your account is not optional; it is your first line of defense.
If you authorized a payment but the company charged you the wrong amount, or charged you after you cancelled, the process is slower. You still have the right to dispute it, but the bank may take longer to investigate because the charge was technically authorized. This is where a clear cancellation process with the company matters: if you can show you cancelled in writing, the bank will side with you.
Real risks: data breaches and account takeover
The largest risk with checking account autopay is that your account number can be stolen. When you give a company your checking account details, that information is stored in their system. If that company is hacked, or if an employee sells the data, criminals now have your account number and routing number. They can use this to drain your account or sell it to other criminals.
Unlike a credit card, where the card company can cancel the card and issue a new one, your checking account number is tied to your actual bank account. If criminals access it, they can pull money directly. You will get the money back if you report it, but you may be without those funds for days while the bank investigates, and you may face overdraft fees if the unauthorized charge pushes your balance negative.
Companies that handle autopay payments are required to follow security standards, but standards are not the same as perfect security. Smaller companies, or companies that have not invested in security, are higher risk. A utility company or major insurance company has strong incentive and resources to protect your data. A small subscription service or local contractor may not.
How to reduce risk when setting up autopay
Start by using autopay only with companies you have an existing relationship with and that you can reach by phone. If something goes wrong, you need to be able to call someone and speak to a human. Companies that operate only online, or that have no clear customer service number, are riskier because you have no way to resolve a dispute quickly.
Before you set up autopay, look for the company's cancellation policy. Can you cancel online, or do you have to call? How long does it take to stop a payment after you request it? Some companies will process one more payment even after you cancel, so know what to expect. If the cancellation process is unclear or requires you to jump through hoops, that is a sign the company makes money by making it hard to leave.
Set up account alerts with your bank for any transaction over a certain amount, or for all transactions from that company. Most banks allow you to set alerts by merchant name or by amount. You will get a text or email within minutes of the charge, which means you can catch a mistake or fraud almost immediately instead of days later when you review your statement.
Checking account autopay versus credit card autopay
Credit card autopay is generally safer than checking account autopay because the credit card company acts as a middleman. If a merchant charges you incorrectly, you dispute it with the credit card company, not your bank. The credit card company has strong incentive to protect you because they want to keep your business. You also do not have to worry about your actual bank account being drained, because the merchant never touches it.
The downside of credit card autopay is that some companies charge a fee if you pay by credit card, or they offer a discount if you pay by checking account. Utilities, insurance companies, and loan servicers often push checking account autopay because it is cheaper for them. In these cases, you have to weigh the savings against the risk.
If a company offers a discount for checking account autopay, ask yourself whether the discount is worth the extra risk. A $5 monthly discount on an insurance payment might not be worth the exposure if the company is hacked. But if you trust the company completely and you monitor your account closely, the discount may be reasonable.
What to do if you spot an unauthorized charge
Call your bank immediately if you see a charge you did not authorize. Do not wait for your statement to arrive or for the next business day. Many banks have a 24-hour fraud line, and the faster you report it, the faster they can freeze the account and begin the refund process. Have your account number and the transaction details ready when you call.
Your bank will ask you to confirm that you did not authorize the charge. They may ask you to sign a form stating this, either in person or by mail. Once you do, they will refund the money and begin investigating the merchant. You should see the refund in your account within one to three business days, though it may take longer if the bank needs to contact the merchant.
After the refund is processed, contact the company that charged you and ask them to cancel any future payments. Even if the charge was unauthorized, the company may still have your account on file and may attempt to charge you again. Get confirmation in writing that the account has been cancelled and that no further charges will be made.
Using a separate account for autopay only
One strategy to reduce risk is to keep a separate checking account that you use only for autopay payments. You transfer the exact amount needed to cover that month's autopay charges, and you leave the rest of your money in your main account. If the autopay account is compromised, the damage is limited to whatever balance you keep in it.
This approach takes more work because you have to manage two accounts and make sure the autopay account has enough money each month. But it gives you a clear boundary: if the autopay account is hacked, your main account and your savings are untouched. Some people use this method for subscriptions and recurring bills, while keeping their main account for everything else.
If you go this route, make sure the autopay account is at the same bank as your main account, or at a bank with strong online tools. You want to be able to transfer money quickly and easily when you need to top up the autopay account. Also set up alerts on the autopay account so you catch any unauthorized charges immediately.
Frequently Asked Questions
Can a company keep charging my account after I cancel autopay?
Yes, if the company does not process your cancellation request properly. This is why you should request cancellation in writing—by email or through the company's online portal—and keep a copy. If the company charges you after you cancelled, report it to your bank as unauthorized and show them your cancellation request. The bank will refund you and investigate the merchant.
What if I set up autopay and then my card details change?
If your bank reissues your debit card because it expired or was compromised, your autopay payments may fail. Contact each company where you have autopay set up and update your account information. Some companies will send you a notice that the payment failed, but not all do. This is another reason to monitor your account and check that expected payments actually went through.
Is it safer to use autopay with a big company or a small one?
Generally, larger companies have better security and more resources to protect your data. But size alone does not may provide safety. A large company that has been hacked is still a breach. The real question is whether the company takes security seriously and whether you can reach them if something goes wrong. A small local business you know and trust may be safer than a large company with a reputation for poor customer service.
Can I get my money back if a company charges me the wrong amount?
Yes, but it may take longer than if the charge was completely unauthorized. You can dispute the charge with your bank and explain that the amount was wrong. The bank will investigate and ask the company for proof that you authorized that specific amount. If you have evidence—like a contract or email—that shows the correct amount, include it with your dispute.
Should I give my checking account number to every company that asks?
No. Only give your checking account number to companies you trust and that you plan to do business with repeatedly. Do not give it out just because a company offers a small discount or incentive. The more companies that have your account number, the more places where a breach could expose it. Treat your checking account number like you treat your Social Security number—share it only when necessary.