Yes, hackers can withdraw money from your bank account—but the path depends on how they get in

Hackers can drain a bank account if they gain access to your login credentials, your debit card number, or your account through a compromised device. The most common routes are phishing emails that trick you into revealing your password, malware that logs your keystrokes, SIM swaps that redirect your phone number to a device the hacker controls, or data breaches at retailers or services where you've stored payment information. Once inside, a hacker can transfer money out via ACH, wire transfer, or simply use your debit card to make purchases or withdraw cash.

The good news: your bank has legal obligations to reverse most fraudulent transfers, and you have protections that vary depending on how the theft happened and how quickly you report it. The bad news: the speed of reversal and whether you lose money depends on the method used and how fast you catch it.

Key Takeaways

  • Hackers most often gain access through phishing emails, malware on your computer or phone, SIM swaps that hijack your phone number, or stolen card data from a breach at a store or website.
  • Unauthorized debit card charges are usually reversed within one to three business days if you report them before the transaction settles, and you are not liable for fraudulent charges if you report within 60 days.
  • ACH transfers and wire transfers initiated by someone with your login credentials are harder to reverse and may take weeks or require police involvement, especially if the money has already left your bank.
  • Enabling two-factor authentication on your bank account, using a strong unique password, and monitoring your account weekly are the most effective ways to prevent unauthorized access.
  • If you discover fraud, call your bank's fraud line immediately—not the number on your card or a website, but the number on your most recent statement or the back of your physical card.

How hackers actually get into your account

Phishing is the most common entry point. A hacker sends an email that looks like it came from your bank, PayPal, Amazon, or another service you use. The email says your account has been locked, a suspicious login was detected, or you need to confirm your identity. You click a link, land on a fake website that looks identical to the real one, and type in your username and password. The hacker now has your credentials and can log in whenever they want.

Malware on your computer or phone records everything you type—passwords, card numbers, answers to security questions. You might have picked it up by downloading a file from an untrusted source, clicking a link in a text message, or visiting a compromised website. The malware runs silently in the background and sends your keystrokes to the hacker.

SIM swaps work differently. The hacker calls your phone carrier, convinces them they are you, and asks them to transfer your phone number to a new SIM card the hacker controls. Now text messages and calls meant for you go to the hacker instead. They use your phone number to reset your bank password, intercept the confirmation code, and lock you out of your own account.

Data breaches at retailers, payment processors, or online services expose your card number, expiration date, and sometimes your CVV. Hackers buy this data on the dark web and use it to make purchases or withdraw cash. This is why your card number alone can be enough—the hacker does not need your password.

What happens when a hacker uses your debit card

If someone uses your debit card number to make a purchase or withdraw cash, federal law limits your liability. If you report the fraud within two business days of discovering it, you are not liable for any amount. If you report it between two and 60 days, you are liable for up to $50. If you wait longer than 60 days, you could lose the entire amount.

Most banks reverse fraudulent debit card charges within one to three business days once you report them. The transaction may still show in your account as pending or posted, but the bank will credit your account while they investigate. You should see the money back before the transaction fully settles—usually within a week.

The catch: if the hacker withdrew cash from an ATM or made a purchase at a store before you noticed, the money is already gone from the system. The bank will still reverse the charge to your account, but they may pursue the hacker or the merchant to recover the cash. You will not be out of pocket, but the reversal takes longer if the transaction has already cleared.

What happens when a hacker transfers money via ACH or wire

ACH transfers and wire transfers are much harder to reverse than debit card charges. If a hacker logs into your account and initiates an ACH transfer to their own bank account, the money leaves your bank within one to two business days. If they send a wire transfer, it can be gone within hours.

Once the money reaches the receiving bank, reversing it requires the receiving bank to cooperate. If the hacker opened a fake account under a stolen identity or a shell company, the receiving bank may freeze the account and hold the funds while they investigate. But if the money was transferred to a real account at another bank, the receiving bank has no obligation to reverse it without a court order or police involvement.

You should report the fraud to your bank immediately, but also file a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and your local police. The police report gives your bank and the receiving bank legal grounds to investigate and potentially recover the funds. Without it, the receiving bank may refuse to act. Recovery can take weeks or months, and there is no may provide the money will be returned if the hacker has already withdrawn it.

Two-factor authentication and why it matters

Two-factor authentication (2FA) requires you to provide a second form of proof after you enter your password—usually a code sent to your phone via text, an app like Google Authenticator, or a security key. Even if a hacker has your password, they cannot log in without that second factor.

Most banks offer 2FA, and many now require it. If your bank offers it, turn it on immediately. Text-based codes (SMS) are better than nothing, but they are vulnerable to SIM swaps. If your bank offers an authenticator app or a security key, use that instead—they cannot be intercepted by a hacker who has stolen your phone number.

One important note: if you enable 2FA and then lose access to your phone or the app, you will need to contact your bank to regain access to your account. Some banks make this process easy; others require you to visit a branch in person. Check your bank's policy before you set it up so you know what to do if you get locked out.

What to do if you discover unauthorized activity

Call your bank's fraud line immediately. Do not use the number on your card or a number you find online—use the number on your most recent statement or call directory assistance to confirm the bank's main number, then ask to be transferred to fraud. This ensures you are talking to your actual bank, not a scammer pretending to be your bank.

Tell the bank what you saw: the date, the amount, the merchant or receiving account, and when you first noticed it. The bank will freeze your account, cancel your debit card, and begin an investigation. They will ask you to confirm that you did not make the transaction. Do not admit to anything you are unsure about—if you are not certain whether you made a purchase, tell the bank you do not recognize it.

After you hang up, change your password from a different device (not the one you use for banking, in case it has malware). Use a password that is at least 12 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is unique to your bank account. Do not reuse a password you have used anywhere else.

Then file a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and may help you if the fraud affects your credit. If money was transferred via ACH or wire, also file a report with the FBI at ic3.gov and your local police department.

How to prevent unauthorized access in the first place

Use a strong, unique password for your bank account. A password manager like Bitwarden, 1Password, or Dashlane can generate and store passwords so you do not have to remember them. Never reuse a password across multiple accounts—if one service is breached, hackers will try that password on your bank, email, and other accounts.

Enable two-factor authentication on your bank account and your email account. Your email is the master key to everything else—if a hacker gains access to your email, they can reset your bank password and intercept the confirmation code. Protect your email with 2FA first.

Monitor your account weekly. Log in and scan your recent transactions for anything you do not recognize. Many banks also offer alerts—you can set them to notify you of any transaction over a certain amount, any login from a new device, or any password change. Turn these on.

Be skeptical of emails, texts, and calls claiming to be from your bank. Your bank will never ask you to confirm your password or full account number via email or text. If you receive a suspicious message, hang up or ignore it, then call your bank directly using the number on your statement.

Keep your computer and phone updated. Install security updates as soon as they become available—they often patch vulnerabilities that hackers exploit. Use antivirus software on your computer and keep it current.

Frequently Asked Questions

Can my bank force me to pay back money a hacker transferred out?

No. If a hacker accessed your account without your permission and transferred money, your bank is liable for the loss under federal law. You are not responsible for unauthorized transfers initiated by someone else, even if they had your password. Report it immediately and your bank must investigate and reverse it.

What if the hacker changed my password and locked me out of my own account?

Call your bank immediately. You will need to verify your identity by answering security questions, providing your Social Security number, or visiting a branch in person. Once you prove who you are, the bank will reset your password and lock out the hacker. Then change your password again to something only you know.

Can a hacker drain my account if I only give them my card number?

They can make purchases and withdraw cash using your card number, but they cannot log into your online account or transfer money via ACH or wire without your password. Card-only fraud is usually reversed quickly. Account takeover—where they have your password—is much more serious.

How long does it take to get my money back after I report fraud?

Debit card fraud usually reverses within one to three business days. ACH transfers may take one to two weeks. Wire transfers can take weeks or months if the money has already left the receiving bank. The faster you report it, the faster your bank can act.

Should I close my account after it has been hacked?

Not necessarily. Close it only if your bank cannot secure it or if you have lost trust in their security. If the bank has reversed the fraud and you have changed your password and enabled 2FA, your account is now more secure than it was before. Closing it means opening a new account, which takes time and may affect your banking history.