Yes, someone can steal from your bank account, but the path depends on how they get access
Bank theft happens in two main ways: someone gains access to your account credentials (username, password, card number), or they commit fraud using your personal information without ever logging in. The first is faster and more direct. The second is slower but harder to trace. In both cases, your bank has legal obligations to investigate and often to refund you—but only if you report it quickly and follow their process.
The speed of your report matters enormously. If you catch unauthorized activity within 60 days of the statement date, federal law (Regulation E) caps your liability at $50 for debit card fraud and often zero if you report before the transaction posts. Wait longer, and your liability can climb to $500 or more. For credit cards, the cap is $50 regardless of timing, but debit accounts are the real risk.
Key Takeaways
- Report unauthorized transactions to your bank within 60 days of the statement date to limit your liability to $50 or less under federal law.
- Debit card fraud exposes you to higher liability than credit card fraud, so monitor debit accounts more closely and consider using credit for online purchases.
- Your bank must investigate within 10 business days and either refund you or explain why they believe the transaction was authorized.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) stops new accounts from being opened in your name.
- If your bank refuses to refund you, file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator.
How thieves access your account directly
The most common entry points are phishing emails that look like they come from your bank, fake login pages that capture your password, malware on your computer or phone that records keystrokes, and data breaches at retailers or other companies where your card number is stored. Once someone has your username and password, they can transfer money out, change your contact information to lock you out, or add themselves as an authorized user.
Phishing is still the leading cause because it works: a message arrives that looks official, you click a link, enter your credentials on a fake site, and the thief has everything. Your bank did not send the email. Banks do not ask for passwords by email or text. If you are unsure, hang up and call the number on the back of your card or your statement—not a number in the message.
Malware and keyloggers are harder to detect because you may not know your device is compromised. Signs include unexpected charges, changed passwords you did not change, or login attempts from unfamiliar locations. If you suspect malware, change your password from a different device, run antivirus software, and contact your bank immediately.
How thieves use your identity without logging in
Identity theft is slower but does not require your password. A thief uses your Social Security number, name, and address to open new accounts, take out loans, or make large purchases in your name. They may also use your information to file a fraudulent tax return and claim your refund. This type of fraud often goes unnoticed for months because the thief is not touching your existing accounts.
The damage spreads across multiple institutions: new credit cards, auto loans, medical debt, and utility accounts all appear on your credit report. You discover it when you apply for a mortgage and learn you have $40,000 in debt you never incurred, or when a collection agency calls about an account you never opened.
This is why monitoring your credit report matters. You can request a free report from each of the three major bureaus (Equifax, Experian, TransUnion) once per year at annualcreditreport.com. Look for accounts you do not recognize, inquiries from lenders you did not contact, and address changes. If you spot fraud, place a fraud alert with all three bureaus and consider a credit freeze.
What to do the moment you spot unauthorized activity
Call your bank immediately—do not email or use the app. Use the number on the back of your card or your statement, not a number from any message. Tell them which transactions are not yours. They will freeze your account, cancel your card, and start an investigation. Ask them to confirm your current contact information (phone, email, mailing address) so the thief cannot intercept communications.
Request a new debit card and ask whether your bank offers a temporary card number or virtual card for online purchases. Some banks issue a temporary number within hours; others mail a replacement that takes 7 to 10 days. Do not use the compromised card until the investigation is complete.
Write down the date and time of your call, the name of the person you spoke with, and a reference number for the investigation. Your bank must provide this. Follow up in writing (email or certified mail) within 24 hours, restating which transactions you dispute and the date you reported them. This creates a paper trail if you need to escalate.
The bank's investigation and your refund timeline
Federal law requires your bank to investigate within 10 business days and either refund you or tell you why they believe the transaction was authorized. In practice, many banks refund disputed debit transactions within 1 to 3 business days while they investigate, then reverse the refund if they determine the transaction was legitimate. This is called a provisional credit.
The full investigation can take up to 45 days. During this time, the bank will contact the merchant, review logs of where the transaction originated (the IP address, device, location), and check whether your account showed signs of compromise. If the thief used your card at a gas pump or ATM, the bank will request video footage.
If the bank finds the transaction was fraudulent, you keep the refund. If they find evidence it was authorized—for example, the PIN was correct, the location matches your usual activity, or you had recently used that card at that merchant—they may deny your dispute. You can appeal, but the burden is on you to prove you did not authorize it.
Protecting yourself from future theft
Use a credit card for online and in-person purchases instead of a debit card when possible. Credit card fraud is capped at $50 by law and often zero in practice. Debit card fraud can cost you up to $500 if you report it late. Credit cards also offer better fraud detection and do not drain your checking account while the dispute is investigated.
Enable two-factor authentication on your bank account and email. This means logging in requires a code sent to your phone or generated by an authenticator app, not just a password. If a thief has your password, they still cannot access your account without that second code.
Monitor your accounts weekly, not monthly. Set up transaction alerts through your bank's app so you receive a notification for every purchase over a certain amount (or every purchase, if you prefer). Catch fraud in hours instead of weeks.
Use a password manager to create unique, complex passwords for each account. Reused passwords are a major vulnerability: if one company is breached, the thief tries that password on your bank, email, and other sites. A password manager like Bitwarden, 1Password, or Dashlane stores encrypted passwords so you only have to remember one master password.
Freeze your credit if you have been a victim of identity theft or if you want to prevent new accounts from being opened in your name. A freeze is free and does not affect your existing credit. It stops lenders from pulling your credit report, which blocks new account applications. You can thaw the freeze temporarily when you actually want to apply for credit.
What to do if your bank refuses to refund you
If your bank denies your dispute and you believe the transaction was fraudulent, you have the right to escalate. Ask to speak with the dispute department supervisor and provide any additional evidence: screenshots of phishing emails, proof you were out of town when the charge occurred, or documentation that you reported the fraud to police.
If the bank still refuses, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can order banks to refund you if they find the bank violated the law. You can also file a complaint with your state's banking regulator—search "[your state] banking regulator" or "[your state] attorney general consumer protection".
Keep all documentation: the original dispute form, the bank's response, emails, call logs, and any police report. If the fraud was part of a larger identity theft scheme, file a report with the Federal Trade Commission at identitytheft.gov. The FTC does not investigate individual cases, but the report creates an official record and provides you with a recovery plan.
Frequently Asked Questions
How long does it take to get my money back?
Your bank must refund provisional credit within 10 business days if they find fraud, though many refund within 1 to 3 days while investigating. The full investigation takes up to 45 days. If the bank denies your dispute, you can appeal or file a complaint with the CFPB, which can take several weeks.
Can I be held liable for fraudulent charges if I report them late?
Yes. If you report debit card fraud more than 60 days after the statement date, your liability can reach $500. Credit card fraud is capped at $50 regardless of timing. Report any suspicious activity as soon as you notice it.
What if the thief used my card at a store or ATM?
The bank will request video footage from the merchant or ATM operator. This helps prove whether the transaction was authorized. If the video shows someone other than you, the bank has strong evidence of fraud and will refund you.
Do I need to file a police report?
Not required by law, but filing a police report creates an official record and can help if you are a victim of identity theft. Some banks ask for a police report number when you dispute charges. You can file online in many jurisdictions or visit your local police station.
What if my bank account was hacked but no money was stolen?
Change your password immediately from a different device, enable two-factor authentication, and monitor your account closely for the next 30 days. The thief may have access but not have acted yet. Contact your bank to confirm your contact information has not been changed and ask them to flag your account for suspicious activity.