Yes, someone can steal money from your bank account — but your bank is required to cover most of it

Money can leave your account without your permission through several routes: someone uses your debit card number, logs into your online banking, sets up an unauthorized transfer, or tricks you into sending it yourself. The good news is that federal law limits your liability, and your bank must investigate and often refund the money. The catch is that your liability depends on how fast you report it, and some theft methods are harder to recover from than others.

Your protection starts the moment you notice something wrong. The faster you report it, the smaller the hole in your account — and the stronger your claim to a full refund.

Key Takeaways

  • Federal law caps your liability at $50 if you report unauthorized debit card charges within two business days, and $500 if you report within 60 days; after 60 days you may lose everything.
  • Unauthorized transfers from your account (ACH, wire, or bill pay) have a 60-day reporting window, but your bank can refuse to refund you if you were negligent — for example, if you wrote your PIN on your debit card.
  • If someone tricks you into sending money yourself (phishing, social engineering, fake invoices), the money is usually gone; banks treat it as authorized because you initiated it.
  • Call your bank immediately when you spot unauthorized activity; do not wait for a statement to arrive, and follow up in writing within the reporting window.
  • Freezing your credit with the three bureaus (Equifax, Experian, TransUnion) stops thieves from opening new accounts in your name, even if they have your Social Security number.

How thieves access your account without your password

The most common entry points are your debit card number, your online banking credentials, and your bank account number itself. A thief can get your debit card number from a data breach at a store or website, from skimming a card reader at a gas pump or ATM, or from a photo of your card. They then make purchases or withdraw cash before you notice the card is compromised.

Online banking theft usually starts with phishing — a fake email or text that looks like it came from your bank and asks you to "verify" your username and password. Once they have those, they can log in, see your balance, and move money out. Some thieves buy stolen login credentials on the dark web for a few dollars.

A third route is ACH fraud, where someone sets up an automatic transfer from your account to theirs using only your account number and routing number — both of which are printed on every check you write. They may pose as a utility company, landlord, or employer to convince you to give them these numbers, or they may simply guess them. Wire fraud and bill pay fraud work the same way: the thief initiates the transfer, not you.

What federal law says you owe if your debit card is stolen

The Electronic Funds Transfer Act (EFTA) sets your liability based on how quickly you report the theft. If you notice unauthorized charges and report them to your bank within two business days, your liability is capped at $50. If you report within 60 days, your liability rises to $500. If you do not report within 60 days of receiving your statement, you may be liable for the entire amount stolen.

This applies only to debit card fraud — charges made with your card number without your permission. It does not cover transfers you authorized but later regret, and it does not cover situations where you gave your PIN to someone else.

The 60-day clock starts when your bank sends you a statement showing the unauthorized charge, not when the charge occurred. If your bank mails statements, you may not see the theft for weeks. Check your account online at least weekly to catch fraud early.

Unauthorized transfers and ACH fraud have different rules

If someone sets up a transfer from your account without your permission — through ACH, wire, or bill pay — you have 60 days from the date your bank sends you a statement to report it. Your bank must then investigate and refund you, with one major exception: if your bank can prove you were negligent, they can refuse to pay.

Negligence means you did something that made the theft easier or more likely. Examples include writing your PIN on your debit card, sharing your password with someone, leaving your checkbook in an unlocked car, or ignoring repeated fraudulent charges before reporting them. If your bank claims negligence, you can dispute that claim, but you will need to prove you took reasonable steps to protect your account.

ACH fraud is slower than debit card fraud — transfers usually take one to three business days to clear — which gives you a window to catch and stop them. If you spot an unauthorized ACH transfer before it settles, call your bank immediately and ask them to recall it. Once it settles, recovery depends on whether the receiving bank cooperates, which is not may provide.

When the money is gone and the bank will not refund it

If someone tricks you into sending money yourself — by posing as your bank, your employer, a government agency, or a trusted vendor — the money is almost never recoverable. This includes wire transfers, ACH transfers you authorized based on a fake email, and cash you withdrew and handed to someone. Because you initiated the transfer, your bank sees it as authorized, and federal law does not protect you.

The same applies to money you send to pay a fake invoice, to cover a fake tax bill, or to "verify" your account. Once the money leaves your account and lands in a criminal's bank account, it is extremely difficult to trace or recover. Some banks will try to recall the transfer if you report it within hours, but success rates are low.

If you have been the victim of this kind of fraud, report it to your bank, your local police, and the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. These reports do not recover your money, but they create a record that may help law enforcement identify patterns and catch the thief.

Steps to take the moment you spot unauthorized activity

Call your bank's fraud line immediately — do not use the number on the back of your card if you think your card itself was compromised, because a thief may have redirected calls. Look up the number on your bank's official website or your statement instead. Tell them which charges or transfers are not yours, and ask them to freeze your account and issue a new card or account number.

Your bank will open a dispute and begin an investigation, which typically takes 10 business days. During this time, they may provisionally credit your account while they gather evidence from the merchant or receiving bank. Do not assume the provisional credit is permanent — if the investigation finds the charge was authorized, they can take the money back.

Follow up in writing within 60 days of receiving your statement. Send a letter to your bank's dispute department (the address is usually on your statement) listing each unauthorized transaction, the date you reported it by phone, and your account number. Keep a copy for your records. Written notice creates a paper trail and resets the clock if your bank misses a deadline.

If your bank refuses to refund you, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can order banks to refund money if they violated the law.

Protecting your account from future theft

Use a strong, unique password for online banking — at least 12 characters, mixing letters, numbers, and symbols. Do not reuse passwords across websites. If a retailer's database is breached, a thief who gets your password there can try it on your bank account.

Enable two-factor authentication (2FA) on your bank account if available. This requires a second form of verification — usually a code sent to your phone or generated by an authenticator app — before anyone can log in or change account settings. Even if a thief has your password, they cannot access your account without this second factor.

Never give your account number, routing number, or PIN to anyone who contacts you first — not by phone, email, or text. Your bank will never ask for this information unsolicited. If you need to pay a bill or send money, initiate the contact yourself using a phone number or website you know is legitimate.

Check your account online at least weekly, not just when statements arrive. The sooner you catch fraud, the smaller your liability and the faster your bank can stop it.

If your identity has been stolen or you suspect ongoing fraud, freeze your credit with all three bureaus: Equifax (equifax.com/personal/credit-report-services), Experian (experian.com), and TransUnion (transunion.com). A credit freeze prevents anyone from opening new accounts in your name, even if they have your Social Security number. The freeze is free and takes about 15 minutes per bureau.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Your bank must begin investigating within 10 business days and complete it within 45 days. Many banks issue a provisional credit within a few days while they investigate, but this is not may provide. If the investigation finds the charge was authorized, your bank can reverse the credit. Full refunds usually arrive within 5 to 10 business days after the investigation closes.

What if my bank says I was negligent and refuses to refund me?

You can dispute the negligence claim in writing to your bank's dispute department. If they still refuse, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will investigate whether your bank followed the law. You can also consult a lawyer, though the amounts involved may not justify the cost.

Can my bank hold me liable for fraud that happened before I opened the account?

No. Your liability begins only after you receive an account statement showing the unauthorized activity. If fraud occurred before you opened the account, it is the previous account holder's responsibility, not yours.

If I report fraud by phone, do I need to follow up in writing?

Yes. Phone reports start the investigation, but written notice within 60 days creates a legal record and protects you if your bank claims they never received your call. Send a letter to the dispute department address on your statement, and keep a copy.

What should I do if the same fraudster strikes twice?

Report the second fraud immediately and ask your bank to close the compromised account and open a new one with a different account number. If the thief has your debit card number, ask for a new card with a different number. If they have your online banking password, change it to something completely different and enable two-factor authentication if you have not already.