Who can legally access your bank account

Your bank can see everything in your account—that's their job. Law enforcement can see it too, but only with a court order, subpoena, or warrant. Your employer cannot see it unless you give them permission (for direct deposit setup, they only see routing and account number, not the balance). Your spouse or ex-spouse can see it during divorce proceedings if a judge orders it. A creditor suing you can obtain account information through the discovery process, but they cannot simply look at it on their own.

The IRS can access your bank records without a warrant under a provision of the Bank Secrecy Act, though they typically need to show reasonable cause. If you owe child support, the state child support agency can see your account to enforce collection. Your accountant or tax preparer can see whatever you show them—they have no automatic access. A debt collector cannot see your account balance or transaction history; they can only sue you and try to garnish wages or freeze accounts after winning a judgment.

Key Takeaways

  • Your bank and law enforcement with a court order are the only parties with legal access to your full account details without your permission.
  • Phishing emails, fake bank websites, and social engineering are the most common ways unauthorized people gain access to your login credentials.
  • If someone accesses your account without permission, contact your bank immediately and file a report with the Federal Trade Commission and your local police.
  • Enabling two-factor authentication, using a unique strong password, and monitoring your account regularly are the most effective ways to prevent unauthorized access.

How unauthorized people gain access

Phishing is the most common entry point. You receive an email that looks like it came from your bank, asking you to "verify" your account or "confirm" recent activity. The link goes to a fake website that looks identical to your real bank's site. You enter your username and password, and the attacker now has them. Banks never ask for passwords via email—ever.

Social engineering works differently. Someone calls you pretending to be from your bank's fraud department and says suspicious activity was detected on your account. They ask you to confirm your password or security questions to "verify your identity." Real banks already have your identity; they will not ask you to prove it by giving them your password. If you are unsure, hang up and call the number on the back of your card.

Malware on your computer or phone can log your keystrokes or take screenshots when you log in. Public Wi-Fi without a password is a risk—anyone on the same network can intercept unencrypted traffic. If you must use public Wi-Fi for banking, use a VPN (virtual private network) first. Weak or reused passwords are easy targets; if one website is breached, attackers try that same password on your bank account.

Signs someone has accessed your account

Check your account regularly—at least weekly. Look for transactions you did not make, transfers to accounts you do not recognize, or changes to your contact information (phone number, email, mailing address). If your bank sends you a statement for activity you did not authorize, that is a clear sign. Some banks offer transaction alerts via text or email; enable these so you know immediately when money moves.

If you cannot log in to your account, or your password no longer works, someone may have changed it. If you receive a password reset email you did not request, your account is under attack. If your bank calls you about suspicious activity but you did not initiate the call, verify by hanging up and calling the number on your card. Do not use any phone number the caller provides.

What to do if your account is compromised

Contact your bank immediately—most have a fraud line that operates 24/7. Tell them which transactions are unauthorized. Your bank will freeze the account, cancel your debit card, and issue a new one. They will investigate the fraudulent transactions. Under federal law, your liability for unauthorized transactions is limited: if you report it within two business days of discovering the fraud, you are liable for no more than $50 of unauthorized charges. If you wait longer, your liability can go up to $500. If you do not report it within 60 days of your statement, you may lose all protection.

File a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record and may help you dispute charges later. File a police report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Keep copies of all documentation: the police report number, the FTC report number, your bank's fraud investigation reference number, and copies of statements showing the fraudulent activity.

Dispute the unauthorized charges with your bank in writing. Send a letter to the address on your statement (not email) within 60 days of receiving the statement with the fraudulent transaction. Include your account number, the date and amount of each disputed transaction, and a brief explanation that you did not authorize it. Keep a copy for your records. Your bank must respond within 10 business days, though the investigation may take up to 45 days.

How to prevent unauthorized access

Use a unique, strong password for your bank account—one you do not use anywhere else. A strong password has at least 12 characters and mixes uppercase letters, lowercase letters, numbers, and symbols. Do not use your birthday, pet's name, or any word found in a dictionary. Consider using a password manager like Bitwarden, 1Password, or KeePass to generate and store complex passwords securely.

Enable two-factor authentication (2FA) on your bank account. This means that even if someone has your password, they cannot log in without a second piece of information—usually a code sent to your phone via text or generated by an authenticator app. Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy) are more secure than text messages because they cannot be intercepted the way SMS can. Your bank may offer both options; choose the app if available.

Monitor your account regularly. Log in at least once a week and review recent transactions. Set up account alerts through your bank's app or website so you receive notifications when money is transferred, a large purchase is made, or your contact information changes. Do not use public Wi-Fi for banking; if you must, use a VPN first. Keep your computer and phone updated with the latest security patches. Do not click links in emails claiming to be from your bank—go directly to the bank's website by typing the address yourself or calling the number on your card.

What your bank is required to tell you

Your bank must send you a statement at least monthly showing all transactions. You have the right to request a copy of any check you wrote, any electronic transfer you authorized, or any debit card transaction. Your bank must provide this within a reasonable time, usually 30 days. You can also request your bank's records of who accessed your account and when—this is called an access log.

If your bank discovers unauthorized activity, they must notify you. The timing depends on the type of fraud, but generally they must tell you as soon as possible. If your account is compromised due to the bank's negligence (for example, if their security system was breached), the bank bears the cost of the fraud, not you. If you were negligent (for example, you wrote your PIN on your debit card), your liability may be higher.

Frequently Asked Questions

Can my employer see my bank balance?

No. When you set up direct deposit, you provide your employer with your routing number and account number only—not your balance or transaction history. Your employer cannot see how much money is in your account or what you spend it on.

Can someone access my account with just my account number?

Not typically. Your account number alone is not enough to log in or transfer money. An attacker would also need your username, password, and ideally your two-factor authentication code. However, if someone has your account number and routing number, they may be able to set up unauthorized ACH transfers or bill payments, so monitor your account closely.

What if I gave my password to someone by accident?

Change it immediately. Log in to your bank account right now and update your password to something new and unique. If you cannot log in, call your bank's customer service line. Enable two-factor authentication if you have not already. Monitor your account closely for the next 30 days for any unauthorized activity.

Does my bank sell my information to other companies?

Banks do not sell your account balance or transaction details to third parties. They may share limited information with affiliates or service providers under their privacy policy, and they must comply with the Gramm-Leach-Bliley Act, which restricts how they use and share your financial information. Read your bank's privacy policy to understand what information they share and with whom.

Can I be held liable for fraud if I did not report it quickly?

Yes, your liability increases if you delay reporting. If you report unauthorized transactions within two business days, your liability is capped at $50. If you wait longer than two business days but report within 60 days of your statement, your liability can be up to $500. If you do not report within 60 days, you may lose all protection and be liable for the full amount.