Yes, someone can steal from your savings account — here's how it happens
Theft from a savings account happens through a handful of specific methods, and the person stealing does not need your card or your PIN. They can drain your account using your account number alone, or by posing as you to the bank, or by gaining access to your online login. The bank is responsible for most of the money if you report it quickly, but the first hours matter — the longer you wait, the harder it is to recover.
The most common routes are ACH fraud (someone sets up an automatic transfer out of your account using your routing and account number), account takeover (someone logs into your online banking), check fraud (someone writes checks against your account), and social engineering (someone calls the bank pretending to be you and requests a wire or change of address). A fifth method — someone with physical access to your debit card — is the least common but the fastest to spot.
Key Takeaways
- ACH fraud and account takeover are the two most common ways money leaves a savings account without your permission, and both can drain thousands before you notice.
- Federal law (Regulation E) requires your bank to refund unauthorized transfers if you report them within 60 days, but reporting within two business days protects you much more completely.
- Your account number and routing number are enough for someone to set up a transfer out of your account — you do not need to share your PIN or password for this to happen.
- Checking your account at least weekly and setting up low-balance alerts can catch theft within days rather than weeks, which makes recovery faster and more complete.
ACH fraud: the most common method
An ACH transfer is an electronic movement of money between bank accounts. Someone with your account number and routing number can initiate an ACH debit — a pull of money out of your account — without your permission. They do not need your password, your PIN, or your card. They need only those two numbers, which appear on the bottom left of every check you write.
The thief typically uses a fake business name or poses as a utility company, a government agency, or a creditor. They set up the transfer through their own bank or through a third-party payment processor. Your bank processes it because the routing and account numbers are correct. The money leaves your account within one to three business days. By the time you notice, the thief has already withdrawn the money from their own account or moved it elsewhere.
ACH fraud is harder to catch than debit card fraud because there is no card involved and no merchant name you recognize. The transaction shows up as a debit to an unfamiliar account number, often with a vague description like "DEBIT" or a company name you do not know. Many people do not notice for weeks.
Account takeover: logging in as you
Account takeover happens when someone gains your online banking password, usually through a phishing email, a data breach, or malware on your computer. Once they are logged in, they can transfer money out, change your contact information, or request a new debit card sent to an address they control.
The thief often starts by changing your email address or phone number on file, which locks you out of password recovery. Then they move money to another bank account they own, or they order a new debit card and use it before you know it is gone. Some thieves also change your security questions or add themselves as an authorized user on the account.
Account takeover is often paired with identity theft — the thief may have your Social Security number and other personal details from a breach or a phishing attack. This makes it easier for them to convince the bank they are you if they need to call customer service.
Check fraud and social engineering
Check fraud happens when someone writes checks against your account without your permission. They may have stolen a blank check from your mail, or they may have obtained your account number and routing number and printed counterfeit checks. The checks clear through the banking system just like legitimate ones, and the money leaves your account.
Social engineering is when someone calls your bank, pretends to be you, and requests a wire transfer, a change of address, or a new card. They use personal information they have gathered — your name, address, phone number, Social Security number — to convince the bank representative they are legitimate. If the representative does not verify carefully, the money moves before you know it happened.
Both methods are slower than ACH fraud or account takeover, but they are harder to prevent if you do not monitor your account regularly. A single forged check can clear in days, and by then the thief has already cashed it.
What to do immediately if you notice unauthorized transfers
Call your bank's fraud line right away — do not wait for business hours. Most banks have a 24-hour fraud hotline on the back of your debit card or on their website. Tell them which transactions are not yours and ask them to freeze your account. The bank will usually reverse the unauthorized transfers while they investigate, which means the money goes back into your account within one to three business days.
Write down the date and time you called, the name of the person you spoke to, and what they told you. Ask for a confirmation number. Then follow up in writing — send a letter to the bank's fraud department describing the unauthorized transactions, the date you reported them, and who you spoke to. Keep a copy for your records. This written report starts the official dispute process and protects you under federal law.
Change your online banking password immediately, using a password you have never used before. If you use the same password on other websites, change those too. If you think someone has your Social Security number or other personal information, consider placing a fraud alert or credit freeze with the three credit bureaus (Equifax, Experian, TransUnion).
Federal protection: Regulation E and your rights
Federal law requires banks to refund unauthorized electronic transfers under Regulation E. The amount of protection depends on how quickly you report the theft.
If you report the unauthorized transfer within two business days, the bank must refund all of it. If you report it between two and 60 days, the bank must still refund it, but they may charge you up to $50 of the loss. If you wait longer than 60 days, the bank has no obligation to refund anything — though many do anyway as a courtesy.
This protection covers ACH fraud, account takeover, and unauthorized debit card use. It does not cover check fraud or social engineering in the same way — those fall under different rules. For checks, the bank is responsible for verifying the signature, so if a forged check clears, the bank must refund it. For social engineering, the bank may argue that you authorized the transfer (even if you did not), which makes recovery harder.
How to catch theft before it becomes a big problem
Check your account at least once a week, either through your bank's app or website. Look for transactions you do not recognize, especially small ones — thieves sometimes test an account with a small transfer first to see if it clears. If it does, they move larger amounts.
Set up low-balance alerts through your bank's app or website. Most banks let you choose a threshold — for example, alert me if my balance drops below $500. This catches large transfers quickly. Some banks also offer transaction alerts, which notify you by text or email every time money leaves your account.
Review your statements monthly, even if you check your account weekly. Statements sometimes show details that the app does not, and you may spot a pattern of small fraudulent charges that adds up over time. Keep statements for at least one year.
Do not share your account number, routing number, or online banking password with anyone. Do not write these numbers on checks or give them out over the phone unless you initiated the call and you are certain you are speaking to your bank. Be especially careful with emails or texts that ask you to "verify" your information — banks do not ask for this via email.
What happens after you report the theft
The bank will open a dispute and investigate the unauthorized transactions. This usually takes 10 business days, though it can take up to 45 days. During this time, the bank may provisionally refund the money while they investigate, or they may wait until the investigation is complete. Ask your bank which approach they use.
If the bank finds that the transfer was truly unauthorized, they refund the full amount (minus any fee they charged you for reporting late). If they find that you authorized it — which can happen if someone social-engineered you into approving a transfer — they may not refund it. This is rare, but it happens.
Once the investigation is closed, the bank will send you a written report explaining what they found. Keep this report in case you need to dispute it further or report the theft to law enforcement.
Frequently Asked Questions
Can someone steal from my savings account with just my account number?
Yes. Your account number and routing number are enough for someone to set up an ACH debit (a transfer out of your account). They do not need your password, PIN, or card. These numbers appear on every check you write, so protect them the same way you protect your card number.
How long does it take to get my money back after I report fraud?
The bank must refund unauthorized electronic transfers within one to three business days if you reported within two business days. If you reported between two and 60 days, it may take up to 45 days. Check fraud refunds depend on the bank's investigation, which can take 10 to 30 days.
Will my bank refund me if I wait a month to report the theft?
Yes, but with limits. If you report between two and 60 days, the bank must refund the money but can charge you up to $50 of the loss. If you wait longer than 60 days, the bank has no legal obligation to refund anything, though many do as a courtesy. Report as soon as you notice.
What should I do if the thief changed my email address or phone number?
Call your bank immediately from the phone number on your statement or card — not a number from an email or text. Tell them your account has been compromised and ask them to restore your contact information and freeze your account. Do not try to reset your password online if you cannot access your email, because the thief may have locked you out.
Can I prevent ACH fraud by not writing checks?
Stopping check use reduces one source of exposure, but it does not prevent ACH fraud. Your account number and routing number can be obtained from a data breach, a phishing attack, or someone who has seen a check or bank statement. The best prevention is monitoring your account weekly and setting up low-balance alerts.