Yes, someone can steal from your savings account, but the method matters for how you recover the money

Money leaves a savings account without your permission through a few specific routes: someone uses your debit card or card number, they log into your online account with your password, they convince the bank to move money by pretending to be you, or they set up an unauthorized transfer. The bank's responsibility to refund you depends on which route was used and how quickly you report it. Federal law protects you in most cases, but the window to report and the amount you might lose varies.

The fastest theft to spot is usually a fraudulent debit card charge — it shows up in your transaction history within hours. The slowest to notice is often an ACH transfer (a bank-to-bank transfer) set up by someone with your account number and routing number, because it can take days to appear and may look like a legitimate payment at first glance.

Key Takeaways

  • Federal law (Regulation E) limits your loss to $50 if you report unauthorized charges within two business days, but you may owe the full amount if you wait longer than 60 days.
  • Debit card fraud is usually refunded within one to three business days once reported, while ACH transfer fraud can take up to ten business days to reverse.
  • The bank must investigate your claim within ten business days and either refund you or explain in writing why they will not.
  • You are not responsible for charges made after you report the fraud, even if the thief continues trying to use your account.
  • Checking your account at least weekly and setting up transaction alerts reduces the time between theft and discovery, which directly affects how much you recover.

How debit card fraud works and what the bank owes you

If someone uses your debit card number or physical card to make a purchase, that charge appears in your account within hours. Under Regulation E (the federal rule that covers electronic transfers and card fraud), you are protected as long as you report it. The amount you might lose depends on when you report it.

Report the fraud within two business days: you owe a maximum of $50. Report it between two and 60 days after the statement containing the fraud is sent to you: you owe a maximum of $500. Report it after 60 days: you may owe the full amount, and the bank can refuse to refund you at all. "Business days" means Monday through Friday, not counting federal holidays.

Once you report the fraud by phone or in writing, the bank must refund the money within one to three business days while they investigate. They have ten business days to finish the investigation and either confirm the refund or send you a written explanation of why they are not refunding it. If they need more time, they can extend the investigation to 45 days, but they must refund you provisionally (temporarily) within ten days while they continue looking.

ACH transfers and wire transfers: slower theft, different rules

An ACH transfer is a bank-to-bank transfer that takes one to three business days to complete. If someone has your account number and routing number, they can set up an ACH transfer to move money out of your account without your permission. This type of theft is harder to spot because it does not show up immediately, and it can look like a legitimate bill payment or paycheck deposit at first glance.

ACH fraud is covered by Regulation E, so the same $50/$500/full-amount rules apply based on when you report it. However, the refund timeline is longer because the money has already left your bank and arrived at another bank. Once you report it, your bank must contact the receiving bank and request a reversal. This can take up to ten business days. If the receiving bank cannot recover the money (for example, because the thief withdrew it immediately), your bank must refund you from their own account.

Wire transfers are different and offer less protection. If someone tricks you into sending a wire transfer, or if they access your account and send a wire themselves, Regulation E does not cover it the same way. Wire fraud is treated as a criminal matter, and recovery depends on whether the receiving bank can freeze the account before the money is withdrawn. Report wire fraud to your bank and to the FBI's Internet Crime Complaint Center (IC3) immediately.

Account takeover: when someone logs in with your password

If a thief has your username and password, they can log into your online banking account and move money or change your contact information. This is called account takeover. They might have gotten your password through a data breach at another company, by phishing (a fake email pretending to be your bank), or by malware on your computer.

Account takeover is covered by Regulation E as long as you report it. The same timeline rules apply: report within two business days and you owe $50 maximum; report within 60 days and you owe $500 maximum; report after 60 days and you may owe everything. Once you report it, change your password immediately and ask the bank to freeze your account or issue a new debit card.

The bank should also review your account for other unauthorized activity during the time the thief had access. If they find multiple fraudulent transfers or charges, they must refund all of them, not just the one you reported. Ask the bank to provide a written list of all unauthorized activity they found during their investigation.

Social engineering: when a thief impersonates you to the bank

Social engineering is when someone calls your bank, pretends to be you, and convinces a bank employee to move money or change account details. The thief might have your name, address, and last four digits of your Social Security number (information that is often public or available from data breaches). They use this to sound legitimate and pressure the employee into acting quickly.

If this happens, the protection you receive depends on whether the bank employee followed proper verification procedures. If the employee did not verify your identity correctly before making the change, the bank is responsible for the loss. If the employee did verify your identity but the thief had enough real information to pass the verification, the situation is more complicated and may require a dispute process.

Report social engineering fraud to your bank immediately and ask them to review the call recording (most banks record customer service calls). Request a written statement of what happened and what the employee did to verify the caller's identity. If the bank refuses to refund you, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB).

What to do the moment you notice unauthorized activity

Call your bank's fraud line immediately — do not wait until business hours if you discover the fraud on a weekend or evening. Most banks have a 24-hour fraud hotline on the back of your debit card. Explain what happened, which transactions are unauthorized, and when you first noticed them. The bank will create a fraud report and issue you a case number.

Follow up the phone call with a written report sent by certified mail or through your online banking portal (if the bank offers that option). Include the case number, the dates of the unauthorized transactions, the amounts, and the date you first discovered the fraud. Keep a copy for your records. Written documentation protects you if the bank later claims you did not report it.

Ask the bank to cancel your current debit card and issue a new one with a new number. Request that they place a fraud alert on your account so that any future changes to your contact information or password require additional verification. Ask whether they offer a credit freeze or fraud monitoring service.

Protecting yourself: what reduces your risk and recovery time

Check your account at least once a week, ideally more often. The faster you spot unauthorized activity, the sooner you can report it and the more money you will recover. Set up transaction alerts through your bank's app or website — most banks let you choose to be notified by email or text whenever a charge over a certain amount is made, or whenever any charge is made.

Use a strong, unique password for your online banking account. "Strong" means at least 12 characters mixing uppercase letters, lowercase letters, numbers, and symbols. "Unique" means you do not use the same password for your bank account that you use for email, social media, or other websites. If one of those sites is hacked, a thief can try the same password on your bank account.

Enable two-factor authentication (also called multi-factor authentication) on your online banking account if your bank offers it. This means that even if someone has your password, they cannot log in without a second form of verification — usually a code sent to your phone or generated by an authenticator app. Do not use SMS text messages if your bank offers an authenticator app instead, because text messages can be intercepted.

Do not share your debit card number, PIN, or online banking password with anyone, including bank employees. Your bank will never ask for your password. If someone claiming to be from your bank asks for it, hang up and call the bank's main number (from the back of your card or their official website) to report the call.

If the bank refuses to refund you

If your bank investigates your fraud claim and decides not to refund you, they must send you a written explanation. This explanation should describe what they found during their investigation and why they believe the charges were authorized. Read it carefully — sometimes banks make mistakes in their investigation.

You can dispute the bank's decision by filing a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. You can also file a complaint with your state's banking regulator (search "[your state] banking regulator" or "[your state] attorney general"). These agencies can investigate the bank's handling of your case and sometimes force them to refund you.

If the fraud involved a crime (for example, if someone physically stole your card or if you were the victim of identity theft), you can also file a police report. Provide the police with your bank's fraud report and case number. A police report can help if you need to dispute the bank's decision later.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Your bank must refund you within one to three business days for debit card fraud, and within ten business days for ACH transfer fraud. If the bank needs more time to investigate, they must still refund you provisionally (temporarily) within ten days while they continue looking. The full investigation can take up to 45 days.

What if I authorized the transfer but now I want the money back?

If you authorized the transfer, Regulation E does not cover it, and the bank does not have to refund you. This is different from fraud. However, if you can show that you were tricked or coerced into authorizing it, you may be able to dispute it as fraud. Contact your bank and explain the situation.

Can the thief keep stealing from my account after I report the fraud?

No. Once you report the fraud, you are not responsible for any charges made after that point, even if the thief continues trying to use your account. The bank should cancel your debit card and issue a new one. If unauthorized charges appear after you reported the fraud, report them again immediately.

Do I have to pay for a new debit card after fraud?

No. Banks must issue a replacement debit card for free after fraud. They cannot charge you a fee for the replacement card or for the fraud investigation. If your bank charges you, contact your state's banking regulator.

What if the fraud happened at an ATM?

ATM fraud is covered by Regulation E. Report it the same way you would report debit card fraud — call the bank's fraud line and follow up with a written report. If the ATM was at a different bank, your bank will contact that bank to investigate. The same $50/$500/full-amount rules apply based on when you report it.