Yes, a scammer can take money directly from your bank account if they have your routing number, account number, or online login credentials

A scammer does not need your debit card to drain your account. They need one of three things: your routing and account number (which appear on every check you write), your online banking login, or access to your email or phone to reset your password. Once they have any of these, they can move money out through ACH transfers, bill pay, or fraudulent checks written in your name.

The damage happens fast because ACH transfers and bill pay do not require the same verification as a card transaction. A scammer can initiate a transfer in minutes and the money can leave your account within hours. Your bank will not call you to confirm an ACH debit the way it might flag an unusual card purchase.

The good news: your bank account has fraud protection, but it works differently than credit card protection, and you have to report the theft quickly for it to work.

Key Takeaways

  • Scammers can drain your account using your routing and account number, online login, or by resetting your password through a compromised email or phone.
  • ACH transfers and bill pay move money without the verification required for card transactions, so theft can happen in hours.
  • Federal law limits your liability to $50 if you report unauthorized transfers within two business days, but waiting longer can cost you thousands.
  • Your bank must investigate within 10 business days and return money if the transfer was not authorized by you.
  • Prevention means using a strong unique password, enabling two-factor authentication, and monitoring your account weekly for unfamiliar transactions.

How scammers get your routing and account number

Your routing and account number are printed on every check, so they are not secret. A scammer can get them by stealing mail, photographing a check you left visible, or buying a list of numbers from someone who works at a business where you paid by check. They can also get them by phishing—sending you a fake email that looks like it is from your bank and asking you to "verify" your account information.

Once they have these numbers, they can create unauthorized ACH transfers or write fraudulent checks in your name. Neither requires your signature or PIN. The scammer does not need to forge your handwriting because ACH transfers are electronic and checks can be deposited remotely through a phone app.

If you have given your account number to a business (a utility, insurance company, or employer for direct deposit), that business has it too. A data breach at that company can expose your number to criminals.

How scammers access your online banking login

Scammers steal login credentials through phishing emails, fake bank websites, malware on your computer, or by tricking you into giving them the information directly. A common scam is a call claiming to be from your bank's fraud department, asking you to "verify" your username and password to protect your account. You give them the information thinking you are helping, and they log in and transfer money out.

Once logged in, a scammer can set up bill pay to send money to accounts they control, change your contact information so you do not see the transactions, or transfer money via the bank's own app. Some banks allow transfers to external accounts after a short waiting period (24 to 48 hours), so a scammer can initiate a transfer and it will go through even if you discover the breach the next day.

This is why two-factor authentication matters: even if a scammer has your password, they cannot log in without also having access to your phone or email. If your email is compromised, they can reset your bank password and bypass two-factor authentication entirely.

What happens when money leaves your account

An unauthorized ACH transfer typically clears within one business day. The money leaves your account and goes to another bank account, often at a different bank. Once it is there, the scammer moves it again—to a payment app, a wire transfer service, or a cash withdrawal. By the time you notice, the money has moved multiple times and is much harder to recover.

If the scammer writes a fraudulent check in your name, it may take longer to clear (three to five business days), giving you more time to catch it. But once it clears, the same problem applies: the money is gone and the scammer is moving it quickly.

Your bank will see the transaction as an outgoing transfer or check payment from your account. It looks legitimate from the bank's side because it came from your account using valid credentials or routing information. That is why you have to prove it was not you.

Your legal protection and the two-day window

Federal law (Regulation E) limits your liability for unauthorized ACH transfers and electronic payments. If you report the theft within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report it within 60 calendar days, you could lose up to $500. If you wait more than 60 days, you may lose everything.

The clock starts when you discover the unauthorized transaction, not when it happened. If a scammer drains your account on a Friday and you do not check your balance until Monday, you have until Wednesday to report it and stay within the $50 liability cap.

This is why monitoring your account matters. Check your balance and recent transactions at least once a week. Set up account alerts if your bank offers them—many will notify you by text or email when a transfer over a certain amount is initiated or when a login happens from a new device.

How to report unauthorized transfers to your bank

Call your bank immediately, not through a number in an email or text. Use the number on the back of your debit card or on your bank's official website. Tell them you have an unauthorized transfer and you want to report it under Regulation E. Do not wait for an email response or a callback.

Your bank will freeze the account or the specific transfer while they investigate. They will ask you to describe what happened, when you discovered it, and whether you recognize the receiving account. They will also ask whether anyone else has access to your account or knows your password.

The bank must begin an investigation within one business day and complete it within 10 business days. During that time, they will contact the receiving bank and ask them to hold the money. If the receiving bank confirms the transfer was unauthorized, your bank will return the money to your account. If the receiving bank says the money was already moved out, your bank will still credit you, but recovery becomes harder.

Get a written confirmation of your report. Ask for a case number and a timeline for when the money will be returned. Some banks will provisionally credit your account within one to three business days while the investigation continues.

What to do if the money is not returned

If your bank does not return the money within 10 business days, ask why. The investigation may still be ongoing, or the receiving bank may have said the money was already withdrawn. Ask your bank for a written explanation of their findings.

If your bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. You can also contact your state's banking regulator or attorney general. These agencies can pressure the bank to reconsider or investigate further.

If the money went to another bank, that bank has a legal obligation to cooperate with the investigation. If they refuse or if the money was already withdrawn, recovery becomes a matter for law enforcement. File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and with your local police. These reports do not recover money but they create a record that may help if the scammer targets others.

Preventing unauthorized access to your account

Use a unique, strong password for your bank account—one you do not use anywhere else. If a scammer gets your password from a breach at another company, they will try it on your bank account. A unique password stops them.

Enable two-factor authentication on your bank account and on your email. Two-factor authentication means you need both your password and a code from your phone (or a security key) to log in. Even if a scammer has your password, they cannot get in without your phone.

Do not give your account number, routing number, or online login to anyone who calls you, even if they claim to be from your bank. Your bank will never ask for this information by phone or email. If someone calls claiming to be from your bank, hang up and call the number on your bank statement.

Do not click links in emails claiming to be from your bank. Go directly to your bank's website by typing the address into your browser. Phishing emails often look identical to real bank emails, but the link goes to a fake site designed to steal your login.

Shred checks you do not use and do not leave them in your mailbox. If you pay bills online, use your bank's bill pay feature rather than mailing checks. Monitor your account weekly and set up alerts for large transfers or logins from new devices.

Frequently Asked Questions

Can a scammer drain my account if they only have my debit card number?

No, not directly. A debit card number alone does not give access to your bank account for ACH transfers or bill pay. However, a scammer can use the card number to make fraudulent purchases, which is why you should report a stolen or compromised card number immediately. Debit card fraud is covered under different rules than account access fraud.

What if the scammer used my account to send money to someone else, and that person spent it?

Your bank still has to return the money to you if the transfer was unauthorized. The receiving bank may try to recover it from the person who received it, but that is between the banks. Your liability is capped at $50 if you report within two business days, regardless of whether the money was spent.

If I report fraud, will my bank close my account?

Not because you reported fraud. Banks close accounts for other reasons (repeated overdrafts, suspicious activity patterns, or violations of their terms), but reporting unauthorized transfers is not one of them. In fact, reporting fraud quickly shows you are monitoring your account responsibly.

Can I get my money back if I wait more than 60 days to report?

You lose federal protection after 60 days, but you can still try. Contact your bank and explain why you did not report sooner. Some banks will investigate anyway, especially if you have a good account history. However, the longer you wait, the harder it is to recover money because it has moved through multiple accounts and may have been withdrawn as cash.

What if my email was hacked and the scammer reset my bank password?

Call your bank immediately and tell them your email was compromised. Ask them to lock your account and require a phone call or in-person visit to make any changes. Secure your email by changing its password and enabling two-factor authentication. Your bank should also send you a new debit card as a precaution.