Yes, a scammer can withdraw money from your bank account if they have your account number and routing number, or if they trick you into giving them access through your online banking login or a payment app

The most common routes are: they use your account details to set up an unauthorized ACH transfer or debit, they log into your account directly after you've shared your password, they pose as your bank and trick you into authorizing a transfer through your phone, or they gain access to your email and reset your online banking password. The speed and amount they can take depends on which method they use and how quickly your bank catches it.

Your bank account is not the same as a credit card. With a credit card, federal law caps your liability at $50 if you report fraud quickly. With a bank account, the rules are stricter and the window to report is shorter. If a scammer drains your checking account, you may be able to recover the money, but only if you act fast and understand which protections actually apply to you.

Key Takeaways

  • Scammers can withdraw from your bank account using your account and routing number, your online login, or by tricking you into authorizing a transfer over the phone.
  • Federal law limits your liability to $50 if you report unauthorized transfers within two business days; after that, you may lose up to $500 or more depending on how long you wait.
  • Your bank is required to investigate and refund unauthorized ACH transfers and debit card fraud, but the timeline and outcome depend on the type of transaction and when you report it.
  • Scammers often gain access by phishing your email, stealing your password, or posing as your bank on the phone — not by hacking into the bank itself.
  • Freezing your credit and monitoring your accounts daily are your best defenses once you suspect fraud.

How scammers actually get into your bank account

Most scammers do not hack the bank. They target you. The most common method is phishing — they send you an email or text that looks like it came from your bank, asking you to "verify your account" or "confirm your identity." The link takes you to a fake login page that looks identical to your real bank's site. You enter your username and password, and the scammer now has both. Within minutes, they log in to your real account and transfer money out.

The second method is social engineering over the phone. A scammer calls you pretending to be your bank's fraud department. They say they noticed suspicious activity and need you to confirm your account details. Once they have your account number, routing number, and sometimes your Social Security number, they can set up an ACH transfer or authorize a debit from your account. Some scammers are convincing enough that you authorize the transfer yourself, thinking you're protecting your account.

A third route is email compromise. If a scammer gains access to your email account, they can reset your bank's online password and lock you out. They then transfer money or change your contact information so you don't get alerts. This often happens because your email password was weak or reused across multiple sites.

The fourth method is using your account and routing number directly. If you've written a check, paid a bill online, or given your banking details to a business, that information is out there. A scammer can use those numbers to set up an unauthorized ACH debit or even create counterfeit checks in your name.

What federal law says about your liability

The Electronic Funds Transfer Act (EFTA) is the federal rule that protects you when someone uses your account without permission. But the protection depends entirely on how fast you report it.

If you report an unauthorized transfer or debit within two business days of discovering it, your liability is capped at $50. That means if $5,000 was stolen, you lose $50 and the bank refunds $4,950. If you wait longer than two business days but report it within 60 calendar days of your statement being sent to you, your liability jumps to $500. If you wait more than 60 days, you may lose the entire amount — the bank has no obligation to refund you.

This timeline is strict. "Two business days" means two actual banking days, not calendar days. If you discover fraud on a Friday evening, you have until Monday end of business to report it. If you discover it on a Saturday, you have until Tuesday. The clock starts the moment you notice the unauthorized transaction, not when you receive your statement.

One exception: if the fraud involved your debit card (not just your account number), and you report it before the card is used, your liability is $0. Once the card is used, the two-business-day window applies.

How banks investigate and what you need to do

When you report an unauthorized transfer, your bank is required by law to investigate. They will ask you to sign an affidavit stating that you did not authorize the transaction. Do this immediately — do not delay. The bank then has up to 10 business days to investigate and either refund you or explain why they won't.

In practice, most banks refund unauthorized ACH transfers and debit card fraud within 5 to 7 business days if you report quickly. The money goes back into your account as a provisional credit while the investigation continues. If the bank finds that you were negligent — for example, you wrote your PIN on your debit card or shared your password with someone — they may reverse the credit and hold you liable.

Wire transfers and transfers you authorized but were tricked into making are much harder to recover. If a scammer convinced you to wire money or transfer funds to their account, the bank may not refund you because technically you authorized it. The money is often gone for good. This is why scammers prefer to trick you into authorizing a transfer rather than stealing your login credentials.

Document everything. Save the phishing email, the text message, the phone call recording if you have one, and screenshots of the unauthorized transaction. Send these to your bank along with your fraud report. The more evidence you provide, the faster the investigation moves.

Steps to take immediately if money is missing

First, call your bank's fraud line right now. Do not use the number on your debit card or the website — scammers sometimes intercept those. Look up the number on your statement or call directory assistance. Tell them you have unauthorized transactions and you want to report fraud. They will freeze your account and issue you a new debit card.

Second, change your online banking password from a different device (not your computer, which may be compromised). Use a password that is at least 16 characters long and includes numbers, symbols, and mixed case. Do not reuse a password you've used anywhere else.

Third, check your email security. If the scammer accessed your email, they may have reset your bank password, changed your recovery phone number, or set up forwarding rules to hide emails from you. Log into your email account and review the "Recently used devices" or "Login activity" section. If you see logins from places you don't recognize, change your email password immediately and enable two-factor authentication.

Fourth, place a fraud alert on your credit file by contacting one of the three credit bureaus: Equifax, Experian, or TransUnion. You only need to contact one; they will notify the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name. This is free and lasts one year.

Fifth, monitor your accounts daily for the next 30 days. Check your bank account, credit card accounts, and credit report for any activity you don't recognize. Many banks offer free credit monitoring as part of their fraud protection — ask if yours does.

What you should never do after discovering fraud

Do not send money to anyone claiming they can recover your funds. Scammers often follow up fraud with a recovery scam: they call or email saying they work for a recovery service and can get your money back for an upfront fee. This is a second scam. Legitimate recovery is handled by your bank and law enforcement, not by private companies that call you unsolicited.

Do not ignore the fraud hoping it will go away. The longer you wait to report it, the less the bank is required to help you. Report it the same day you discover it, even if you're not sure yet whether it's real fraud. Your bank can investigate and tell you whether the transaction was authorized.

Do not assume your bank will catch everything. Banks have fraud detection systems, but they are not perfect. A small unauthorized transfer might slip through. Check your account regularly, especially after you've given your banking details to a new business or service.

How to prevent scammers from accessing your account in the first place

Use a strong, unique password for your online banking login. This means at least 16 characters, a mix of uppercase and lowercase letters, numbers, and symbols. Do not use your birthday, address, or any word that appears in a dictionary. Use a password manager like Bitwarden or 1Password to generate and store passwords so you don't have to remember them.

Enable two-factor authentication (2FA) on your bank account. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this for free. Use an authenticator app like Google Authenticator or Authy rather than SMS text messages, because text messages can be intercepted.

Never click links in emails or texts claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser, or call the number on your statement. Legitimate banks never ask you to confirm your password or account number via email or text.

Do not share your account number, routing number, or online banking login with anyone except your employer (for direct deposit) or a business you are actively paying. If you're unsure whether a request is legitimate, call your bank directly using the number on your statement.

Monitor your credit report for free at annualcreditreport.com once per year. Look for accounts you don't recognize or inquiries from creditors you didn't apply to. If you see fraud on your credit report, contact the credit bureau and the creditor immediately.

Frequently Asked Questions

Can a scammer withdraw money if they only have my account number?

Yes. With your account number and routing number, a scammer can set up an ACH debit or create counterfeit checks. They cannot use an ATM or debit card, but they can pull money out of your account through the banking system. Report it immediately to your bank and follow the steps above.

What if my bank says the transaction was authorized and won't refund me?

Ask the bank to provide written documentation of how the transaction was authorized. If you did not authorize it, file a dispute in writing and reference the Electronic Funds Transfer Act. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can force them to refund you.

How long does it take to get my money back?

Most banks issue a provisional credit within 5 to 7 business days if you report quickly. The full investigation can take up to 10 business days. If the bank finds the transaction was unauthorized, the provisional credit becomes permanent. If they find you were negligent, they may reverse it.

Do I need to close my bank account after fraud?

Not necessarily. Your bank will issue you a new debit card and monitor the account for further fraud. You can keep the account open if you trust the bank's response. Close it only if you want a fresh start or if the bank is unresponsive to your fraud report.

What if the scammer set up a payment app account using my information?

Contact the payment app company (Venmo, PayPal, Cash App, etc.) immediately and report the unauthorized account. They will freeze it and investigate. If money was transferred out, ask them to help you recover it. You can also file a fraud report with your bank if the transfers came from your bank account.