Yes, scammers can drain your bank account if they get your login credentials or routing information

Scammers can move money out of your bank account in several ways. The most common is phishing—tricking you into giving them your username and password, then logging in as you. Another is ACH fraud, where they use your account number and routing number to pull money out without your permission. A third is SIM swapping, where they convince your phone carrier to transfer your phone number to their device, then use it to reset your banking passwords. Each method works differently, leaves different traces, and has different recovery timelines.

The speed matters. If you catch the theft within a day or two, your bank can often reverse it. If weeks pass, recovery becomes harder and may not happen at all. Your bank is not required to refund you if you voluntarily gave someone your password, though many do anyway. The law protects you more strongly if someone stole your information without your knowledge.

Key Takeaways

  • Phishing—where scammers trick you into handing over your login details—is the fastest way for a criminal to drain your account, because they log in as you.
  • ACH fraud uses only your account number and routing number (both printed on your checks) to pull money out, and you may not notice for days.
  • Report unauthorized transactions to your bank within 60 days to preserve your right to a refund under federal law.
  • Your bank may refuse to refund you if you gave your password away willingly, even if you were tricked into doing so.
  • Freezing your credit with the three major bureaus stops scammers from opening new accounts in your name while you recover.

How phishing drains your account in hours

Phishing is the fastest theft because the scammer logs into your account as you. They send you a fake email or text that looks like it came from your bank, a payment app, or a service you use. The message says your account is locked, a suspicious login was detected, or you need to confirm your identity. The link takes you to a fake website that looks identical to the real one. You enter your username and password. The scammer now has both.

Once they are logged in, they can transfer money to another account, pay bills in your name, or change your contact information so you do not see the alerts. Some scammers move money to a money transfer service like Western Union or MoneyGram within minutes, making it nearly impossible to recover. Others move it to another bank account they control, which gives you a slightly longer window to catch it.

The reason phishing works is that the fake website is often pixel-perfect. The email address in the "from" line may say "noreply@yourbank.com" when it actually came from "noreply@yourbank-secure.net" or something similar. Your eye skips over the difference. The URL in the browser bar looks right until you look closely. Most people do not look closely when they are worried their account is locked.

ACH fraud: pulling money without your login

ACH stands for Automated Clearing House, the system banks use to move money between accounts. To pull money via ACH, a scammer needs only two pieces of information: your account number and your routing number. Both are printed on the bottom left of every check you write. If you have ever given a check to a contractor, landlord, or utility company, someone has seen both numbers.

With those two numbers, a scammer can set up a one-time ACH withdrawal or create a recurring payment. They do not need your password. They do not need to log into your account. They simply tell their bank (or a payment processor) to pull money from your account and deposit it into theirs. Your bank receives the instruction and processes it. You may not notice for days, because ACH transfers are not instant—they typically settle within one to three business days.

The catch is that ACH fraud is reversible. If you report it within 60 days, your bank must refund you under the Electronic Funds Transfer Act. If you report it after 60 days, your bank may still refund you, but it is not required to. This is why checking your account regularly matters: the sooner you spot the theft, the easier it is to recover.

SIM swapping and account takeover

SIM swapping is a two-step attack. First, the scammer calls your phone carrier and convinces them that they are you. They say they lost their phone, got a new one, and need the SIM card transferred to the new device. The carrier moves your phone number to a SIM card the scammer controls. Your phone stops working. Their phone now receives all your calls and text messages.

Second, the scammer uses your phone number to reset your bank password. They go to your bank's website, click "Forgot Password," and enter your email address. The bank sends a password reset link to your email and a one-time code via text message. The scammer has your email password (from a previous breach or phishing attack) and receives the text message on the SIM they just stole. They reset your password and log in.

SIM swapping is harder to pull off than phishing because it requires social engineering with your phone carrier. But it is devastating when it works, because the scammer has full access to your account and your phone number. They can also reset passwords for your email, payment apps, and investment accounts. Recovery can take weeks and may require filing a police report.

What to do if money is missing from your account

Call your bank immediately—do not email or use the app. Use the phone number on the back of your debit card or on your bank statement, not a number from a search result or email. Tell them the specific transactions that are unauthorized and the amounts. Do not assume they know which ones you mean.

Your bank will freeze the account, cancel your debit card, and begin an investigation. They will ask you whether you recognize the transactions, where the money went, and whether anyone had access to your passwords or account information. Answer honestly. If you gave your password to someone (even if they tricked you), say so. Lying to your bank can void your protection.

Ask your bank for a written confirmation of the unauthorized transactions and the date you reported them. This matters because federal law gives you 60 days from the date the transaction appeared on your statement to report it. If you report it after 60 days, your bank can refuse to refund you. Get the confirmation in writing so you have proof of when you reported it.

Request a new debit card and a new PIN. Change your online banking password to something long and random—at least 16 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used anywhere else. If you used the same password on other sites, change those too.

Freezing your credit while you recover

While your bank investigates, scammers may try to open new accounts in your name—credit cards, loans, phone lines, utilities. A credit freeze stops them. You contact the three major credit bureaus (Equifax, Experian, and TransUnion) and ask them to freeze your credit. After a freeze is in place, no one can open a new account in your name without unfreezing it first, and unfreezing requires a PIN only you know.

A credit freeze is free and takes about 15 minutes per bureau. You can do it online, by phone, or by mail. Equifax, Experian, and TransUnion each have their own freeze process, so you have to contact all three. Write down the PIN they give you and store it somewhere safe—you will need it if you want to unfreeze your credit later to apply for a loan or credit card.

A freeze is different from a fraud alert. A fraud alert tells creditors to call you before opening a new account in your name, but it does not stop them from opening one. A freeze actually blocks new accounts. If you have been the victim of identity theft, a freeze is stronger protection.

Your legal protection depends on how the money left

Federal law protects you differently depending on how the scammer stole the money. If they used your debit card (either the physical card or the number), the Electronic Funds Transfer Act says your bank must refund you if you report it within 60 days. If you report it after 60 days, your bank can refuse.

If the scammer used ACH to pull money from your account, the same 60-day rule applies. If they used a wire transfer or a money transfer service like Western Union, your protection is weaker. Wire transfers are nearly impossible to reverse once they leave your bank. Money transfer services like Western Union or MoneyGram rarely refund money unless the recipient has not picked it up yet.

If you gave your password away willingly—even if someone tricked you into doing it—your bank may argue that you are responsible for the loss. Many banks refund it anyway as a customer service gesture, but they are not legally required to. This is why it matters whether the scammer phished you (tricked you) or hacked you (stole your information without your knowledge). Banks are more likely to refund phishing victims.

Frequently Asked Questions

How long does it take to get my money back?

If your bank confirms the transaction was unauthorized, they typically refund you within 5 to 10 business days. Some banks do it faster. If the bank disputes your claim or investigates further, it can take 30 to 60 days. Wire transfers and money sent to other banks take longer because the receiving bank has to cooperate.

Can my bank refuse to refund me if I gave out my password?

Yes, they can, though many do not. Banks are not legally required to refund you if you voluntarily shared your password, even if you were tricked into doing so. However, if you can show the bank that you were phished—that you received a fake email or text that looked legitimate—many banks will refund you anyway. Keep the phishing email or text as evidence.

What if the scammer moved my money to another bank?

Your bank will contact the receiving bank and ask them to freeze the account and return the money. This takes longer than a refund from your own bank, usually 10 to 30 days. If the receiving bank is small or in another country, it can take much longer. The sooner you report it, the better your chances of recovery.

Do I need to file a police report?

You do not need one to get a refund from your bank, but filing one creates an official record of the theft. This helps if the scammer targets you again or if you need to dispute fraudulent accounts opened in your name. You can file a report online with your local police department or the FBI's Internet Crime Complaint Center (IC3).

Should I close my bank account after a theft?

Not necessarily. Closing it does not erase the theft from your record, and it can hurt your banking history. Instead, ask your bank for a new account number and debit card. Keep the old account open for 60 days in case the bank needs to reverse additional transactions, then close it if you want to.