Yes, scammers can take money directly from your bank account if they have your account number and routing number

Scammers do not need your debit card or password to pull money out. If they have your account number and routing number, they can set up an unauthorized ACH transfer or draft against your account. If they have your full card details and CVV, they can make online purchases or create a fake card. If they trick you into giving remote access to your computer, they can log into your banking app themselves. The method depends on what information they obtained and how they got it.

The good news: your bank has a legal obligation to reverse most of these transfers if you report them quickly. The bad news: "quickly" means within a specific window, and the longer you wait, the harder recovery becomes. Knowing how the theft happened and which type of transfer it was determines what you can recover and how long it takes.

Key Takeaways

  • Scammers can pull money from your account using your account and routing numbers alone, without your debit card or online password.
  • You have 60 days from when your bank statement shows the unauthorized transfer to report it and trigger the bank's fraud investigation.
  • ACH transfers and debit card fraud have different dispute timelines and recovery rates, so identifying which one happened matters immediately.
  • Freezing your account and contacting your bank within 24 hours of discovering the theft significantly improves your chances of recovery.
  • If the scammer accessed your account through remote access or phishing, change your password and enable two-factor authentication before they return.

How scammers get your account and routing numbers

Your account and routing numbers are printed on every check you write. If you have given checks to a contractor, landlord, or anyone else, they have this information. Scammers also obtain these numbers by intercepting mail, posing as your bank in a phishing email, or buying stolen banking data on the dark web. Some get it from a data breach at a company where you have an account.

Once they have these numbers, they can file what is called an ACH debit — a request to pull money from your account. Unlike a wire transfer, which is instant and nearly impossible to reverse, an ACH debit takes one to three business days to clear. This delay is your window to catch it and stop it. They can also use the numbers to set up recurring payments, so money drains from your account on the same day each month until you notice.

The difference between ACH fraud and debit card fraud

If scammers have your full debit card number, expiration date, and CVV, they can make online purchases or create a virtual card number. This is debit card fraud. Your bank's fraud department can dispute these charges, but the process is different from an ACH dispute.

With debit card fraud, you have up to 60 days to report unauthorized charges. Your bank must investigate within 10 business days and either reverse the charge or explain why it was legitimate. If they reverse it, the money goes back into your account within one to three business days. If they cannot confirm the charge was yours, they must credit you while they continue investigating.

With ACH fraud, the timeline is the same — 60 days to report — but the reversal process is slower. Your bank must initiate a return request to the originating bank, which can take five to ten business days. If the scammer has already withdrawn the money, recovery depends on whether the originating bank can trace it.

What happens if a scammer gains remote access to your account

If you gave a scammer remote access to your computer through software like TeamViewer or AnyDesk, or if they phished your online banking password, they can log into your account directly and transfer money themselves. This is the most dangerous scenario because the transfer appears to come from you, not from an unauthorized third party. Your bank may initially deny the dispute because the login came from your device.

Report this to your bank immediately and tell them the access was unauthorized. Ask them to check the IP address and device used to log in — if it does not match your usual location or device, this proves you did not make the transfer. Change your password from a different device (not the compromised one) and enable two-factor authentication so the scammer cannot log back in. If your bank still refuses to reverse the transfer, file a complaint with the Consumer Financial Protection Bureau (CFPB) and your state's banking regulator.

The 60-day reporting window and why it matters

Federal law gives you 60 days from the date your bank statement shows the unauthorized transfer to report it. If you report on day 61, your bank can legally refuse to investigate. This is why checking your account weekly — or setting up transaction alerts — is critical. Many people discover fraud weeks or months later when they reconcile their account or notice a pattern of small charges.

When you report within 60 days, your bank must credit your account for the disputed amount while they investigate, unless they can prove the transfer was authorized. This provisional credit usually appears within one to three business days. If the investigation confirms fraud, the credit becomes permanent. If the bank cannot determine what happened, they must still credit you after 45 days.

If you report after 60 days, you lose this protection. Your bank can investigate if they choose to, but they are not required to, and they do not have to credit you while they investigate. Some banks will still help you, but you have no legal may provide.

Steps to take immediately after discovering unauthorized transfers

First, call your bank's fraud line — not the main customer service number. The fraud department can freeze your account, stop pending transfers, and initiate a dispute on the same call. Have your statement ready and know the exact date and amount of each unauthorized transfer. Ask the fraud department to place a fraud alert on your account so no new accounts can be opened in your name.

Second, change your online banking password from a different device (a phone or computer the scammer did not access). Use a password that is at least 12 characters and includes numbers, uppercase letters, and symbols. Enable two-factor authentication — either through an authenticator app like Google Authenticator or a hardware security key. Text message-based two-factor authentication is better than nothing, but app-based or hardware keys are stronger.

Third, check your credit report at annualcreditreport.com (the only free, official source). Look for accounts you did not open. If you find fraudulent accounts, dispute them with the credit bureau and the creditor. Place a credit freeze with all three bureaus (Equifax, Experian, TransUnion) to prevent the scammer from opening new accounts.

Fourth, file a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and may help law enforcement if the scammer targets others. You will receive a recovery plan and can use the report number when disputing charges with creditors.

What to do if your bank denies your dispute

If your bank investigates and concludes the transfer was authorized, or if they refuse to investigate after you report within 60 days, you have options. File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB will forward your complaint to your bank, which must respond within 15 days. The CFPB does not resolve disputes directly, but banks take CFPB complaints seriously because they affect regulatory ratings.

You can also file a complaint with your state's banking regulator. Each state has a department of financial regulation or banking commissioner. A quick search for "[your state] banking regulator complaint" will direct you to the right office. Include copies of your bank statements, the dispute letter you sent to your bank, and the bank's response.

If the amount is large enough, consult a consumer protection attorney. Many offer free consultations and work on contingency, meaning they take a percentage of what they recover instead of charging you upfront. The National Association of Consumer Advocates (consumeradvocates.org) has a directory of attorneys by state.

How to prevent unauthorized transfers in the future

Do not give your account number and routing number to anyone except your employer (for direct deposit) or a trusted service provider you initiated contact with. If someone calls claiming to be from your bank and asks for this information, hang up and call your bank's main number to verify. Scammers often spoof bank phone numbers so the caller ID looks legitimate.

Do not click links in emails or texts claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser. Do not use a link from an email, even if it looks official. Enable transaction alerts so your bank texts or emails you whenever money leaves your account. Set the threshold low — even $1 — so you catch fraud immediately.

Use a password manager like Bitwarden or 1Password to generate and store unique passwords for each account. Never reuse passwords across sites. If one site is breached, scammers will try that password on your bank account, email, and other high-value targets. A password manager makes this easy.

Consider using a separate checking account for online shopping and bill payments, with a low balance. Keep most of your money in a savings account that does not have a debit card attached. This limits the damage if your checking account is compromised.

Frequently Asked Questions

Can a scammer drain my entire bank account with just my account number?

Yes, if they have your account number and routing number, they can set up ACH debits. However, most banks have fraud detection systems that flag unusual activity, and ACH transfers take one to three business days to clear, giving you time to catch and stop them. Report any unauthorized transfer to your bank immediately.

How long does it take to get my money back after I report fraud?

Your bank must credit your account within one to three business days if you report within 60 days. The investigation itself takes up to 45 days. If the bank confirms fraud, the credit is permanent. If they cannot determine what happened, you keep the credit after 45 days.

What if the scammer already withdrew the money from their own bank account?

Your bank will file a return request with the scammer's bank. If the money is still there, the scammer's bank must return it. If the scammer has already spent it, recovery is much harder and depends on whether law enforcement can trace the funds. This is why reporting quickly matters — the sooner your bank files the return, the better the chance the money is still in the scammer's account.

Do I have to pay for fraudulent charges while the bank investigates?

No. If you report within 60 days, your bank must credit your account for the disputed amount while they investigate. You are not responsible for unauthorized transfers or charges. Do not let a bank representative tell you otherwise.

Can scammers access my bank account if I use the same password everywhere?

Yes. If your password is breached at one site, scammers will try it on your bank account. This is why using a unique password for your bank account is critical. Use a password manager to generate and store a strong, unique password that you never reuse.