Yes, scammers can take money directly from your savings account if they obtain your account number, routing number, or online login credentials

Scammers do not need your debit card or physical access to your bank. They need one of three things: your account and routing number (which appear on every check you write), your online banking username and password, or authorization to make a transfer that you unknowingly gave them. Once they have any of these, they can move money out through ACH transfers, wire transfers, or by setting up unauthorized bill pay.

The speed and ease depend on which method they use. An ACH transfer initiated by a scammer typically takes one to three business days to clear, giving you a narrow window to catch and stop it. A wire transfer moves within hours and is nearly impossible to reverse. Bill pay set up in your name can drain your account over weeks without you noticing each individual charge.

Your bank's fraud protections exist, but they are not automatic. You have to notice the theft, report it, and follow your bank's dispute process. The sooner you act, the better your odds of recovery.

Key Takeaways

  • Scammers can initiate ACH transfers or bill pay from your savings account using only your account number and routing number, which are printed on your checks.
  • Wire transfers and ACH transfers move money within hours to days, so checking your account regularly is your first line of defense.
  • You must report unauthorized transfers to your bank within 60 days of receiving your statement to preserve your right to dispute the charge.
  • Banks are required to refund fraudulent ACH transfers if you report them promptly, but wire transfers are harder to recover once they leave your account.
  • Scammers often obtain your banking information through phishing emails, fake websites, data breaches, or by posing as someone you trust.

How scammers get your account information

The most common route is phishing—a fake email or text that looks like it came from your bank, asking you to "verify" your account or "confirm" a suspicious login. The link takes you to a fake website that looks identical to your real bank's site. You enter your username and password, and the scammer now has both. From there, they log into your real account and transfer money out.

Another common source is data breaches at retailers, employers, or other companies where you have given your information. Your account number and routing number may also be exposed if you have paid a bill online or written a check to someone who then sells that information. Unlike a credit card number, these details are not considered secret—they are printed on every check—so scammers treat them as fair game.

Scammers also pose as trusted contacts: a family member in an emergency, a utility company threatening to shut off service, a government agency claiming you owe taxes. They build trust first, then ask you to send money or give them access to your account "to help" you.

The difference between ACH transfers, wire transfers, and bill pay

ACH transfers move money through the Automated Clearing House network, which processes transfers in batches. A scammer can initiate an ACH transfer out of your account using your account and routing number alone. The transfer typically takes one to three business days to complete. During that window, your bank may catch it as suspicious and block it, or you may notice it yourself and call to stop it before it clears.

Wire transfers move money directly between banks and clear within hours, often the same day. Once a wire leaves your account, it is nearly impossible to reverse. Your bank can attempt to recall it, but if the receiving bank has already released the funds, recovery is unlikely. Scammers prefer wire transfers for this reason.

Bill pay is a service your bank offers that lets you authorize payments to companies or people. A scammer who has access to your online banking can set up bill pay to themselves or an accomplice, often in small amounts that you might not notice immediately. These payments go out on a schedule you did not authorize, and each one is technically a transfer you "approved" (even though you did not), making disputes harder.

What to do if you notice unauthorized transfers

Stop and call your bank immediately. Do not wait until the end of the day or the next business day. Most banks have a fraud line that operates 24/7. Tell them the specific transfers you did not authorize, the dates, and the amounts. Ask them to freeze your account and cancel any bill pay you did not set up.

Your bank will likely issue you a new debit card and new online banking credentials. They may also place a temporary hold on your account while they investigate. This is normal and protects you.

Write down the name of the person you spoke to, the time you called, and what they told you. Ask them to send you a written confirmation of your dispute. This creates a record in case you need to escalate the claim later.

Your legal right to dispute and recover money

Under the Electronic Funds Transfer Act, you have the right to dispute unauthorized ACH transfers and other electronic transfers from your account. You must report the fraud within 60 days of receiving the bank statement that shows the unauthorized transfer. If you report within two business days of discovering the fraud, your liability is capped at $50. If you wait longer, your liability can go up to $500.

Your bank is required to investigate your dispute and refund the money if they determine the transfer was unauthorized. The investigation typically takes 10 business days, though your bank may provisionally credit your account while they investigate. Once they confirm the fraud, the credit becomes permanent.

Wire transfers are not covered by the same protections. If you authorized a wire transfer (even under false pretenses), the bank is not required to reverse it. Your only recourse is to contact the receiving bank and ask them to freeze the account where the money landed, then work with law enforcement. This is why scammers prefer wire transfers.

Steps to protect your savings account from unauthorized access

Use a strong, unique password for your online banking—one you do not use anywhere else. A password manager like Bitwarden or 1Password can generate and store these for you. Enable two-factor authentication (also called 2FA) on your bank account if your bank offers it. This means that even if a scammer has your password, they cannot log in without a code sent to your phone or email.

Do not share your account number, routing number, or online credentials with anyone, even if they claim to be from your bank. Your real bank will never ask for your password via email or phone. If you receive such a request, hang up or delete the email and call your bank directly using the number on the back of your debit card or on your statement.

Check your account at least weekly, ideally more often. Set up account alerts through your bank's app or website so you are notified of large transfers, new bill pay setups, or login attempts from new devices. The faster you spot fraud, the faster you can stop it.

Shred documents that contain your account number before throwing them away. Be cautious about who you give your checking account information to—you may need to provide it to set up direct deposit at work or to pay a bill, but avoid giving it to people or companies you do not trust.

What happens if your bank does not refund the money

If your bank denies your dispute claim, you have the right to escalate. Ask to speak to a supervisor or file a complaint with your bank's customer service department in writing. Keep copies of all correspondence.

You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can pressure them to reverse decisions. You can also contact your state's banking regulator or attorney general's office.

If the amount is large enough, you may want to consult a lawyer. Some attorneys offer free consultations and can advise you on whether you have grounds to sue your bank for negligence or breach of contract.

Frequently Asked Questions

Can a scammer drain my entire savings account?

Yes, if they have your account and routing number or your online login credentials. There is no daily limit on ACH transfers or bill pay initiated through your bank's system. A scammer could theoretically move your entire balance out in one transfer. This is why monitoring your account regularly and setting up alerts is critical.

What if the scammer used a fake check with my account number on it?

If someone deposited a fraudulent check drawn on your account, contact your bank immediately. Your bank will investigate and reverse the deposit. You are not liable for checks you did not write, even if your account number appears on them.

Do I lose my money if I do not report the fraud within 60 days?

Not necessarily, but your protections weaken. If you report within 60 days of your statement, the bank must refund you. If you report after 60 days, the bank may still investigate and refund you, but they are not legally required to. Always report as soon as you notice unauthorized transfers.

Can my bank refuse to refund me if I was tricked into sending money?

It depends on whether you authorized the transfer. If a scammer tricked you into wiring money or authorizing a transfer yourself, that is considered authorized fraud, and your bank may not refund it. If the scammer accessed your account without your knowledge and initiated transfers, that is unauthorized fraud, and your bank must refund it.

What if the scammer set up bill pay to themselves and I did not notice for months?

Report it immediately. Even if months have passed, your bank should investigate and refund the unauthorized bill pay transactions. The longer you wait, the harder it becomes to prove you did not authorize them, so act as soon as you discover it.