Yes, money can be stolen from your checking or savings account, and it happens through several routes

Thieves can drain a checking or savings account without your permission through unauthorized transfers, fraudulent checks, debit card fraud, ACH debits, or wire transfers. The theft can happen in hours or days once someone has your account number, routing number, or online login credentials. Your bank account is a direct pipeline to your money—unlike a credit card, which creates a debt the bank has to pursue—so criminals prioritize it.

The good news: federal law limits your liability, and your bank has a legal obligation to investigate and often to restore the money. The bad news: the speed of recovery depends on how quickly you report it, what method the thief used, and whether your bank can prove the transaction was unauthorized. Some stolen funds come back in days; others take weeks or months.

Key Takeaways

  • Federal law caps your liability at $50 if you report unauthorized transactions within two business days, and at $500 if you report within 60 days of your statement.
  • Thieves most often steal from checking accounts using ACH debits (automatic payments), fraudulent checks, or debit card numbers—not by hacking the bank itself.
  • You must report the theft to your bank in writing within 60 days of the statement showing the unauthorized transaction, or you may lose all protection.
  • Your bank must investigate within 10 business days and either restore the money or explain why they believe the transaction was authorized.
  • Wire transfers and transfers to another bank account are harder to recover because the money leaves the banking system faster.

The most common ways money disappears from your account

ACH debits are the leading theft method. An ACH (Automated Clearing House) debit is an automatic payment pulled from your account—the same system used for payroll deposits and utility bills. If a thief has your account number and routing number, they can set up an ACH debit in your name without your permission. The transaction clears in one to two business days, and by then the money is gone. You might not see it until your next statement or a balance check.

Fraudulent checks are slower but still common. A thief writes a check on your account using a stolen checkbook or a forged check with your account number. The check clears when the recipient deposits it, which can take several days. If you do not monitor your account closely, you might not notice until the check has already cleared.

Debit card fraud happens when a thief uses your card number (stolen online, from a data breach, or skimmed from a card reader) to make purchases or withdraw cash. Unlike credit card fraud, the money comes directly out of your account. If the thief uses your physical card at an ATM, they can drain cash instantly.

Wire transfers and transfers to another bank move money out of your account and into someone else's bank within hours. Once the money reaches another bank, it is much harder to recover because it has left your bank's control. Wire fraud and account takeover often use this method because the speed makes it difficult to stop.

How quickly you need to report it to stay protected

Federal law (Regulation E) requires you to report unauthorized transactions within a specific window, or you lose protection. The timeline is strict, and missing the deadline can cost you thousands.

Within two business days: If you report the theft within two business days of discovering it, your liability is capped at $50. This is the strongest protection. "Business days" means Monday through Friday, excluding federal holidays. If you discover the theft on a Friday evening, you have until the end of business on Monday to report it.

Within 60 days: If you report between day three and day 60, your liability rises to $500. Your bank must still investigate, but you are responsible for more of the loss. The 60-day clock starts from when your bank sends you the statement showing the unauthorized transaction—not from when the theft occurred.

After 60 days: If you do not report the theft within 60 days of receiving the statement, you lose all federal protection. You are liable for the entire amount, and your bank has no legal obligation to restore it. Some banks may still help you, but they are not required to.

Report the theft in writing—email, phone call, or in-person at a branch. Written documentation is stronger because it creates a record with a timestamp. Include the date you discovered the theft, the amount, the transaction type, and your account number.

What your bank must do after you report it

Once you report unauthorized transactions, your bank is required by federal law to investigate. The process has specific steps and timelines.

Provisional credit (within one to three business days): Many banks will credit your account provisionally while they investigate—meaning the money goes back into your account temporarily. This is not a final decision; it is a courtesy to keep you from being short on funds while the investigation happens. If the bank later determines the transaction was authorized, they can take the provisional credit back.

Investigation (within 10 business days): Your bank must complete its investigation and either confirm the transaction was unauthorized or explain why they believe it was authorized. They will review the transaction details, check for signs of fraud, and contact the other bank or merchant if needed. If the theft involved an ACH debit, they may be able to reverse it quickly. If it involved a wire transfer, recovery is slower because the money has already left the banking system.

Final decision (by day 10 or within 45 days): The bank must tell you the outcome in writing. If they find the transaction was unauthorized, they must restore the full amount (minus any provisional credit already given). If they believe the transaction was authorized, they must explain their reasoning. You have the right to dispute their decision and ask for a second review.

If your bank drags out the investigation or refuses to investigate, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. These agencies can force the bank to comply with the law.

What makes recovery harder or slower

Wire transfers: Once a wire leaves your bank, it is in another bank's system. Your bank can ask the receiving bank to return it, but they are not legally required to comply. If the receiving bank has already released the money to the thief, recovery becomes a civil matter—you may have to sue to get it back. Wire fraud is one of the hardest theft types to reverse.

Transfers to another account at the same bank: If the thief transferred money to another account at your bank, recovery is faster because the money is still in the bank's system. Your bank can freeze the receiving account and reverse the transfer within days.

Transfers to another bank: If the thief moved money to an account at a different bank, your bank must contact the receiving bank and ask them to freeze and return the funds. The receiving bank is not required to comply immediately, and the process can take one to two weeks. If the receiving bank has already released the money, recovery is unlikely.

Delays in reporting: The longer you wait to report the theft, the harder it is for your bank to reverse it. Transactions that cleared days or weeks ago are harder to undo than transactions still pending. If you report after 60 days, you have no federal protection at all.

Lack of documentation: If you cannot provide your bank with clear details—the date, amount, transaction type, and any merchant or recipient information—the investigation takes longer. Keep screenshots of your account activity and any suspicious emails or texts.

Steps to take immediately after discovering the theft

Step 1: Call your bank right away. Use the phone number on the back of your debit card or on your bank statement—not a number from an email or text, which could be fake. Tell them you have unauthorized transactions on your account and ask them to freeze your account and debit card immediately. This stops the thief from making more withdrawals while you report.

Step 2: Report the theft in writing within 60 days. Send an email or letter to your bank's fraud department with the date you discovered the theft, the amount stolen, the transaction type, and your account number. Keep a copy for your records. This creates a paper trail that protects you under federal law.

Step 3: Request a new debit card and account number. Ask your bank to issue a new debit card and, if possible, a new account number. This prevents the thief from using the old card or account number again. Your bank may charge a small fee for a new account number, but it is worth it for security.

Step 4: Review your account activity for the past 60 to 90 days. Look for other unauthorized transactions you might have missed. Thieves often test small amounts first before stealing larger sums. Report all unauthorized transactions, not just the largest one.

Step 5: Check your credit report. Go to annualcreditreport.com (the only free, official source) and request your credit report from all three bureaus: Equifax, Experian, and TransUnion. Look for accounts or inquiries you did not open. If you find fraud, place a fraud alert or credit freeze on your file.

Step 6: File a report with the FTC. Go to reportfraud.ftc.gov and file a report about the identity theft or account fraud. The FTC does not investigate individual cases, but the report creates an official record and gives you a recovery plan. You can use this report if you need to dispute fraudulent accounts on your credit report.

How to reduce the risk of account theft

No method is 100 percent foolproof, but these steps make your account a harder target.

Monitor your account weekly. Check your balance and recent transactions at least once a week, not just when you receive a statement. Many banks offer free alerts for large transactions or low balances. Set these up and check your email or text regularly.

Use a strong, unique password for online banking. Your password should be at least 12 characters, include uppercase and lowercase letters, numbers, and symbols, and be different from passwords you use elsewhere. Use a password manager like Bitwarden or 1Password to store and generate passwords.

Enable multi-factor authentication (MFA). Most banks now offer MFA, which requires a second form of verification (a code sent to your phone, a fingerprint, or a security key) when you log in. This stops thieves from accessing your account even if they have your password.

Do not share your account number or routing number with anyone you do not trust. Scammers pose as bank employees or government agencies to trick you into giving these numbers. Your bank will never ask for this information via email or phone.

Shred paper statements and checks. If you still receive paper statements, shred them before throwing them away. A thief can use a discarded statement to get your account number and routing number.

Be cautious with ACH debits. Before authorizing an ACH debit (for a utility bill, subscription, or loan payment), verify the company's identity and the amount. Scammers sometimes pose as legitimate companies to set up fraudulent debits.

Frequently Asked Questions

Can a bank refuse to refund stolen money?

A bank can refuse to refund money if they believe the transaction was authorized by you, even if you claim you did not make it. However, they must investigate your claim and explain their reasoning in writing. If you reported within 60 days, federal law requires them to either refund you or prove the transaction was authorized. If they cannot prove it, they must refund the money.

What if the thief used my account number to set up an ACH debit?

ACH debits are reversible if you report them as unauthorized. Your bank can issue a reversal (called a "return") within one to two business days, and the money comes back to your account. The receiving company may dispute the reversal, but your bank will defend it if you reported the theft on time. Keep documentation of your report.

How long does it take to get stolen money back?

If you report within two business days and the theft was an ACH debit or debit card transaction, your bank may restore the money within three to five business days. Wire transfers and transfers to other banks take longer—often one to two weeks—because the money has to be recalled from another bank. Some banks take the full 10 business days allowed by law to investigate before restoring funds.

Do I have to pay overdraft fees if a thief drains my account?

If the theft causes your account to go negative and you incur overdraft fees, ask your bank to waive them. Many banks will remove overdraft fees related to fraud once the theft is confirmed. If your bank refuses, file a complaint with the CFPB or your state banking regulator.

What if my bank says the transaction was authorized because I gave out my account number?

Giving out your account number does not automatically mean you authorized a specific transaction. If you gave your number to a company for a legitimate purpose (like paying a bill) and they charged you for something you did not request, that is still unauthorized. Report it to your bank and explain the context. Your bank must investigate whether the charge matched what you authorized.