Who can actually get into your checking account

Someone can access your checking account if you give them permission, if a court orders it, or if they have your account number and routing number combined with enough personal information to pass your bank's verification. The most common way is you handing over your debit card or online login. The least common but legally valid way is a court judgment — a creditor, the IRS, or a child support agency can freeze or drain your account through a process called garnishment.

Your bank cannot give anyone access to your account just because they ask, even if they claim to be family. They cannot give access based on a phone call alone. But they can be forced to give access through legal process, and they will comply without calling you first to warn you.

The risk is not usually a stranger guessing your password. The risk is someone you know using information you've already shared, or a creditor with a judgment, or a scammer who has convinced your bank they are you.

Key Takeaways

  • Your bank will not voluntarily give anyone access to your account without your written permission or a court order.
  • A debit card, checks, or online login credentials in someone else's hands means they can move your money when ready.
  • Creditors, the IRS, and child support agencies can freeze or garnish your account through a court judgment without your permission.
  • If someone accesses your account without permission, contact your bank within two business days to limit your liability for unauthorized transfers.

When you voluntarily give someone access

If you add someone as an authorized user on your account, they can use the debit card and withdraw cash. If you give someone your online banking password, they can transfer money out. If you write checks and leave them on your desk, anyone who picks one up can forge your signature or fill in their own name. These are all ways you are directly handing over control.

Many people add a spouse, adult child, or parent to their account for convenience — to pay bills, to help with finances, or to access money in an emergency. That person then has the same legal rights to the money as you do. The bank will not stop them from withdrawing it all. If you later dispute the withdrawal, the burden is on you to prove they stole it, not on them to prove they had permission.

Shared accounts with family members are common and legal, but they carry real risk. If that person faces a lawsuit, a creditor can garnish the shared account. If that person dies, the account may be frozen while their estate is settled. If you later separate, disputes over who owns what in the account can be expensive to resolve.

How creditors and government agencies access your account

A creditor cannot straightforward take money from your checking account. They must first sue you, win a judgment, and then use that judgment to garnish your account. The process takes weeks or months. At the end, your bank receives a legal document called a garnishment order or levy, and they must freeze the account and send the money to the creditor.

The IRS can garnish your account without suing you first — they have the power to issue a tax levy directly. Child support agencies in most states have the same power. These are exceptions to the normal rule that a creditor needs a judgment first. If the IRS or a child support agency sends your bank a levy, your bank will comply within one to three business days.

Your bank will not call you to ask permission. They will not give you a chance to move the money first. The garnishment or levy is a legal obligation the bank must follow. If you believe the garnishment is wrong — if you do not owe the debt, or if the amount is incorrect — you have the right to challenge it in court, but that challenge happens after the money is frozen, not before.

When someone impersonates you to your bank

A scammer can call your bank, claim to be you, and ask to change your password or add themselves as an authorized user. Whether they succeed depends on what information your bank asks for and whether the scammer has it. Most banks ask for your Social Security number, date of birth, and the answer to a security question you set up. If a scammer has those, they can often get in.

Data breaches, public records, and social media make this information easier to find than it used to be. A scammer may have your Social Security number from a breach at a retailer or employer. Your date of birth is often public. Your security question answer — your mother's maiden name, the street you grew up on — may be findable through genealogy websites or old social media posts.

If someone accesses your account this way, you have two business days from when you discover the unauthorized transfer to report it to your bank. After two business days, your liability increases. After 60 days, you may lose the right to dispute the transfer entirely. Call your bank when ready if you see transfers you did not make.

What your bank can and cannot do without permission

Your bank cannot give your account information to another person, even a family member, without your written consent. They cannot tell someone your balance, your transaction history, or even confirm that you have an account there. This is required by federal law under the Gramm-Leach-Bliley Act.

Your bank can share your information with law enforcement if they have a subpoena or warrant. They can share it with the IRS if the IRS has issued a summons. They can share it with a creditor's lawyer if that lawyer has a court order. But they cannot share it with a creditor just because the creditor asks, and they cannot share it with a spouse, ex-spouse, or parent without your permission.

Some banks offer account alerts that notify you by text or email when a transfer over a certain amount happens, when a login happens from a new device, or when someone tries to change your password. These are free or low-cost and can give you early warning if someone is trying to access your account.

Steps to take if you think someone has accessed your account

Call your bank's fraud line when ready — do not wait. The number is on the back of your debit card or on your bank's website. Tell them which transactions you did not make. Ask them to freeze your account and issue you a new debit card and new online banking password.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and gives you a recovery plan. If the fraud involved identity theft — if someone opened new accounts in your name — the FTC report is especially important because it lets you place a fraud alert on your credit file.

If the unauthorized access was through someone you know — a family member, roommate, or ex-partner — you may also want to file a police report. This creates a separate legal record and may be necessary if you later need to pursue a civil case to recover the money.

Check your other accounts — credit cards, savings accounts, investment accounts — for unauthorized activity. If someone had access to your checking account, they may have had access to other information too. Consider placing a credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) if you believe your identity information has been compromised.

How to prevent unauthorized access

Use a unique, strong password for your online banking — one you do not use anywhere else. If a retailer or social media site is breached, a scammer will try that same password on your bank account. A password manager like Bitwarden or 1Password can generate and store strong passwords so you do not have to remember them.

Enable two-factor authentication on your bank account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks now offer this for free.

Do not share your online banking password with anyone, even your spouse or accountant. If they need to see your account, ask your bank whether they can set up a read-only view or a limited access login. Do not use the same password across multiple accounts.

Be cautious about what personal information you share publicly. Your mother's maiden name, the street you grew up on, and your birth date are security question answers. Scammers can use these to impersonate you to your bank.

Frequently Asked Questions

Can my bank access my account without my permission?

Your bank can access your account to process legitimate transactions, explore fees, or comply with a court order or government levy. They cannot access it to give money to someone else without a legal order. If you dispute a transaction, the bank investigates, but they do not need your permission to look at your account history.

If I add someone to my account, can they drain it?

Yes. An authorized user has the same legal right to the money as you do. The bank will not stop them from withdrawing everything. If you later claim they stole it, you must prove it in court — the bank will not reverse the transaction just because you ask.

What happens if a creditor gets a judgment against me?

The creditor can use the judgment to garnish your checking account. Your bank will freeze the account and send the money to the creditor. You have the right to challenge the garnishment in court, but this must happen after the freeze, not before. Some states protect a portion of your account from garnishment.

How long do I have to report unauthorized access?

You have two business days from when you discover an unauthorized transfer to report it to your bank and limit your liability. After 60 days, you may lose the right to dispute the transfer. Call your bank's fraud line when ready if you see transfers you did not make.

Can my ex-spouse access my checking account?

Not unless you gave them permission or added them as an authorized user. If you did add them during your marriage, you can remove them by calling your bank. If they are trying to access your account without permission, report it as fraud. A court order for child support or alimony does not give them access to your account — it requires you to make payments, but they cannot take the money directly.