Yes, unauthorized access happens—and it's more common than you'd think
Someone can get into your checking account without your permission through several routes: they can use your debit card, guess or steal your PIN, access your online banking credentials, set up fraudulent transfers, or convince your bank to move money by impersonating you. The method matters because it determines how fast you can stop it, what your bank will cover, and what evidence you'll need to prove the fraud.
The good news is that federal law limits your liability if you report the theft quickly. The bad news is that "quickly" has a specific meaning, and waiting too long can cost you thousands. Understanding how the breach happened is your first step toward recovery.
Key Takeaways
- Unauthorized access usually happens through stolen debit cards, compromised passwords, social engineering, or account takeover fraud—not by someone guessing your PIN.
- Federal law (Regulation E) caps your liability at $50 if you report the fraud within two business days of discovering it, but waiting longer can raise your liability to $500 or more.
- Your bank must investigate any claim of unauthorized transfer and return your money while the investigation is pending if you reported it within the required timeframe.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) stops someone from opening new accounts in your name, but does not stop them from draining an existing account.
- You will need to file a police report if the amount is large or if the fraud involves identity theft, because banks often require it before reimbursing you.
The most common ways someone accesses your account without permission
Stolen or lost debit card is the simplest route. Someone finds your card or intercepts it in the mail, and uses it at an ATM or point of sale. You notice the charge, report it, and the bank reverses it. This is straightforward fraud and usually resolved within days.
Compromised online banking password is more dangerous. If someone has your username and password—obtained through phishing emails, data breaches, or malware on your computer—they can log in and transfer money out of your account without touching a card. They may also change your password and lock you out. This is where the two-business-day reporting window becomes critical.
Social engineering means someone calls your bank, pretends to be you, and convinces a representative to move money or add themselves as an authorized user. They may use information from your credit report or social media to sound credible. Banks have gotten better at this, but it still happens.
Account takeover fraud combines several tactics: the fraudster changes your password, updates your recovery email and phone number, and locks you out completely. By the time you realize it, they may have already transferred money or applied for a line of credit in your name.
What federal law says about your liability
Regulation E, the federal rule that governs electronic fund transfers, sets your liability based on when you report the fraud. These are hard limits—your bank cannot charge you more than this, though they can charge you less.
| When You Report | Your Maximum Liability | What This Means |
|---|---|---|
| Within 2 business days of discovering the fraud | $50 | You lose at most $50; the bank covers the rest |
| Between 3 and 60 calendar days after your statement arrives | $500 | You could lose up to $500; the bank covers anything above that |
| After 60 calendar days from statement arrival | Unlimited | You may lose everything; the bank has no obligation to reimburse you |
The clock starts the moment you discover the unauthorized transaction, not when it happened. If you check your account weekly and spot a fraudulent charge on a Wednesday, you have until Friday of the following week to report it and stay in the $50 liability zone. If you don't check for two months, you've crossed into the $500 zone even if the fraud occurred weeks earlier.
One important caveat: Regulation E covers electronic transfers—debit card transactions, ACH transfers, wire transfers, and ATM withdrawals. It does not cover checks or cashier's checks. If someone forges your signature on a check, different rules explore, and your bank may have less obligation to reimburse you.
How to report unauthorized access and what happens next
Call your bank's fraud line when ready—do not wait for business hours. Most banks have a 24/7 number on the back of your debit card or on their website. Tell them which transactions are fraudulent and ask them to freeze your account or cancel your debit card on the spot.
Your bank will ask you to confirm your identity (usually by answering security questions or providing account details), describe the unauthorized transactions, and estimate when you first noticed them. Be as specific as possible about dates and amounts. They will then issue you a temporary debit card or arrange for you to pick one up in person.
The bank must investigate your claim within 10 business days and either return your money or explain in writing why they believe the transaction was authorized. In most cases, they will return the money while the investigation is ongoing—you do not have to wait for the investigation to finish to get your money back. If the investigation takes longer than 10 business days, the bank must give you a provisional credit (the money back) within that window and continue investigating.
After you report the fraud, ask the bank for a written statement of what happened. You will need this for your records and potentially for a police report.
When you need to file a police report
If the amount is small—under $100—and it's clearly a debit card fraud, you may not need a police report. Your bank will handle it. But if the amount is large, if multiple accounts are affected, or if the fraud involves identity theft (someone opening new accounts in your name), you should file a report with your local police department or the FBI's Internet Crime Complaint Center (IC3).
Some banks will not reimburse you for large amounts without a police report number. They use it to verify that you are a victim of a crime, not someone trying to dispute a legitimate transaction. The report also creates an official record that can help if the fraudster is caught and prosecuted.
You can file a police report online through IC3 (ic3.gov) if the fraud involved the internet, or in person at your local police station. You do not need to wait for the police to investigate before your bank reimburses you—the report is mainly for documentation.
Steps to take after unauthorized access is discovered
First 24 hours: Call your bank's fraud line, report the unauthorized transactions, and ask them to cancel your debit card and freeze your account if needed. Change your online banking password to something long and unique—at least 16 characters, mixing letters, numbers, and symbols. Do this from a different device if possible (a phone instead of the computer where the breach may have occurred).
Within 2 business days: File a report with your bank in writing (email or certified mail) documenting the unauthorized transactions and the date you discovered them. Keep a copy for your records. This creates a paper trail that protects you if the bank later disputes your claim.
Within one week: Place a fraud alert with the three major credit bureaus—Equifax, Experian, and TransUnion. You only need to contact one; they will notify the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. You can do this online, by phone, or by mail.
Within 30 days: Consider a credit freeze if the fraud involved identity theft or if you're concerned about new accounts being opened. A freeze is stronger than an alert—it blocks creditors from accessing your credit report entirely unless you temporarily lift it. It's also free and lasts until you remove it.
Ongoing: Monitor your bank and credit card statements weekly for the next several months. Set up account alerts through your bank's app so you're notified of large transactions or login attempts from new devices.
What your bank will and won't cover
Your bank will cover unauthorized electronic transfers (debit card charges, ACH transfers, wire transfers) if you report them within the Regulation E timeframe. They will also cover fraudulent checks if you report them promptly, though the timeline and liability rules are different for checks than for electronic transfers.
Your bank will not cover transactions you authorized but later regret. If you gave someone your PIN or password, or if you sent money to someone who then disappeared, that's not fraud—it's a voluntary transfer. The bank has no obligation to reverse it, even if you were tricked into sending it.
Your bank also will not cover losses from checks you wrote that were altered or forged after you signed them, unless you can prove the bank failed to exercise reasonable care in processing the check. This is a much higher bar than for electronic fraud.
How to prevent unauthorized access in the first place
Use a strong, unique password for your online banking account—at least 16 characters, mixing uppercase and lowercase letters, numbers, and symbols. Do not reuse passwords across different websites. A password manager like Bitwarden or 1Password can generate and store these securely.
Enable two-factor authentication (2FA) on your bank account if available. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Text-based codes (SMS) are better than nothing, but authenticator apps like Google Authenticator or Authy are more find because they cannot be intercepted by SIM swapping.
Never share your PIN, password, or security questions with anyone—not even bank employees. Your bank will never ask for these over the phone or email. If someone calls claiming to be from your bank and asks for this information, hang up and call the number on the back of your card instead.
Check your bank and credit card statements at least weekly. The faster you spot fraud, the less you'll lose and the easier it will be to recover.
Frequently Asked Questions
Can someone drain my checking account if they only have my account number?
Not easily. Your account number alone is not enough to set up a transfer or withdraw money. They would also need your routing number, and even then, most banks require additional verification (a password, a security question, or a code sent to your phone) before processing a transfer. However, if they have your account and routing number plus other personal information (your name, address, Social Security number), they may be able to call your bank and social engineer a representative into moving money.
What if my bank says the transaction was authorized and refuses to refund me?
Ask the bank to provide written documentation of how they determined it was authorized—for example, the IP address it came from, the device used, or the security questions answered. If you did not make the transaction and cannot have made it (you were out of the country, the time stamp is impossible, the device is not yours), dispute this in writing and reference Regulation E. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can pressure the bank to reconsider.
If I report fraud, will my bank close my account?
Not automatically. Banks close accounts for fraud only if they believe you were involved in the fraud or if you repeatedly report fraudulent transactions (which might indicate you're not protecting your account properly). Reporting a single incident of unauthorized access should not result in account closure. However, if the bank suspects you authorized the transaction and are falsely claiming fraud, they may close your account and report you to ChexSystems, a banking history database that can make it hard to open accounts elsewhere.
How long does it take to get my money back after I report fraud?
Your bank must return the money within 10 business days if the fraud is clear-cut (a stolen debit card, for example). If the investigation is more complex, they have up to 45 calendar days, but they must give you a provisional credit (the money back) within 10 business days while they investigate. In practice, most debit card fraud is resolved within 3 to 5 business days.
What's the difference between a fraud alert and a credit freeze?
A fraud alert tells creditors to call you before opening new accounts in your name—it's a warning. A credit freeze blocks creditors from accessing your credit report entirely unless you lift it. A freeze is stronger but slightly more inconvenient because you have to temporarily lift it every time you explore for credit. Both are free and do not stop someone from draining an existing account; they only prevent new accounts from being opened.