Yes, someone can steal money from your checking account — but not all theft works the same way

Money can leave your checking account without your permission through several routes: someone uses your debit card number, logs into your account with your password, sets up an unauthorized transfer, or convinces your bank to move funds. The speed of recovery and your liability depend entirely on which method was used and how quickly you report it. Some theft you catch in days; some takes weeks to reverse.

The good news is that federal law limits what you owe in most cases. The bad news is that the limit depends on when you notice and report the theft, and some methods of theft are harder to reverse than others.

Key Takeaways

  • Debit card fraud and unauthorized transfers are covered by federal law, but you must report them within specific timeframes to limit your liability.
  • If you report unauthorized charges within two business days, you typically owe no more than $50; after that window, liability can jump to $500 or more.
  • Account takeover — when someone logs in with your password — is treated differently than card fraud and may take longer to reverse.
  • Your bank can freeze your account during investigation, which means you may not have access to your own money while they work.
  • Reporting to your bank is the first step, but you may also need to file a police report and place a fraud alert with the credit bureaus.

How thieves actually access checking accounts

Debit card theft is the most common method. Someone obtains your card number — through a data breach, a skimmed ATM, a compromised online store, or a lost card — and makes purchases or withdrawals. You see these on your statement as charges you did not authorize.

Account takeover happens when someone logs into your online banking with your username and password. They may have gotten these through phishing (a fake email that looks like your bank), malware on your computer, or a password breach at another website where you used the same password. Once inside, they can transfer money out, change your contact information, or lock you out of your own account.

Unauthorized transfers occur when someone sets up a wire transfer or ACH transfer (a slower electronic transfer between banks) using your account information. They may have obtained this from a check you wrote, a bill payment you made, or straightforward by guessing your routing and account numbers. Unlike a debit card charge, these transfers move larger sums and are harder to reverse quickly.

Social engineering is when a thief calls your bank pretending to be you, provides enough personal information to pass verification, and asks the bank to transfer money or issue a new debit card. This is rare but devastating because your bank itself moves the money.

Your liability depends on when you report the theft

Federal law (Regulation E) limits your liability for unauthorized debit card transactions and transfers, but the limit changes based on timing. This is the single most important reason to check your account regularly.

If you report the theft within two business days of discovering it, you owe no more than $50. If you report it after two business days but within 60 calendar days of your statement being sent, you owe up to $500. If you wait more than 60 days after your statement arrives, you may owe the full amount stolen — the bank has no obligation to refund you.

This is why banks send statements: the clock starts when the statement is mailed or made available online, not when the theft occurred. If someone drains your account on day 1 of the month but you do not check your statement until day 45, you still have 15 days left in the 60-day window. If you do not notice until day 65, you have lost the protection.

Account takeover (when someone logs in with your password) is sometimes treated more leniently by banks, even though the law does not require it. Some banks will refund the full amount if you report it within 30 days. Check your account agreement or call your bank to ask what their policy is.

What happens when you report the theft

Call your bank when ready — do not email or use the app. Speak to a person. Tell them which transactions are unauthorized and provide the dates and amounts. The bank will freeze your account or issue a new debit card (or both) to stop further theft.

The bank will then open an investigation. During this time, your account may be locked, meaning you cannot withdraw money or use your debit card, even though the money is technically still there. This can last 10 business days for debit card fraud or up to 45 days for transfers. You will not have access to your own funds while they investigate.

Once the investigation closes, the bank will either refund the money (if they determine the transaction was unauthorized) or tell you they found it was authorized and you owe it. If they refund you, the money usually appears within one to three business days, though it can take longer for transfers.

Get the bank's case number and ask them to send you a written summary of the investigation. You will need this if you dispute the outcome or if the theft is part of a larger fraud pattern.

Transfers and wire fraud are harder to reverse

If someone set up an ACH transfer or wire transfer out of your account, recovery is slower and less certain than debit card fraud. Wires especially are nearly impossible to reverse once they leave your bank — the receiving bank has already credited the account, and if the money has been withdrawn, it is gone.

Your bank will still investigate and may refund you if they determine the transfer was unauthorized, but this can take 10 to 45 days. If the receiving bank is outside the United States, recovery becomes much harder and may require law enforcement involvement.

This is why many banks limit who can set up transfers and require additional verification (like a code sent to your phone) before a transfer goes through. If your account was compromised and transfers were made, ask your bank whether they can reverse them. If the receiving bank is known, law enforcement may be able to freeze those funds, but this requires a police report.

Steps to take after discovering unauthorized charges

First: Call your bank when ready. Have your account number and a list of unauthorized transactions ready. Ask them to freeze your account and issue a new debit card.

Second: File a police report. You can do this online in most jurisdictions or in person at your local police station. You need the report number for your bank's investigation and for credit reporting purposes. The police will not recover the money, but the report creates an official record.

Third: Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion). You only need to contact one; they will notify the others. This tells creditors to verify your identity before opening new accounts in your name. You can do this for free at annualcreditreport.com or by calling 1-888-298-2227.

Fourth: Monitor your account and credit report for the next 30 to 60 days. Check your statement weekly. If new unauthorized charges appear, report them when ready — each report restarts the clock on your liability window.

Fifth: If the theft involved your password or personal information, change your passwords on all accounts where you used the same or similar password. Use a password manager to create unique, strong passwords for each account.

What you cannot recover and what you can

If you reported the theft within the liability window, your bank must refund unauthorized debit card charges and most unauthorized transfers. You will not owe the money.

If you reported it late (after 60 days), the bank is not required to refund anything. Some banks will refund it anyway as a courtesy, but they are not legally obligated to. This is the biggest risk: missing the reporting window costs you the full amount.

If someone used your debit card at an ATM to withdraw cash, this is treated as a debit card transaction and covered by the same liability limits. If someone convinced your bank to wire money out by impersonating you, this is also covered, though it may take longer to reverse.

If you gave someone permission to use your account (a family member, a roommate, a contractor) and they took more than you authorized, this is not fraud in the legal sense — it is a civil dispute between you and that person. Your bank will not refund it. You would need to pursue the person in small claims court.

Frequently Asked Questions

How long does it take to get my money back?

Debit card fraud usually refunds within one to three business days after the investigation closes. Transfers can take 10 to 45 days. Wire transfers are the slowest and may take longer if the receiving bank is outside the U.S. Ask your bank for an estimated timeline when you report the theft.

Can my bank refuse to refund me if I reported it on time?

Your bank can refuse if they determine the transaction was actually authorized — for example, if you gave someone permission to use your card and they exceeded that permission. They must prove this in writing. If you disagree with their decision, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau.

What if the thief is someone I know?

If a family member or friend stole from you, it is still theft, and you can report it to your bank and police. However, your bank may be reluctant to refund if the person had legitimate access to your account (like a joint account holder). If the account is solely in your name, the bank should treat it as fraud regardless of who did it.

Do I need to close my account?

Not necessarily. Your bank will issue a new debit card and can freeze the old one. If you want to close the account, you can, but it is not required. Closing an account can affect your credit score slightly, so only do it if you no longer want the account or if you do not trust the bank's security.

What if my bank says the charges were authorized?

Ask them to explain in writing how they determined this. Request copies of the transaction details, IP addresses, and device information. If you did not make the transaction and did not authorize it, dispute their decision with your state banking regulator or file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov.