Yes, someone can steal your checking account, but banks have legal responsibility to protect you

Your checking account can be stolen in several ways: someone obtains your account number and routing number, uses your debit card without permission, gains access to your online banking login, or commits identity theft to open a fake account in your name. The good news is that federal law limits your liability for unauthorized transactions, and your bank is required to investigate and often reimburse you.

The amount you owe depends on how quickly you report the theft and what type of theft occurred. If you report unauthorized debit card charges within two business days, you typically owe no more than $50. If you wait longer, your liability can grow. For unauthorized transfers from your account, the rules are stricter — you may owe up to $500 if you don't report within 60 days of your statement.

Banks also have their own fraud detection systems that catch suspicious activity before you do. Most will freeze your account, contact you, or block a transaction if something looks wrong. Understanding how theft happens and what protects you helps you spot problems early and know what to do if they occur.

Key Takeaways

  • Federal law limits your liability for unauthorized transactions to $50 if you report within two business days, but waiting longer can increase what you owe.
  • Someone can steal your account using your debit card, account number, online login, or by opening a fraudulent account in your name.
  • Your bank is required by law to investigate unauthorized transactions and often reimburses you even if you wait to report.
  • Monitoring your account regularly and reporting suspicious activity within 60 days protects you from the highest liability limits.
  • Freezing your credit and placing a fraud alert with credit bureaus stops thieves from opening new accounts in your name.

The most common ways someone steals a checking account

Debit card theft is the simplest form. Someone physically steals your card, finds it, or uses the card number without the physical card present. They make purchases or withdraw cash. You notice the unauthorized charge on your statement or receive a notification from your bank.

Account number and routing number theft happens when someone obtains these two pieces of information — often from a check you wrote, a bill payment, or a data breach. They can then set up unauthorized transfers out of your account or create fraudulent checks. This type of theft is harder to spot because there is no card involved.

Online banking theft occurs when someone gains your username and password, usually through phishing emails, malware on your computer, or password reuse from another breached website. Once inside, they can transfer money, change your contact information, or lock you out of your own account.

Identity theft is when someone uses your personal information — name, Social Security number, date of birth — to open a completely new checking account in your name. They then use that account to receive fraudulent deposits or write bad checks. You may not discover this for months.

What federal law says about your liability

The Electronic Funds Transfer Act (EFTA) is the federal law that protects you. It sets limits on how much you can lose if someone steals your debit card or uses your account number without permission. The amount depends on when you report the theft.

If you report unauthorized debit card charges or transfers within two business days of discovering them, you owe no more than $50. This is the strongest protection. If you wait between two and 60 days, your liability jumps to $500. If you wait longer than 60 days from when your statement was sent to you, you could owe the full amount stolen — there is no cap.

This timeline is strict. "Two business days" means the next two days your bank is open, not including weekends or holidays. If you discover fraud on a Friday evening, you have until Tuesday to report it and keep your liability at $50. Many banks offer faster reporting through their apps or phone lines, so you can report outside business hours.

Your bank can also choose to give you more protection than the law requires. Some banks reimburse all unauthorized transactions regardless of when you report, or they waive the $50 fee entirely. Check your account agreement or call your bank to learn what they offer.

How banks detect and stop theft before you notice

Most banks use automated fraud detection systems that watch for suspicious patterns. These systems flag transactions that don't match your normal spending — a $3,000 purchase when you usually spend $200, a withdrawal from a city you've never visited, or multiple transactions in a short time from different locations.

When the system detects something unusual, the bank may contact you by phone, text, or email to confirm the transaction is legitimate. You'll be asked to verify details like the merchant name, amount, or location. If you say no, the bank blocks the transaction and may freeze your card or account temporarily.

Banks also monitor for account takeover — when someone logs into your online banking and changes your password or contact information. If the system detects a login from an unusual location or device, it may require you to answer security questions or send a verification code to your phone before allowing access.

These systems aren't perfect. Some fraud slips through, and some legitimate transactions get blocked by mistake. That's why monitoring your own account remains important — you know your spending better than any algorithm.

Steps to take if you discover unauthorized transactions

The moment you notice a transaction you didn't make, contact your bank. Don't wait to see if it resolves itself or if more charges appear. Call the phone number on the back of your debit card or log into your online banking to find the fraud reporting number. Many banks have 24/7 fraud lines.

Tell the bank the specific transaction: the date, amount, and merchant. Be clear about what you did and didn't authorize. The bank will ask questions to confirm you are the account holder. They may freeze your account or cancel your debit card when ready to stop further theft.

Ask the bank to send you a written confirmation of your report. This creates a record with a date and time stamp. The bank is required to investigate within 10 business days and tell you the results. If they find the transaction was unauthorized, they must credit your account.

While the investigation is happening, you can still use your account — the bank will usually issue a temporary debit card or allow transfers. If your account was compromised, change your online banking password when ready. Use a password that is at least 12 characters long and includes numbers, uppercase letters, and symbols.

Protecting yourself from account theft

Check your account at least once a week, either through your bank's app or website. Look for transactions you don't recognize, even small ones. Thieves sometimes make tiny charges first to test whether the account is being monitored before stealing larger amounts.

Set up account alerts through your bank. Most banks let you receive a text or email whenever a transaction over a certain amount occurs, or whenever your balance drops below a threshold. These alerts give you early warning of theft.

Never share your account number, routing number, or online banking password with anyone — not even someone claiming to be from your bank. Your bank will never ask for your password. If someone calls claiming to be from your bank and asks for sensitive information, hang up and call the number on your debit card.

Use a strong, unique password for online banking. Don't reuse passwords from other websites. If another website is breached, thieves will try that same password on your bank account. Consider using a password manager to generate and store complex passwords.

If you believe your identity has been stolen — not just your account, but your personal information — place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. You can do this for free by calling one bureau and asking them to notify the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name.

What happens during a bank investigation

When you report fraud, your bank opens an investigation. They pull transaction records, check the merchant's records, and review your account activity around the time of the unauthorized transaction. They also verify your identity and confirm you didn't authorize the charge.

The investigation usually takes 10 business days, though complex cases can take up to 45 days. During this time, the bank may place a temporary hold on your account or the disputed amount. You can still use your account and make deposits, but the bank is protecting itself in case the investigation finds the transaction was actually authorized.

Once the investigation is complete, the bank sends you a written explanation of the results. If they find the transaction was unauthorized, they credit your account for the full amount plus any fees charged because of the theft (like overdraft fees). If they find the transaction was authorized, they explain why and you remain liable.

If you disagree with the bank's decision, you have the right to dispute it in writing. Send a letter to the address on your statement explaining why you believe the transaction was unauthorized. The bank must respond within 30 days.

Frequently Asked Questions

Can someone use just my account number to steal money?

Yes. With your account number and routing number, someone can set up unauthorized transfers or create fraudulent checks. They don't need your debit card. This is why you should be careful sharing these numbers — only give them to people and organizations you trust, like your employer for direct deposit.

What if my bank says the transaction was authorized and I disagree?

You have the right to dispute the bank's decision in writing within 60 days of receiving their investigation results. Send a letter to the address on your statement explaining why you believe the charge was unauthorized. The bank must respond and may reverse their decision if you provide new evidence.

Do I have to pay my bills while my account is frozen due to fraud?

Your bank should allow you to make deposits and essential transactions during an investigation, even if your account is partially frozen. Contact your bank and explain your situation. They can often issue a temporary card or allow specific transfers while they investigate.

If someone opens a checking account in my name, am I responsible for the debt?

No. If someone opens an account using your identity without permission, that is identity theft, not account theft. You are not responsible for any charges or overdrafts on that account. Report it to your bank, the police, and the credit bureaus when ready. Place a fraud alert to prevent further accounts from being opened.

How long does it take to get my money back after fraud is confirmed?

Once the bank confirms the transaction was unauthorized, they must credit your account within one to three business days. Some banks credit you when ready while the investigation is ongoing, especially for debit card fraud. Check your account agreement or call your bank to learn their specific timeline.