The most common ways someone steals from your checking account

Theft from a checking account usually happens in one of three ways: someone uses your debit card without permission, someone writes a check in your name, or someone transfers money out using your account number and routing number. The person doing this might be a stranger who found your information, someone you know, or a scammer you've never met. Each method leaves different traces, and your bank can help you recover the money if you catch it quickly.

The fastest way money leaves an account is through your debit card. If someone has your card number (from a store receipt, a data breach, or a stolen card itself), they can make purchases online or in person. The second method is check fraud — someone writes a check on your account without your permission. The third is ACH fraud, where a person uses your account number and routing number to pull money out electronically, often by setting up a fake bill payment or transfer.

A fourth method, less common but serious, is account takeover. This happens when someone gains access to your online banking login and password, usually through phishing (a fake email that looks like it's from your bank) or by buying your credentials from a data breach. Once inside, they can change your password, lock you out, and drain the account.

Key Takeaways

  • Debit card fraud, check fraud, and ACH fraud are the three most common ways money leaves a checking account without permission.
  • Your bank is required by federal law to refund unauthorized transactions if you report them within a specific timeframe — usually 60 days for debit card fraud.
  • Phishing emails and data breaches are how most scammers get your login information or card details in the first place.
  • Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) stops someone from opening new accounts in your name, even if they have your Social Security number.
  • Checking your account weekly and setting up transaction alerts means you catch fraud days after it happens, not months later.

What happens when you report unauthorized transactions

Federal law (the Electronic Funds Transfer Act) requires your bank to refund money taken from your account without your permission, but only if you report it in time. For debit card fraud, you have 60 days from the date your statement arrives. For ACH fraud and check fraud, the window is longer — usually up to one year, depending on your bank and the type of fraud.

When you report fraud, your bank will freeze the disputed amount while they investigate. This usually takes 10 business days. During that time, the bank contacts the merchant or the other bank involved to ask whether the transaction was legitimate. If the merchant can't prove you authorized it, the money goes back into your account. If your bank determines the fraud happened, they refund you in full and close the case.

The catch: if you wait too long to report it, your bank can deny the claim. If you don't check your statements regularly, you might miss the important date without realizing it. This is why setting up account alerts — notifications when money leaves your account — is one of the fastest ways to catch fraud.

How to protect your account from the start

The simplest protection is to check your account at least once a week. Log into your online banking or mobile app and scan the recent transactions. Most banks let you set up alerts that text or email you whenever a transaction over a certain amount goes through. You can also set alerts for any transaction at all, which catches fraud when ready.

For your debit card, use it only at places you trust. Online shopping is riskier than in-person because the merchant stores your card number. If you shop online frequently, ask your bank about a virtual card number — a temporary card number that works only once and expires after one transaction. Some banks offer this for free.

For your account number and routing number (the two pieces of information printed on the bottom of your checks), treat them like passwords. Don't write them on envelopes or give them to someone you don't know. If you pay bills by check, mail them from a post office mailbox, not your home mailbox — mail theft is real, and a stolen check is straightforward to forge.

Your online banking password should be long (at least 12 characters), use uppercase and lowercase letters, numbers, and symbols, and be different from passwords you use anywhere else. Never click a link in an email that claims to be from your bank — instead, go directly to your bank's website by typing the address yourself or calling the number on the back of your debit card.

What to do if your account is compromised right now

If you see a transaction you didn't make, call your bank when ready. Most banks have a fraud line open 24 hours. Tell them the transaction amount, the date, and the merchant name. Your bank will ask you to confirm recent legitimate transactions to prove you're the account holder, then they'll start the dispute process.

Ask your bank to cancel your debit card and issue a new one. The new card will have a different number, which stops the thief from using the old card again. Your bank will mail the new card to your address on file, usually within 5 to 10 business days.

If the fraud involved your online banking login, change your password when ready — use a computer or phone you know is find, not a shared device. If you suspect someone has your Social Security number or other personal information, place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place one for free by calling 1-888-298-6018 (Equifax), 1-888-378-4329 (Experian), or 1-888-909-8872 (TransUnion), or by visiting their websites.

The difference between fraud and a mistake

Not every unauthorized transaction is fraud. Sometimes a merchant charges twice by accident, or a subscription you forgot about keeps billing you. These are still unauthorized if you didn't approve them, and your bank can still refund them — but the process is different because there's no criminal involved.

If a merchant charged you twice, contact the merchant first. They can usually refund the duplicate charge within a few business days. If they won't, then contact your bank and dispute it. If a subscription is still charging you after you canceled it, ask the merchant for a refund, and if they refuse, dispute it with your bank.

The reason to try the merchant first is speed — a merchant refund is faster than a bank dispute, which can take weeks. But if the merchant doesn't respond or refuses, your bank's dispute process protects you.

Why data breaches happen and what they mean for you

A data breach is when a company's computer system is hacked and customer information is stolen. This might be your name, address, Social Security number, debit card number, or all of these. Breaches happen at retailers, banks, healthcare providers, and government agencies. You might not know your information was breached until months later, when the company discovers the hack and sends you a letter.

If your debit card number is stolen in a breach, the thief can use it to make purchases, but they can't access your actual account — they just have the card number. If your account number and routing number are stolen, they can set up unauthorized transfers or bill payments. If your Social Security number is stolen, someone could try to open a credit card or loan in your name.

When you receive a breach notification letter, read it carefully. It will tell you what information was stolen and what the company is doing about it. Many breaches include free credit monitoring for a year — a service that watches your credit report for suspicious activity. Take advantage of this. You should also place a fraud alert with the credit bureaus, as mentioned above.

Frequently Asked Questions

Can my bank force me to pay back money a thief stole?

No. Federal law requires your bank to refund unauthorized transactions if you report them within 60 days (for debit card fraud) or longer (for other types). The only exception is if you were negligent — for example, if you wrote your PIN on your debit card and someone stole it. Even then, your liability is limited to $50 if you report it within two business days.

What if the thief is someone I know?

The process is the same. Call your bank and report the transaction as unauthorized. Your bank doesn't care whether the thief is a stranger or a family member — they will still refund you. However, if the person is a household member or someone with authorized access to your account, your bank might ask questions. Be clear about what happened and when you discovered it.

How long does it take to get my money back?

Your bank must refund you within 10 business days if they determine the fraud happened. In practice, many banks refund faster — sometimes within 24 hours. During the investigation, the disputed amount is usually frozen, so you can't spend it, but you can still use the rest of your account.

Should I close my checking account after fraud?

Not necessarily. Closing the account doesn't help you recover the money faster, and it might hurt your banking history. Instead, get a new debit card, change your password, and monitor the account closely for 30 days. If fraud happens again, then consider closing it and opening a new account at a different bank.

What's the difference between a fraud alert and a credit freeze?

A fraud alert tells creditors to call you before opening new accounts in your name — it's free and lasts one year. A credit freeze locks your credit report so no one can open accounts without your permission — it's also free but takes longer to set up and remove. If you suspect identity theft, start with a fraud alert. If you want maximum protection, add a credit freeze.