The short answer: not legally, but the real risk is people you already trust
No one can legally access your bank account without your permission—not a stranger, not a family member, not even someone with your Social Security number. Banks are required by federal law to authenticate you before allowing withdrawals, transfers, or account changes. But the practical risk is different from the legal one. The people most likely to take money from your account are people you have already given access to: joint account holders, authorized users, or people who know your password because you told them or wrote it down.
Fraud does happen—through phishing, malware, stolen credentials, or social engineering—but it leaves a trail. Your bank can see when and where a transaction occurred, who initiated it, and whether it matches your normal behavior. That trail is how you recover the money. The harder problem is distinguishing between theft and a legitimate dispute with someone you know.
Key Takeaways
- Joint account holders and authorized users can withdraw money legally without asking you first, because you gave them that power when you added them to the account.
- Fraud through stolen passwords or hacked accounts is traceable—your bank can see the IP address, device, and time of the transaction, which helps prove it was not you.
- If someone you know takes money without permission, it is a civil or criminal matter depending on the amount and your relationship, not a banking problem the bank can reverse on its own.
- Protecting your account means controlling who has access (passwords, cards, authorized users) and monitoring statements monthly for transactions you do not recognize.
- If your account is compromised, contact your bank when ready and file a dispute; federal law limits your liability to $50 if you report within 60 days of the statement.
Who has legal access to your account right now
Anyone you have explicitly added to your account can access it without asking you. This includes joint account holders (who own the account equally with you), authorized users (who can use the account but do not own it), and anyone you have given a debit card, checkbook, or online login credentials to. These are not security breaches—they are permissions you granted.
The bank will not stop a joint account holder from withdrawing all the money, because legally they own half of it. The bank will not block an authorized user from making a purchase, because you authorized them. If a dispute arises between you and someone with legitimate access, that is a personal or legal matter between you two, not a bank error the bank can reverse without a court order.
Your bank can see the transaction happened and confirm who initiated it, but they cannot unwind it just because you changed your mind about whether that person should have had access. If the person is a spouse or family member and the amount is large, you may need a lawyer or police report to recover it.
How strangers actually get into accounts
Unauthorized access by someone outside your circle usually happens through one of four routes: phishing (fake emails or texts that trick you into entering your password), malware (software installed on your device that captures keystrokes or credentials), credential stuffing (attackers using passwords leaked from other websites to try your email and password combination), or social engineering (calling your bank pretending to be you and convincing them to reset your password or add a new authorized user).
Each of these leaves evidence. Phishing emails have headers that show they did not come from your bank. Malware infections show up in your device's activity logs or antivirus scans. Credential stuffing attempts fail unless you reused a password across multiple sites. Social engineering requires the attacker to know personal details about you—your mother's maiden name, the last four digits of your Social Security number—that they usually do not have.
The bank's fraud detection systems also flag unusual activity: a withdrawal from a city you have never visited, a transfer to an account that was just added, a login from a device or IP address that does not match your history. If the transaction is flagged and reversed before it settles, you may never see it on your statement. If it goes through, you can dispute it.
What to do if you see a transaction you did not make
Contact your bank when ready—do not wait for a statement or a second transaction. Call the number on the back of your debit card or log into your online account and look for a "report fraud" or "dispute transaction" button. Have the transaction details ready: the date, the amount, the merchant or recipient, and whether the transaction is still pending or has already posted.
The bank will ask whether you recognize the transaction, whether you authorized anyone else to make it, and whether your card or account information was compromised. Be specific: if someone you know took the money, say so. If you do not know how it happened, say that too. The bank will open a dispute and begin an investigation.
Under the Electronic Funds Transfer Act, if you report the fraud within 60 days of the statement date, your liability is capped at $50. If you wait longer than 60 days, you may be liable for the full amount. If your debit card was stolen or compromised (not your account credentials), your liability is $0 if you report it before any fraudulent transactions post.
The difference between fraud and a dispute with someone you know
If the person who took the money is someone you know—a roommate, family member, ex-partner, or business associate—the bank will not reverse the transaction just because you say they should not have had access. The bank sees that the transaction came from a device or location associated with the account, or from someone with a legitimate card or login. From the bank's perspective, it looks authorized.
In this situation, you have a few options. First, ask the person to return the money. Second, if they refuse, you can file a police report for theft or embezzlement, depending on the amount and your relationship. Third, you can pursue a civil claim in small claims court or with a lawyer. The police report or court order can then be presented to the bank as evidence that the transaction was unauthorized, though the bank is not required to reverse it without a court order.
The bank's role is to confirm that the transaction happened and who initiated it. The bank is not a referee in personal disputes. If you are in a relationship where you share an account and one person is taking money the other does not approve of, the solution is to separate the accounts, not to ask the bank to block the other person.
How to prevent unauthorized access
Start with your password. Use a unique password for your bank account—one you do not use anywhere else. If that password is leaked from another website, attackers cannot use it to get into your bank. Store your password in a password manager (like Bitwarden, 1Password, or Dashlane) rather than writing it down or reusing it.
Enable two-factor authentication on your bank account if the bank offers it. This means that even if someone has your password, they cannot log in without a second form of verification—usually a code sent to your phone or generated by an authenticator app. Most banks offer this for free.
Monitor your account regularly. Log in at least monthly and review your transactions. Many banks let you set up alerts for large withdrawals, transfers to new accounts, or logins from new devices. Use these alerts. If you see something unfamiliar, report it when ready.
Be cautious with your personal information. Do not share your Social Security number, mother's maiden name, or account number with anyone unless you initiated the contact and you are certain they are legitimate. Do not click links in emails or texts that claim to be from your bank—go directly to the bank's website or call the number on your card instead.
If you have authorized users or joint account holders, review them periodically. If someone no longer needs access, remove them. If you suspect someone has your password, change it when ready and contact your bank to report the suspected compromise.
What happens after you report fraud
Your bank will place a temporary credit to your account while they investigate, usually within one to three business days. This is not a final resolution—it is a courtesy while they gather evidence. The investigation itself takes 10 business days to 45 days, depending on the bank and the complexity of the case.
During the investigation, the bank will review the transaction details, check whether your card or account information was compromised, and contact the merchant or receiving bank if money was transferred out. They will also ask you for any additional information—screenshots of phishing emails, records of when you discovered the fraud, or evidence that you did not authorize the transaction.
If the bank determines the transaction was fraudulent, the temporary credit becomes permanent and you are not liable. If the bank determines you authorized it or cannot prove you did not, they will reverse the temporary credit and you will be liable for the amount. You can dispute the bank's decision, but you will likely need documentation or a police report to change their mind.
Frequently Asked Questions
Can my bank freeze my account if they suspect fraud?
Yes. If your bank detects suspicious activity or you report fraud, they can temporarily freeze your account while they investigate. This protects you from further unauthorized transactions, but it also means you cannot access your money during the freeze. The freeze usually lasts a few days to a few weeks. Ask your bank for a timeline and what you need to do to unfreeze it.
What if someone added themselves as an authorized user on my account without my permission?
Contact your bank when ready and ask them to remove the unauthorized user. The bank can see who added them and when. If you did not authorize it, the bank can investigate whether your account was compromised. Once the user is removed, monitor your account closely for other unauthorized changes, like new cards issued or transfers initiated.
Can my employer or landlord access my bank account?
No, unless you have explicitly authorized them. Your employer can see your bank account only if you give them permission for direct deposit, and even then they can only deposit money, not withdraw it. Your landlord has no access to your account unless you add them as an authorized user, which you should never do. If someone is threatening to access your account, contact your bank and police.
If I report fraud, will the merchant get in trouble?
Not necessarily. If the fraud happened because your card was stolen or your account was hacked, the merchant is not at fault. If the fraud happened because the merchant was compromised (their payment system was breached), the merchant may face consequences from their payment processor or bank, but that is separate from your dispute. Your job is to report the unauthorized transaction to your bank, not to investigate the merchant.
How long do I have to report fraud before I lose my money?
You have 60 days from the date the statement containing the fraudulent transaction was sent to you. If you report within 60 days, your liability is capped at $50. If you report after 60 days, you may be liable for the full amount. Check your statements as soon as they arrive so you catch fraud early.