Someone else can access your bank account if you give them permission, if they have your login credentials, or if a court orders it—but the bank itself cannot let them in without one of those three things.

The most common way someone gains access is because you authorized it: you added them as a joint account holder, gave them power of attorney, set up a trusted contact, or shared your username and password. The second way is theft—they obtained your credentials through phishing, malware, a data breach, or social engineering. The third way is legal: a court order, a tax lien, or a creditor judgment can force the bank to freeze or release funds. This guide covers what each scenario looks like, how to spot unauthorized access, and what to do if it happens.

Key Takeaways

  • You can authorize access by adding someone as a joint owner, granting power of attorney, or naming a trusted contact—each gives different levels of control.
  • Unauthorized access usually happens through stolen passwords, phishing emails, or malware, and you should report it to your bank and the Federal Trade Commission when ready.
  • Banks are required to investigate unauthorized transactions within a specific timeframe and may reverse them if you report them promptly.
  • A court order, tax lien, or creditor judgment can force your bank to freeze your account or release funds without your permission.
  • Monitoring your account regularly, using strong passwords, and enabling two-factor authentication are your strongest defenses against unauthorized access.

Ways you can intentionally give someone access

Joint account ownership is the broadest form of access. When you add someone as a joint owner, they can withdraw money, make transfers, close the account, and see all transaction history. The bank treats both of you equally—they do not need your permission to act. This is common between spouses, parents and adult children, or business partners. Once someone is a joint owner, removing them usually requires their signature or a court order.

Power of attorney lets you give someone legal authority to manage your finances without making them a joint owner. You sign a document (often called a financial power of attorney) that specifies what they can do—withdraw money, pay bills, manage investments, or all of the above. The person holding power of attorney is called an agent or attorney-in-fact. They have a legal duty to act in your interest, and you can revoke the power of attorney at any time by signing a revocation document and notifying the bank.

Trusted contact is a newer option that gives limited access. You name someone at the bank, and the bank can contact them if they suspect fraud or if you become incapacitated. A trusted contact cannot withdraw money or move funds on their own—they are an information channel, not a decision-maker. This is useful if you want someone to help you spot problems but not control your account.

Authorized user status on a credit card or checking account with a debit card lets someone use the card to spend money but usually not see your full account or change settings. The rules vary by bank and account type, so ask your bank exactly what an authorized user can and cannot do.

How unauthorized access happens and what to watch for

Unauthorized access most often starts with your password. Someone obtains it through a phishing email (a fake message pretending to be from your bank), a data breach at another company where you used the same password, malware on your computer or phone, or by guessing a weak password. Once they have your login, they can transfer money, change your contact information, add themselves as a trusted contact or authorized user, or lock you out by changing your password.

Signs of unauthorized access include transactions you do not recognize, a login notification from a device or location you do not use, a changed password you did not change, missing money, new authorized users or payees you did not add, or mail about accounts you did not open. Check your account at least weekly—many banks let you set up alerts for large transactions or logins from new devices.

If you spot unauthorized access, call your bank when ready using the number on the back of your card or statement, not a number from an email or search result. Do not use the bank's website to report it, because if someone has access to your login, they may have changed your contact information. Tell the bank what happened, which transactions were unauthorized, and ask them to freeze your account and change your password. The bank will open an investigation and may issue you a new debit card.

Your rights when unauthorized transactions occur

Federal law (Regulation E) requires banks to investigate unauthorized transactions on checking and savings accounts within 10 business days and to give you a provisional refund within three business days if the transaction appears unauthorized. If the bank needs more time, they can extend the investigation to 45 days, but they must keep you informed. At the end of the investigation, the bank must tell you in writing whether they found the transaction unauthorized and whether you will receive a permanent refund.

The key word is unauthorized. If you gave someone permission to access your account and they took money without your knowledge, that is a civil dispute between you and that person, not a bank error. The bank will not refund it. If someone stole your password and used it, that is unauthorized, and the bank should refund it. If you shared your password with someone and they used it, the bank may argue you authorized access by sharing credentials, which complicates your case.

Report unauthorized transactions as soon as you notice them. The longer you wait, the harder it is to prove you did not authorize the transaction, and some banks limit refunds if you wait more than 60 days. Keep records of everything: screenshots of transactions, emails from the bank, notes on when you called, and the names of bank employees you spoke with.

When a court order or creditor can force access

A court judgment, tax lien, or creditor order can force your bank to freeze your account or release funds without your permission. This happens when you owe money—to the government for taxes, to a creditor who sued you and won, or to a child support agency. The creditor or government agency files paperwork with the court, the court issues an order, and the creditor serves the order on your bank. The bank then freezes the account or sends the money to the creditor.

You have the right to object. If you receive notice that your account is frozen, you can file a motion in the court that issued the order, claiming the money is exempt (for example, Social Security benefits are exempt from most creditor claims in most states). You must act quickly—usually within 10 to 30 days, depending on your state. If you do not respond, the freeze stands and the money goes to the creditor.

If you believe the freeze is a mistake—for example, the creditor is suing the wrong person, or the debt is already paid—contact the creditor directly and ask them to withdraw the order. If they refuse, you will need to go to court. This is one situation where talking to a lawyer is worth the cost, because missing a important date can mean losing access to your own money.

Protecting your account from unauthorized access

Use a strong, unique password for your bank account—at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Do not use the same password on multiple sites. If one site is breached, attackers will try that password on your bank account. A password manager like Bitwarden or 1Password stores strong passwords securely so you only have to remember one master password.

Enable two-factor authentication on your bank account. This means that even if someone has your password, they cannot log in without a second form of verification—usually a code sent to your phone or generated by an authenticator app. Two-factor authentication stops most unauthorized access cold. Your bank may call it "two-step verification" or "multi-factor authentication," but the idea is the same.

Do not click links in emails claiming to be from your bank. Instead, go directly to the bank's website by typing the address into your browser, or call the number on your statement. Phishing emails look real but lead to fake websites designed to steal your password. If you are unsure whether an email is real, call your bank using the number you know is correct.

Keep your computer and phone updated with the latest security patches. Malware can steal your password or intercept codes sent for two-factor authentication. Use antivirus software and avoid public Wi-Fi for banking—if you must use public Wi-Fi, use a VPN (virtual private network) to encrypt your connection.

Review your account statements and online activity regularly. Many banks let you read three months or more of transaction history. Look for anything unfamiliar. Set up alerts for large transactions, new payees, or logins from new devices. The sooner you spot a problem, the sooner you can stop it.

What to do if someone you know is misusing your account

If a family member, friend, or caregiver is taking money from your account without permission, the situation is complicated because they may have legitimate access. If they are a joint owner or have power of attorney, they have legal authority to withdraw money, even if you did not intend for them to use it that way. The bank will not stop them or refund the money, because from the bank's perspective, they are authorized.

Your options are to remove them from the account (which usually requires their signature or a court order), to change your password and remove them as an authorized user, or to pursue a civil lawsuit against them for theft or breach of fiduciary duty. If they are a caregiver and you believe they are exploiting you, you can also report elder abuse or vulnerable adult abuse to your state's adult protective services agency. If they obtained access through fraud—for example, they forged your signature on a power of attorney document—report it to the police and your bank.

If you are in an abusive relationship and your partner has access to your account, contact the National Domestic Violence Hotline (1-800-799-7233) for help opening a new account at a different bank and moving money safely. They can also help you understand your legal options for removing someone from an account or protecting yourself.

Frequently Asked Questions

Can my bank see my password?

No. Your bank stores an encrypted version of your password, not the password itself. If someone at the bank wanted to access your account, they would need to use their own employee credentials, which are logged and audited. Banks have strict rules about employee access to customer accounts, and unauthorized access by an employee is a crime.

What if I added someone to my account and now I want to remove them?

If they are a joint owner, you will need their signature on a removal form, or you can close the account and open a new one without them. If they have power of attorney, you can revoke it by signing a revocation document and giving it to the bank. If they are an authorized user on a debit card, you can call the bank and have them removed when ready. Ask your bank which process applies to your situation.

Can the IRS access my bank account without telling me?

The IRS can freeze your account if you owe back taxes, but they must follow a legal process and you will receive notice. They cannot secretly access your account to see what is in it. If you receive notice of a freeze, you have the right to request a hearing and argue that the money is exempt.

What if I share my login with my spouse?

Sharing your login is risky because if your spouse's device is compromised, an attacker could access your account. It is safer to make your spouse a joint owner or give them power of attorney, because then the bank has a record of their authorization and can help you if something goes wrong. If you do share your login, use two-factor authentication so that even if they share the password, an attacker cannot log in without the second factor.

How long does it take to get my money back after reporting fraud?

The bank must give you a provisional refund within three business days and a final decision within 10 business days (or up to 45 days if they need more time to investigate). In practice, most banks refund unauthorized transactions within one to five business days. If the bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau.