The short answer: legally, no—but it happens, and the consequences depend on who it is and what they do

Your bank account is yours alone. The bank holds you responsible for every transaction, whether you made it or someone else did. If you give someone access—through a debit card, online login, or by adding them as an authorized user—you are giving them permission to spend your money. If you did not give permission and they used it anyway, that is fraud or theft, and you have a window to report it and recover the money.

The hard part is that banks treat these situations differently depending on how the person got access. A spouse with a joint account has legal rights you cannot straightforward revoke. A family member you gave a debit card to is different from a stranger who stole your login. A scammer who tricked you into sending money is different from someone who hacked your account. Each path has different timelines, different protections, and different outcomes.

Key Takeaways

  • If someone used your account without permission, you must report it to your bank within 60 days to get federal fraud protection; after that window closes, recovery becomes much harder.
  • Joint account holders have legal ownership rights and can withdraw money freely—you cannot reverse their transactions unless you prove fraud or theft, which requires police involvement.
  • Authorized users (like a child or caregiver you added to the account) can be removed when ready, but money they already spent is gone unless you pursue legal action.
  • Scams where you were tricked into sending money are harder to recover than hacks where someone stole your credentials, because the money left your account by your own hand.

Unauthorized access: the 60-day fraud window

If someone used your account without your permission—they stole your debit card, guessed your password, or used your information to make online purchases—you have 60 days from the date the statement showing the fraud was sent to you to report it to your bank. This is a federal rule under the Electronic Funds Transfer Act. If you report within that window, your liability is capped: you owe nothing if you report before any unauthorized transactions post, up to $50 if you report after they post but within two business days, and up to $500 if you wait longer but still stay within 60 days.

After 60 days, you lose that protection. The bank is no longer required to refund you. You can still report the fraud and ask, but the bank can refuse. This is why the timeline matters more than anything else. Call your bank's fraud line when ready—do not wait for a statement to arrive. Most banks have a 24-hour fraud hotline on the back of your debit card. Tell them which transactions were not you, and ask them to freeze the account and issue a new card.

The bank will usually reverse the fraudulent transactions within 5 to 10 business days while they investigate. If the fraud involved a hacked online account, they may also reset your password and ask you to set a new one. If the fraud involved a stolen card, they will cancel it and mail a replacement, usually within 7 to 10 business days.

Joint account holders: legal co-owners with withdrawal rights

If the person is a joint account holder—someone whose name is on the account alongside yours—they have legal ownership rights. Either owner can withdraw all the money without permission from the other. This is true even if one person contributed all the money or the other person is a spouse you are divorcing. The bank sees both names and treats both as owners.

You cannot reverse a joint account holder's withdrawal by calling the bank and saying they took money without permission. The bank will not help because they took money from an account they legally own. Your only recourse is to go to court and ask a judge to order them to return it. This requires proving that the money was yours alone (not marital property, not a gift, not money you agreed to share), which is difficult and expensive. If you are in a divorce, your divorce attorney can address this. If it is a family member, you would need to file a civil lawsuit for conversion or theft.

If you want to prevent a joint account holder from accessing the account, you must close it. The bank will not remove one owner at your request alone. Both owners must agree, or you must go to court and get a court order. Once the account is closed, the bank will send any remaining balance to both owners, usually by check, and you will both have to decide how to split it or go back to court.

Authorized users: people you gave permission to, but now want to stop

An authorized user is someone you added to your account—a child, a caregiver, a trusted family member—and gave them a debit card or online access. They have permission to use the account, but they do not own it. You can remove them at any time by calling your bank and asking them to revoke access. The bank will usually do this the same day or within one business day.

However, removing them does not recover money they already spent. Once the transaction posts, it is gone. If they spent the money on something you did not agree to, you have a few options: you can ask them to repay you directly, you can pursue a civil lawsuit if the amount is large enough to justify the cost, or you can report it to police if you believe it was theft. Police involvement is rare and usually only happens if the person is not a family member or if the amount is very large.

If you are concerned an authorized user is overspending or making unauthorized purchases, you can set spending limits on their debit card before removing them. Many banks allow you to cap daily withdrawals or set merchant restrictions (for example, no gas station purchases). Check with your bank about what controls are available on your account type.

Scams where you were tricked into sending money

If a scammer convinced you to send them money—you thought you were paying a bill, or you believed you were sending money to a family member in an emergency—the money left your account because you authorized the transaction. This is different from fraud where someone stole your credentials. The bank sees your authorization and is less likely to reverse it.

You still have 60 days to report it, and you should report it when ready. Tell your bank exactly what happened: you were scammed, you sent money to an account you thought belonged to [person/company], and you now know it was fraudulent. The bank will investigate and may be able to recover the money if it is still in the receiving account and the receiving bank cooperates. This is more likely if you report within days rather than weeks.

If the money was sent through a wire transfer or ACH transfer to another bank, the receiving bank can sometimes freeze the account and return the funds, but only if you report quickly—usually within 24 to 48 hours. If the money was sent through a payment app like Venmo, PayPal, or Cash App, recovery is much harder because those platforms treat the transaction as complete once it is sent. You can report it to the app and to the recipient's bank, but the app will not reverse it without a police report or court order.

What happens if someone uses your account and you do not report it

If you discover unauthorized transactions but do not report them within 60 days, you lose federal fraud protection. The bank can hold you liable for the full amount. This is true even if you did not notice the fraud for months—the 60-day clock starts from when your statement was sent, not from when you discovered the problem.

Some banks will still help you after 60 days, especially if you have been a long-time customer or if the fraud is obvious (for example, transactions in a different country). But they are not required to. If you think fraud occurred, report it as soon as you notice it. Do not assume the bank will figure it out or that you have time to think about it.

Protecting your account from unauthorized use

The best defense is to limit who has access. Do not share your PIN, password, or security questions with anyone. Do not give your debit card to someone unless you trust them completely and understand they can spend any amount. If you need to give a family member access to money, consider opening a separate account in their name and transferring money to it, rather than giving them access to your main account.

Enable fraud alerts and transaction notifications on your account. Most banks let you set up text or email alerts when a transaction over a certain amount posts. This helps you catch fraud quickly. Use a strong, unique password for online banking—not your birthday, not a family member's name, not something you use on other websites. Enable two-factor authentication if your bank offers it, so that even if someone has your password, they cannot log in without a code sent to your phone.

If you are concerned about a family member's access, you can remove them without closing the account. You do not have to wait for them to agree or for a court order—you can call the bank and revoke their access when ready. The only exception is a joint account holder, who has legal rights you cannot override without a court order.

Frequently Asked Questions

Can my spouse withdraw all the money from our joint account?

Yes. Both owners of a joint account have full legal rights to all the money in it. Your spouse can withdraw the entire balance without your permission, and the bank will not stop them. If you are divorcing, your attorney can ask the court to freeze the account or order your spouse to return money, but the bank itself cannot help.

What if I gave someone my debit card and they spent more than I said they could?

If you gave them the card, the bank sees that as authorization. You cannot report it as fraud. Your only option is to ask them to repay you, or to pursue a civil lawsuit. You can remove their access by canceling the card, but the money already spent is gone.

How long does it take to get my money back after I report fraud?

Most banks issue a provisional credit within 5 to 10 business days while they investigate. A full refund usually comes within 30 to 45 days. If the bank denies your claim, they must tell you in writing and explain why. You can then dispute their decision, though this is difficult and often unsuccessful.

Can I report fraud if I waited three months to notice it?

You can report it, but you have lost federal protection. The bank is not required to refund you. Some banks will still help as a courtesy, especially if you have been a customer for a long time, but they can refuse. Always report fraud as soon as you notice it.

What if someone used my account to buy something and had it shipped to their address?

Report it as fraud to your bank when ready. Also contact the merchant and tell them the purchase was unauthorized. If the item has not shipped, the merchant may be able to cancel it. If it has shipped, you can report it to the police and provide them with the shipping address—this helps establish a pattern if the person has done this to others. The police report also strengthens your case with the bank.