Yes, someone can get into your bank account — but it usually requires information you have or a mistake you make
Your bank account is not automatically protected just because it has your name on it. A person with your account number, routing number, and enough personal details can move money out. Someone with your online login credentials can transfer funds, change your address, or lock you out. A criminal with your Social Security number and a few other pieces of information can open a fake account in your name. The good news is that each of these routes requires something specific — and you can stop most of them by understanding what that something is.
Banks do have fraud protections built in, and federal law limits your liability in many cases. But those protections work best when you know what to watch for and act quickly when something goes wrong. This guide explains the real ways someone gains access, what happens when they do, and the concrete steps that actually reduce your risk.
Key Takeaways
- Someone can withdraw money from your account if they have your account number and routing number, which appear on every check you write.
- Online account takeover happens when someone obtains your username and password, often through phishing emails or data breaches at other companies.
- Identity theft can result in a fraudulent bank account opened in your name, which requires your Social Security number and a government ID.
- Federal law limits your liability to $50 if you report unauthorized transactions within two business days, but delays cost you more.
- The fastest way to stop ongoing fraud is to call your bank's fraud line directly, not the number on your card or a website.
How someone accesses your account with just your account number
Your account number and routing number are printed on every check you write. If someone has these two numbers, they can set up what is called an ACH transfer — an electronic movement of money from one bank account to another. They do not need your password, your online login, or your permission. They just need those two numbers and a way to initiate the transfer, which can be done through many banks' websites or third-party payment services.
This is why checks are risky if they are lost or stolen. It is also why you should not write checks to people you do not know or leave blank checks where others can find them. If someone uses your account number this way, the money leaves your account and goes to theirs, often at a different bank. By the time you notice, the receiving account may be closed or emptied.
You can reduce this risk by not leaving checks lying around, by shredding old statements, and by being cautious about who you give your account information to. If you do lose a check or suspect someone has your account number, contact your bank when ready and ask them to flag your account for suspicious activity.
How online account takeover happens
If someone has your username and password for online banking, they can log in as you. They can see your balance, transfer money to another account, change your contact information, and in some cases order a debit card to be mailed to a different address. This is the fastest way for a criminal to drain an account because they do not have to wait for a check to clear or an ACH transfer to process.
Criminals get your login credentials in several ways. Phishing is the most common: you receive an email that looks like it is from your bank, asking you to "verify your account" or "confirm your identity." The link takes you to a fake website that looks identical to your real bank's site. You enter your username and password, and the criminal now has them. Other times, your credentials are stolen in a data breach at a company where you use the same password — a retailer, an email provider, or a social media site. Criminals buy lists of stolen usernames and passwords and try them at banks.
The best protection is a unique password for your bank account — one you do not use anywhere else. Use a password manager if you have trouble remembering it. Turn on two-factor authentication if your bank offers it, which requires a second form of verification (usually a code sent to your phone) even if someone has your password. Never click links in emails claiming to be from your bank; instead, go directly to your bank's website by typing the address into your browser.
How identity theft leads to a fraudulent account in your name
A criminal can open a brand-new bank account in your name without touching your existing account. To do this, they need your name, address, date of birth, and Social Security number — information that may be available from a data breach, a lost wallet, or public records. They also need a government-issued ID with your name and photo on it, which they can obtain by explore for a fake ID using stolen information, or in some cases by using an ID that belongs to someone who looks similar.
Once they have opened the account, they can deposit bad checks, receive fraudulent wire transfers, or use it to launder money. You may not discover this account exists until a debt collector contacts you about unpaid overdrafts, or until you check your credit report and see accounts you do not recognize. This type of fraud is harder to catch because the account is not yours — it is a separate account that happens to have your name on it.
To reduce this risk, monitor your credit report regularly. You can request a free credit report once per year from each of the three major credit bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com. Look for accounts you do not recognize. If you find fraudulent accounts, contact the credit bureau and the bank that opened the account. You can also place a fraud alert on your credit file, which requires lenders to verify your identity before opening new accounts in your name.
What to do when ready if you notice unauthorized activity
The moment you see a transaction you did not make, contact your bank. Do not wait to see if it resolves itself or to gather more information. Call the fraud line number on the back of your debit card or the number listed on your bank statement — not a number you find by searching online, which could be a scam. Tell them what transaction is unauthorized and when you first noticed it.
Federal law (Regulation E) limits your liability for unauthorized electronic transfers. If you report the fraud within two business days of discovering it, you are liable for no more than $50. If you wait longer than two business days but report it within 60 days, you could be liable for up to $500. If you wait more than 60 days, you may lose all protection and be responsible for the full amount. This is why speed matters.
Your bank will likely freeze your account or issue you a new debit card while they investigate. They may ask you to file a written statement describing the unauthorized transaction. Keep records of all your communications with the bank, including dates, times, and the names of anyone you spoke with. If the bank denies your claim, you have the right to dispute it in writing.
How to lock down your account right now
Start with your password. If you use the same password at your bank as you do at other websites, change it when ready. Make it at least 12 characters long and include uppercase letters, lowercase letters, numbers, and symbols. Do not use words from the dictionary or personal information like your birthday or pet's name.
Turn on two-factor authentication if your bank offers it. This usually means you choose a phone number or email address where you will receive a code every time someone tries to log in from a new device. Even if a criminal has your password, they cannot log in without that code.
Set up account alerts. Most banks let you receive a text or email notification whenever a transaction over a certain amount occurs, or whenever your balance drops below a certain level. These alerts will not stop fraud, but they will help you catch it faster.
Review your account statements every month, either online or on paper. Look for charges you do not recognize. If your bank offers it, set up a separate savings account and keep most of your money there, using your checking account only for regular bills and withdrawals. This limits the damage if your checking account is compromised.
What happens if someone opens a fraudulent account in your name
If you discover an account you did not open, contact the bank that opened it when ready. Explain that the account is fraudulent and that you did not authorize it. Ask them to close the account and provide you with written confirmation that it is closed. Request a copy of the process they used to open it — this will show you what information the criminal used.
File a report with the Federal Trade Commission at identitytheft.gov. This creates an official record of the fraud and gives you a recovery plan. You can also file a police report in your local jurisdiction, which may be required by the bank or credit bureaus.
Contact the three credit bureaus (Equifax, Experian, and TransUnion) and place a fraud alert on your credit file. This tells lenders to verify your identity before opening new accounts. You can also request a credit freeze, which prevents anyone from opening new accounts in your name without your permission — though you will need to temporarily lift the freeze if you want to open accounts yourself.
Frequently Asked Questions
Can my bank reverse a fraudulent transfer if I report it right away?
Most banks will reverse unauthorized electronic transfers (ACH transfers, wire transfers, debit card charges) if you report them within two business days. Reversals take longer for checks and some other payment types. Contact your bank when ready with the transaction details, and ask for a specific timeline for the reversal.
What if someone has my debit card number but not the card itself?
They can make online purchases or in-person purchases at stores that do not require a PIN. Call your bank when ready and request a new card. Ask them to cancel the old card number. Most banks can issue a temporary card number while your physical card is being mailed.
Is my money safer in a savings account than a checking account?
Federal protections are the same for both. However, savings accounts typically have fewer transactions and may be less of a target. More importantly, keeping most of your money in savings and using checking only for regular bills limits the amount available if your checking account is compromised.
What should I do if I get an email asking me to verify my bank account?
Do not click any links or read any attachments. Go directly to your bank's website by typing the address into your browser, log in, and check your account. If there is a real issue, you will see a message when you log in. If you are unsure, call your bank using the number on your statement or card.
Can I get my money back if I sent it to a scammer myself?
This is harder than fraud where someone took money without your permission. If you sent money willingly but were tricked, your bank may not be required to reverse it. However, it is worth reporting to your bank and asking them to attempt a reversal. Some banks have scam-recovery programs. You should also report it to the FTC and your local police.