Yes, someone can steal from your bank account, but the path depends on how they get access

Theft from a bank account happens in two main ways: someone uses your login credentials or card details without permission, or they trick you into sending money yourself. The first is fraud; the second is often called a scam. Your bank's fraud protections and your own actions determine how much of the money you get back and how fast.

The good news is that federal law limits your liability for unauthorized transactions, but only if you report them within a specific window. The bad news is that scams—where you voluntarily send money to a criminal—are much harder to recover from, because technically you authorized the transfer.

Key Takeaways

  • Unauthorized charges on your debit card are covered by federal law up to $50 if you report them within two business days, and up to $500 if you report within 60 days.
  • ACH transfers and wire transfers you were tricked into making are treated differently than card fraud and are much harder to reverse.
  • You must report fraud to your bank in writing within 60 days of receiving your statement to preserve your legal protections.
  • Criminals get access through phishing emails, fake websites, malware on your device, or by purchasing your information from a data breach.
  • Freezing your credit and monitoring your accounts for 30 days after discovering fraud can catch additional unauthorized activity early.

How criminals actually get your bank account information

The most common entry points are phishing emails that look like they come from your bank, asking you to "verify" your login or update your card. You click the link, enter your credentials on a fake website that looks identical to the real one, and the criminal now has your username and password. This is not a technical hack—it is social engineering.

Data breaches at retailers, healthcare providers, or other companies you do business with are another major source. Your card number, expiration date, and CVV end up for sale on the dark web. Criminals test these numbers on small purchases first (a coffee, a gas station charge) to confirm they work before making larger ones.

Malware on your computer or phone can log your keystrokes or capture screenshots, giving a criminal everything you type, including your login credentials and one-time codes. This often arrives through infected email attachments or compromised websites.

Account takeover happens when a criminal has your email address and password (often from a breach at an unrelated company) and uses it to reset your bank password. If your email account itself is compromised, they can intercept the password-reset link.

What federal law actually covers and what it does not

The Electronic Funds Transfer Act (EFTA) limits your liability for unauthorized debit card transactions. If someone uses your card number without permission and you report it within two business days, you are liable for no more than $50. If you report within 60 days, you are liable for no more than $500. After 60 days, you may lose all protection.

This protection applies to debit card fraud, ATM card fraud, and some online transfers. It does not cover wire transfers or ACH transfers you were tricked into authorizing. If a criminal convinces you to send money via wire or ACH, the money is gone. You authorized it, even though you were deceived. Your bank can try to recall it, but success rates are low once the money has moved.

Credit card fraud is covered under different rules (the Fair Credit Billing Act), which limits your liability to $50 per card, period—even if you do not report for months. But credit cards are less vulnerable to account takeover because they do not directly access your bank account.

State laws sometimes offer stronger protections than federal law. A few states require banks to cover losses from account takeover even after 60 days if you report promptly. Check your state's attorney general website or your bank's terms to see if you have additional coverage.

The difference between fraud and scams, and why it matters for recovery

Fraud is when someone uses your account without your knowledge or permission. You did not authorize the transaction. Your bank's fraud department investigates, and federal law protects you.

A scam is when you authorize the transaction but you were lied to about what you were paying for or who you were paying. You sent money to a criminal thinking you were paying a utility bill, buying concert tickets, or sending a wire to a family member in trouble. Legally, you authorized it. Your bank is less obligated to reverse it.

Recovery from scams is slower and less certain. Your bank will file a report, but the money may already be withdrawn or moved to another account. Law enforcement can investigate, but they prioritize cases involving large sums or patterns of fraud. Small scams often go unresolved.

What to do when ready if you discover unauthorized activity

Call your bank's fraud line right away—do not use the number on the back of your card if you suspect the card itself is compromised, because you might reach a fake number. Look up the number on your statement or the bank's official website. Tell them what transactions are unauthorized and ask them to freeze your account or cancel your card.

Your bank will likely issue a new card within 7 to 10 business days. Debit cards take longer than credit cards because the bank has to may support your direct deposits and automatic payments still work.

Ask the bank to file a fraud dispute for each unauthorized transaction. The bank will send you a dispute form to sign and return. Keep a copy for your records. This starts the investigation clock and preserves your legal protections under the EFTA.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and may help you if you need to dispute fraudulent accounts opened in your name. The FTC does not investigate individual cases, but the report is useful for your records and for law enforcement if they get involved.

If the fraud involved your email account being compromised, change your email password when ready and enable two-factor authentication. If the same password was used elsewhere, change those too.

How long disputes take and what happens during the investigation

Your bank has up to 10 business days to acknowledge receipt of your dispute. They must then investigate and resolve it within 45 days, though they can extend to 90 days if they need more time. During this period, the bank may provisionally credit your account while they investigate, so you are not left without access to your money.

The bank will contact the merchant or the other financial institution involved and ask for documentation of the transaction. If the merchant cannot prove you authorized it, the bank reverses the charge. If the merchant provides a receipt or signature, the bank may deny your dispute.

For card-not-present transactions (online purchases), merchants have a harder time proving authorization, so your dispute success rate is higher. For in-person transactions with a PIN or signature, your success rate is lower.

Wire transfers and ACH transfers are investigated differently and take longer. The sending bank contacts the receiving bank and asks them to freeze the funds if possible. If the money has already been withdrawn, recovery is unlikely. These investigations can take 30 to 90 days.

Protecting your account from future theft

Enable two-factor authentication on your bank account. This means that even if a criminal has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Text-based codes are better than nothing; authenticator apps (like Google Authenticator or Authy) are more find because they cannot be intercepted by SIM swap attacks.

Use a unique, strong password for your bank account—at least 12 characters, mixing letters, numbers, and symbols. Do not reuse this password anywhere else. A password manager like Bitwarden or 1Password can generate and store these for you.

Monitor your account regularly. Log in at least weekly and review recent transactions. Many banks offer alerts for transactions over a certain amount or for any login from a new device. Turn these on.

Do not click links in emails claiming to be from your bank. Instead, go directly to the bank's website by typing the address yourself or calling the number on your statement. Banks never ask you to verify your password or full card number via email.

Be skeptical of unsolicited calls, texts, or emails asking you to send money or confirm personal information. Legitimate companies do not initiate contact this way. If you are unsure, hang up and call the organization directly using a number you know is real.

Check your credit reports at annualcreditreport.com (the only free, official source) once a year. Look for accounts you did not open. If you find fraud, place a fraud alert with the credit bureaus by contacting Equifax, Experian, or TransUnion.

Frequently Asked Questions

How long do I have to report fraud before I lose protection?

You have 60 days from the date your bank statement is sent to you. If you report within two business days, your liability is capped at $50. If you report between day three and day 60, your liability is capped at $500. After 60 days, you may have no protection under federal law, though some states offer longer windows.

What if my bank says the fraud was my fault because I shared my password?

Sharing your password is risky, but it does not automatically void your fraud protection. The EFTA protects you from unauthorized use regardless of how the criminal got your credentials. However, if you voluntarily gave your password to someone and they stole money, a bank might argue you authorized it. Document everything and escalate to the bank's complaint department if they deny your dispute.

Can I get my money back if I was scammed into sending a wire transfer?

Possibly, but it is difficult. Wire transfers are nearly impossible to reverse once sent. Your bank can contact the receiving bank and ask them to freeze the funds, but if the money has been withdrawn, it is gone. Law enforcement can investigate, but recovery rates are low. Prevention is far more effective than recovery for wire fraud.

What is a chargeback, and is it the same as a dispute?

A chargeback is a dispute filed through the credit card network (Visa, Mastercard, etc.) rather than directly with your bank. It is more formal and has stricter timelines. You can file a chargeback up to 120 days after the transaction. For debit cards, you file a dispute with your bank instead, which is faster but has a shorter window (60 days).

Should I close my bank account after fraud?

Not necessarily. Closing the account does not erase the fraud from your record, and it can complicate the dispute process. Keep the account open while the investigation is ongoing. Once the dispute is resolved and you have confirmed no new unauthorized activity for 30 days, you can close it if you want. Open a new account at the same bank or a different one for your direct deposits and automatic payments.