Yes, someone can steal money from your bank account, but your bank has legal responsibility to protect you
Money can leave your account without your permission in several ways: someone uses your debit card number, logs into your account with your password, sets up an unauthorized transfer, or convinces your bank to move money on their behalf. The good news is that federal law limits what you owe when theft happens, and your bank must investigate and often refund you — but only if you report it quickly and follow specific steps.
The speed of your report matters more than almost anything else. If you report unauthorized charges within two business days, you are liable for at most $50 of fraudulent debit card charges. If you wait longer, your liability can jump to $500. If you wait more than 60 days after your statement arrives, you may lose all protection for transfers that happened before you reported them. This is why checking your account regularly — even just weekly — is your strongest defense.
Key Takeaways
- Federal law caps your liability at $50 for unauthorized debit card charges if you report within two business days, but waiting longer can cost you hundreds.
- Transfers set up without your permission are treated differently than card fraud, and you have 60 days from your statement date to report them or lose protection.
- Your bank must investigate within 10 business days and either refund you or explain why they will not, though complex cases can take up to 45 days.
- Protecting yourself means using a strong password, checking your account weekly, and reporting anything suspicious when ready by phone rather than email.
The three main ways money leaves your account without permission
Debit card fraud happens when someone uses your card number — either the physical card or just the number — to make a purchase or withdraw cash. They might have stolen your card, found it, or obtained the number from a data breach at a store or website. You do not have to be present for this to happen.
Account access fraud occurs when someone logs into your online banking with your username and password. They might have guessed your password, stolen it from a phishing email, or obtained it in a data breach. Once inside, they can transfer money out, change your contact information, or set up new transfers.
Unauthorized transfers happen when someone convinces your bank to move money without your permission — usually by calling and impersonating you, or by setting up a recurring transfer using information they have gathered about you. This is harder to pull off than card fraud because it requires more personal details, but it happens.
What to do when ready if you notice unauthorized activity
Call your bank's fraud line by phone as soon as you spot something wrong. Do not email, do not use the app, do not wait until business hours if it is after hours — most banks have 24-hour fraud lines. Have your account number ready and be prepared to describe exactly what happened: the date, the amount, and where the charge appeared (online, at an ATM, at a store).
Your bank will ask you to confirm that you did not authorize the transaction. Answer clearly. They will then freeze your account or issue a new debit card to stop further fraud. Ask them to send you written confirmation of your report — you will need this if the investigation takes time or if you need to dispute something later.
After you hang up, change your online banking password when ready if you still have access to your account. Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. If you cannot access your account, tell your bank during the call and ask them to reset it for you.
How your bank investigates and what timeline to expect
Once you report fraud, your bank must begin an investigation within one business day. For debit card fraud, they have 10 business days to decide whether to refund you. For unauthorized transfers, they have the same 10 days, but complex cases can extend to 45 days if the bank notifies you in writing that they need more time.
During the investigation, the bank will look at the transaction details, check whether the merchant or ATM location matches your usual activity, and contact the merchant if needed. They will also ask you questions: Have you shared your card with anyone? Have you used this card at unfamiliar locations recently? Did you receive any suspicious emails or calls? Answer honestly — if the bank suspects you were careless with your information, they may deny your claim.
If the bank decides the transaction was fraudulent, they must refund your money within one business day of that decision. The money goes back into your account, and you should see it within a few business days depending on your bank. If they deny your claim, they must explain why in writing.
Your legal protection depends on how fast you report
Federal law under the Electronic Funds Transfer Act sets strict timelines for your protection. If you report unauthorized debit card charges within two business days of discovering them, your liability is capped at $50. If you report between two and 60 days, your liability jumps to $500. If you wait more than 60 days after your statement arrives, you lose all protection — the bank does not have to refund you at all.
This is why the date you discover the fraud matters. If fraudulent charges appear on a statement you receive on January 15, your 60-day window closes on March 16. Any unauthorized transactions that happened before January 15 but that you did not report until after March 16 may not be covered. Check your statements as soon as they arrive, and report anything suspicious when ready.
Some banks offer stronger protections than the law requires — they might refund you even after 60 days, or cap your liability at zero. Ask your bank what their specific policy is. It is worth knowing before you need it.
Steps to protect your account from theft in the first place
Use a strong, unique password for your online banking: at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Never use the same password for your bank that you use for email, social media, or shopping sites. If one of those sites gets hacked, criminals will try that password on your bank account.
Check your account at least once a week, either through the app or website. You do not need to read every transaction — just scan for anything you do not recognize. Many banks let you set up alerts that notify you by text or email when a transaction over a certain amount goes through. These alerts are free and can catch fraud within hours instead of days.
Do not share your debit card number, expiration date, or CVV (the three-digit code on the back) with anyone unless you are making a purchase you initiated. Be especially cautious with unsolicited calls or emails claiming to be from your bank — real banks never ask for your password or full account number by email or phone. If you are unsure, hang up and call the number on the back of your card.
If you receive a phishing email (one that looks like it is from your bank but asks you to "verify" your information), do not click any links. Instead, forward it to your bank's fraud department — the email address is usually on your bank's website — and delete it.
What happens if your bank refuses to refund you
If your bank denies your fraud claim, you have the right to dispute it. Ask the bank in writing for a detailed explanation of why they denied your claim. Keep a copy for your records. If you believe they made a mistake, you can file a complaint with the Consumer Financial Protection Bureau (CFPB), which oversees banks and can investigate whether the bank followed the law.
You can also contact your state's banking regulator or attorney general's office. These agencies have the power to fine banks that break fraud protection rules. Having a complaint on file with a regulator sometimes motivates a bank to reconsider a denial, especially if the bank has received multiple complaints about the same issue.
If the amount is small enough, you might consider small claims court, though this is time-consuming and works best if you have clear documentation of your report and the bank's denial. Most people find that a formal complaint to the CFPB is more effective.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
Your bank must investigate within 10 business days (45 days for complex cases) and refund you within one business day of deciding the charge was fraudulent. In practice, most refunds appear in your account within 3 to 5 business days. If your bank is slow, ask for a written timeline when you report the fraud.
What if I authorized the transaction but now regret it?
That is not fraud, and your bank will not refund you. Fraud means you did not authorize it at all. If you sent money to someone and they did not deliver what they promised, that is a scam, not a bank error — and banks have no obligation to refund scams. Report it to police and the FTC, but do not expect your bank to reverse it.
Can someone steal money if they only know my account number?
They can set up an unauthorized transfer or recurring payment if they have your account number and routing number, which is why you should not share these details casually. However, they cannot use just an account number to make debit card purchases — they need the card itself or the full card number with expiration date and CVV.
Do I have to pay my bills while the fraud investigation is happening?
Yes. Your bank may temporarily credit your account while they investigate, but that credit is not permanent — if they later decide the charge was authorized, they will remove the credit and you will owe the money. Do not assume the investigation refund is final. Keep paying your bills as normal.
What if the fraud happened at an ATM?
ATM fraud is treated the same as debit card fraud under federal law. Report it when ready, and your liability is capped at $50 if you report within two business days. If someone skimmed your card at an ATM (used a hidden device to steal your card number), the bank may also refund any cash withdrawals made with that number, depending on how quickly you reported it.