Yes, someone can steal money from your bank account, but the path depends on how they get access
Theft from a bank account happens in three main ways: someone uses your debit card or card number without permission, someone logs into your online banking with your username and password, or someone tricks your bank into moving money to an account they control. The speed of recovery and your liability depend entirely on which method was used and how quickly you report it.
The good news is that federal law limits what you owe. The bad news is that the limit depends on when you notice and report the theft. A theft you report within two business days costs you at most $50. A theft you report after 60 days can cost you up to $500. A theft you don't report at all can cost you everything in the account.
Key Takeaways
- Debit card fraud and unauthorized transfers are covered by federal law, which caps your loss at $50 if you report within two business days.
- If you wait more than 60 days to report, you could lose up to $500 or more, depending on your bank's rules and the type of theft.
- Your bank must investigate any claim of unauthorized transfer and return your money while the investigation happens if the claim is made within 60 days.
- Phishing emails, fake login pages, and social engineering are the most common ways thieves get your password—your bank will not ask for it by email or phone.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) stops thieves from opening new accounts in your name while you resolve the theft.
Debit card theft and what your bank must do
If someone uses your debit card number or physical card to buy things or withdraw cash, federal Regulation E protects you. You are liable for $0 if you report the card lost or stolen before anyone uses it. You are liable for up to $50 if you report within two business days of discovering unauthorized charges. You are liable for up to $500 if you report between two business days and 60 days after your statement arrives.
Your bank must investigate your claim and return the money to your account while they investigate—they cannot make you wait for the outcome. The investigation usually takes 10 business days, though your bank can extend it to 45 days if they have a good reason. If they find the charge was unauthorized, you owe nothing. If they find you authorized it or failed to protect your PIN, you may owe the full amount.
Report the theft to your bank when ready by phone, not by email. Get the name of the person you spoke to and the date and time of the call. Ask your bank to send you written confirmation of the report. Do not rely on a text message or email confirmation alone.
Online banking theft and account takeover
If someone logs into your online banking account using your username and password, the law that protects you is the same—Regulation E—but the investigation is different. Your bank must still return your money while they investigate, but they have 10 business days to do so, and they can extend to 45 days.
The catch is that your bank may argue you were negligent with your password. If you wrote it down, used the same password on multiple sites, or shared it with someone, your bank may try to hold you liable for part or all of the loss. This is a judgment call—banks do not always pursue it—but it is a real risk. Document everything: when you last changed your password, whether you ever shared it, whether you noticed any suspicious login attempts before the theft.
Change your password when ready and enable two-factor authentication if your bank offers it. Two-factor authentication requires a second form of proof (usually a code sent to your phone) before anyone can log in, even if they have your password. This stops most account takeovers cold.
Wire fraud and ACH transfers you did not authorize
If a thief tricks your bank into sending money to a different account—either by impersonating you or by social engineering a bank employee—the law is less clear and recovery is slower. Regulation E still applies, but only if the transfer was initiated electronically without your knowledge. If you were tricked into authorizing the transfer yourself (a scam called social engineering), your bank may argue you authorized it and refuse to return the money.
The difference matters. If a thief hacked your account and sent a wire, your bank must investigate and return the money within 10 to 45 business days. If you received a call from someone claiming to be your bank and you told them to send money, your bank will likely say you authorized it and deny your claim.
Report any unauthorized transfer to your bank within 60 days of the statement date. Your bank must freeze the receiving account if they can identify it, which stops the thief from withdrawing the money while the investigation happens. Recovery of wire transfers sent to another bank is much slower—sometimes weeks or months—because the receiving bank must cooperate, and they have no legal obligation to do so quickly.
How thieves get your information in the first place
The most common entry point is a phishing email that looks like it came from your bank. The email says your account is locked, your card is compromised, or you need to confirm your identity. It includes a link to a fake login page that looks identical to your bank's real page. When you enter your username and password, the thief captures it and logs in for real.
Your bank will never ask you to click a link in an email and log in. If you receive an email claiming to be from your bank, go directly to your bank's website by typing the address into your browser—do not click the link in the email. Call your bank's customer service number on the back of your card to verify whether the email is real.
Other common methods include data breaches at retailers or other websites where you have an account, malware on your computer that logs your keystrokes, public WiFi networks where a thief intercepts your traffic, and social engineering calls where someone pretends to be your bank and tricks you into revealing your password or PIN.
What to do when ready if you discover theft
Call your bank's fraud line right now—the number is on the back of your card. Tell them which transactions are unauthorized. Ask them to freeze your account, cancel your debit card, and issue a new one. Ask them to place a fraud alert on your account so that any future login attempts from a new device require additional verification.
Check your credit report for accounts you did not open. You can view your credit report for free once per year at annualcreditreport.com, which is the only official site authorized by the Federal Trade Commission. If you see accounts you did not open, contact the creditor and dispute them.
Place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to contact one bureau—they are required to notify the other two. The alert lasts one year and is free.
If the theft involved your Social Security number or personal information, consider a credit freeze. A credit freeze prevents anyone, including you, from opening new accounts in your name without unfreezing it first. It is free and lasts until you unfreeze it. A freeze is stronger than an alert but more inconvenient if you need to open new accounts yourself.
Your timeline for reporting and what it costs you
| When You Report | Your Maximum Liability | Bank's Investigation Timeline |
|---|---|---|
| Before the card is used | $0 | N/A |
| Within 2 business days of discovering fraud | $50 | 10 business days (can extend to 45) |
| Between 2 and 60 days after statement arrival | $500 | 10 business days (can extend to 45) |
| After 60 days | Potentially the full amount | Bank may refuse to investigate |
The clock starts when your statement arrives, not when the fraud happened. If your statement shows a fraudulent charge on January 15, you have until March 16 to report it (60 days later). After that date, your bank has no legal obligation to return your money.
What your bank will ask you during the investigation
Your bank will want to know the exact date and amount of each unauthorized transaction, whether you recognize the merchant or location, whether you have shared your password or PIN with anyone, whether you use the same password on other websites, and whether you noticed any suspicious activity before the fraud occurred.
They will also ask whether you received any emails or calls asking you to verify your identity, whether you clicked any links in emails claiming to be from the bank, and whether you logged into your account on public WiFi. Answer honestly. If you made a mistake—like using the same password everywhere or clicking a phishing link—say so. Banks are more likely to side with you if you are honest about what happened than if they discover you were careless after the fact.
Keep copies of everything: your written statement of the unauthorized transactions, the date and time you reported it, the name of the bank employee you spoke to, and any written confirmation the bank sends you. If the bank denies your claim, you will need this documentation to dispute it.
Frequently Asked Questions
Can my bank refuse to give my money back?
Yes, if they find you authorized the transaction or were negligent with your password. They can also refuse if you report more than 60 days after your statement arrives. If your bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator, but you will not automatically get the money back.
How long does it take to get my money back?
Your bank must return the money while they investigate, which usually takes 10 business days. If they need more time, they can extend the investigation to 45 days, but they must return your money by then if you reported within 60 days. Wire transfers sent to another bank take much longer—sometimes weeks or months—because the receiving bank must cooperate.
What if the thief emptied my entire account?
Your bank must return all unauthorized transfers under Regulation E, up to the limits described above. If the theft happened more than 60 days ago, your bank may refuse to investigate, but you can still file a complaint with the Consumer Financial Protection Bureau. Some banks will work with you even after 60 days if you have a good reason for the delay.
Do I need to file a police report?
No, but you can. Filing a police report creates a record that may help if the thief is caught and prosecuted. It also gives you a report number you can provide to your bank and credit bureaus. Police are unlikely to investigate unless the amount is very large, but the report itself is free and takes about 15 minutes.
Will my bank close my account after fraud?
Some banks will close your account if you have been the victim of fraud multiple times, especially if they suspect you are being targeted by scammers. Most will not. If your bank closes your account, they must give you at least 30 days' notice and return any remaining balance. You can open an account at another bank when ready.