What happens when someone withdraws from your account without your consent
Yes, someone can withdraw from your bank account without your permission — but not legally, and your bank has specific obligations to help you recover the money. The key distinction is between authorized transactions (you gave permission, even if you regret it) and unauthorized transactions (someone took money without your consent). Your bank's liability and your recovery timeline depend entirely on which one happened.
If someone accessed your account without your knowledge, you have legal protections under federal law. The Electronic Funds Transfer Act (EFTA) limits your liability for unauthorized transfers, and your bank must investigate and often reimburse you within a defined window. But you have to report it quickly — waiting weeks or months to tell your bank weakens your case and may eliminate your protection entirely.
Key Takeaways
- Report unauthorized withdrawals to your bank within two business days to limit your liability to $50; waiting longer can expose you to losses up to $500 or more.
- Your bank must investigate within ten business days and either restore your money or explain in writing why they will not.
- Authorized transactions — where you gave permission but later regret it — are not covered by EFTA protections and are much harder to reverse.
- Freezing your account, changing your password, and reviewing your transaction history are your first steps while the bank investigates.
- If your bank refuses to investigate or reimburse you, you can file a complaint with your bank's regulator, usually the Federal Reserve, OCC, or FDIC.
The difference between authorized and unauthorized withdrawals
An authorized transaction is one where you gave permission — directly or indirectly. This includes checks you wrote, debit card purchases you made, ACH transfers you set up, or standing orders you authorized. Even if you later change your mind, regret the purchase, or claim you did not understand what you were signing, the transaction is still authorized in the legal sense. Your bank will not reverse it, and you have no EFTA protection.
An unauthorized transaction is one where someone else accessed your account and moved money without your knowledge or consent. This includes someone using your debit card, guessing your PIN, accessing your online banking login, or convincing a bank employee to process a transfer. It also includes transactions made by someone you gave limited permission to — for example, if you let a family member use your debit card for groceries and they withdrew $500 cash instead.
The line between them matters because your legal remedies are completely different. Unauthorized withdrawals trigger EFTA protections and your bank's investigation duty. Authorized ones do not, and you are stuck negotiating with the merchant or the person who took the money.
How to report an unauthorized withdrawal and protect yourself when ready
Call your bank's fraud line as soon as you notice the withdrawal. Do not wait for a statement or for the transaction to "post" — call the moment you see it, even if it is pending. Most banks have a 24-hour fraud number on the back of your debit card or on their website. Tell them the transaction is unauthorized, the date it occurred, and the amount.
Your bank will ask you to confirm your identity and may ask whether you recognize the merchant or location. Be clear: you did not authorize this transaction, you do not know who made it, and you want it reported as fraud. The bank will then freeze the transaction if it is still pending, or begin an investigation if it has already posted.
After the call, follow up in writing. Send an email or letter to your bank's fraud department restating that the transaction was unauthorized, the date, the amount, and the merchant. Include your account number and the reference number from your phone call. Keep a copy. This creates a paper trail and protects you if the bank later claims you never reported it.
Change your online banking password when ready, even if you do not know how the person accessed your account. If you use the same password on other accounts, change those too. Check whether your debit card was physically lost or stolen; if not, request a new card anyway. Review your recent transactions for other suspicious activity — unauthorized withdrawals often come in clusters.
What your bank must do during the investigation
Once you report an unauthorized withdrawal, your bank has ten business days to investigate and either restore your money or tell you in writing why they will not. In practice, many banks restore the money within two to three business days while the investigation continues in the background. Some banks restore it when ready as a courtesy, though they are not legally required to.
During the investigation, the bank will contact the merchant (if applicable), review the transaction details, and check whether the transaction matches your usual spending patterns. They will also ask you for any additional information — such as whether you shared your PIN, whether you received a suspicious email or text, or whether anyone had access to your physical card.
If the bank determines the transaction was unauthorized, they must restore your full account balance, including any overdraft fees or interest charges that resulted from the withdrawal. If they determine it was authorized — for example, if you gave someone permission and they exceeded that permission — they may deny your claim. In that case, they must explain their reasoning in writing.
If the investigation takes longer than ten business days, the bank must restore your money provisionally while they continue investigating. You get access to the funds, but the bank can reverse the credit if they later determine the transaction was authorized.
Your liability limits under federal law
The Electronic Funds Transfer Act caps your liability for unauthorized transactions, but the amount depends on how quickly you report it:
| Reporting Timeline | Your Maximum Liability |
|---|---|
| Within 2 business days of discovering the unauthorized transaction | $50 |
| Between 2 and 60 calendar days after your statement is mailed | $500 |
| More than 60 calendar days after your statement is mailed | Unlimited — you may lose the entire amount |
These limits assume you report the transaction to your bank, not to the police or a credit bureau. Reporting to those agencies does not trigger EFTA protections. You must contact your bank directly.
The 60-day window is measured from when your bank mails your statement, not from when the transaction occurred. If your statement arrives on the 15th and shows a fraudulent transaction from the 10th, you have until the 14th of the following month to report it. If you do not receive a statement (for example, if you only use online banking), the clock still runs — it is measured from when the bank would have mailed it.
When someone you know makes unauthorized withdrawals
If a family member, roommate, or someone you trusted took money from your account without permission, the process is the same: report it to your bank as unauthorized. Your personal relationship to the person does not change your legal rights. Many people hesitate to report a family member, but your bank does not care about the relationship — they care about whether you authorized the transaction.
Be prepared for your bank to ask whether you gave this person access to your account in any form. If you gave them your debit card, PIN, or online banking password for any reason, the bank may argue the transaction was authorized. If you did not give them access and they obtained it through theft or deception, the transaction is clearly unauthorized.
If the person is still in your life and you want to resolve it privately, you can do that — but report it to the bank first. Once the bank restores your money, you can negotiate repayment with the person directly. If you do not report it and later try to reverse it, your bank will likely refuse because too much time has passed.
What to do if your bank denies your claim
If your bank investigates and concludes the transaction was authorized, they will deny your claim in writing. They must explain their reasoning. Read the explanation carefully — sometimes banks make mistakes, and you can appeal.
If you disagree with the bank's decision, you can file a complaint with your bank's regulator. Most banks are regulated by one of three federal agencies: the Federal Reserve, the Office of the Comptroller of the Currency (OCC), or the Federal Deposit Insurance Corporation (FDIC). You can find out which one regulates your bank by visiting the FDIC's bank finder tool or calling the bank's main line and asking.
File a complaint with the appropriate regulator in writing, including copies of your bank statements, the bank's written denial, and any documentation of your communications with the bank. The regulator will contact the bank and ask them to respond. This process can take several weeks, but regulators take unauthorized transaction complaints seriously and often pressure banks to reverse denials.
You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB does not have the power to force your bank to pay you, but they track complaints and can take enforcement action against banks that systematically deny legitimate fraud claims.
Preventing unauthorized withdrawals going forward
Use a strong, unique password for your online banking account — at least 12 characters, mixing letters, numbers, and symbols. Do not use the same password on multiple accounts. Enable two-factor authentication if your bank offers it; this requires you to enter a code sent to your phone or email before logging in, even if someone has your password.
Do not share your PIN, password, or debit card with anyone, even family members. If someone needs to make a purchase on your behalf, give them cash or a gift card instead. Review your account weekly, not just when your statement arrives. Most fraudulent withdrawals are caught within days if you are checking regularly.
Consider using a separate account for online purchases or bill payments, with a lower balance than your main account. This limits your exposure if that account is compromised. Some banks offer virtual card numbers for online shopping — a temporary number linked to your real account that expires after one use or one merchant.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
Most banks restore the money within two to three business days as a courtesy while they investigate. By law, they must either restore it or explain why they will not within ten business days. If the investigation takes longer, they must give you provisional access to the funds while they continue.
Can my bank refuse to investigate because I shared my password with someone?
No. Even if you shared your password, your bank must investigate if you claim the transaction was unauthorized. However, the bank may conclude that sharing your password means you authorized the transaction, and they can deny your claim on that basis. You can appeal that decision to your bank's regulator.
What if the unauthorized withdrawal caused me to overdraft and incur fees?
If the bank determines the transaction was unauthorized, they must restore your full account balance, including any overdraft fees or interest charges that resulted from it. You should not have to pay those fees.
Do I need to file a police report to recover the money?
No. Filing a police report is separate from reporting fraud to your bank. You do not need a police report to trigger EFTA protections, and reporting to police does not count toward your 60-day important date. Report to your bank first, then file a police report if you want a record for your own purposes.
What if someone used my debit card number online but did not have the physical card?
Report it to your bank as unauthorized. The bank will investigate how the person obtained your card number — whether through a data breach, a phishing email, or another method. Your liability limits and the bank's investigation duty are the same whether the card was physically stolen or the number was compromised.