Yes, someone can steal from your savings account — here's how it happens
Theft from a savings account is real and happens through several routes: someone with access to your login credentials, a fraudster who intercepts a wire transfer or ACH payment, a data breach at your bank, or an authorized user you trusted who takes money without permission. The theft might be small and gradual or a single large withdrawal. The good news is that federal law limits your liability in most cases, and your bank has a process to investigate and recover funds.
The speed of recovery depends on how the theft happened and how quickly you report it. If you catch it within two business days, your liability is capped at $50 under the Electronic Funds Transfer Act. If you wait longer, your liability can climb to $500 or more. The bank will not automatically refund you — you have to report it and file a dispute.
Key Takeaways
- Report suspected theft to your bank when ready by phone, not email, and follow up in writing within two business days to protect your liability cap.
- Your liability is limited to $50 if you report within two business days, but can reach $500 or more if you wait longer.
- The bank must investigate and either refund you or explain why they will not within 10 business days, though the full investigation can take 45 days.
- Freeze your credit with the three major bureaus (Equifax, Experian, TransUnion) if the theft involved identity theft or a data breach.
- Change your passwords, enable two-factor authentication, and review your account statements monthly to catch theft early.
The most common ways money disappears from a savings account
Compromised login credentials are the most frequent entry point. A fraudster obtains your username and password through phishing emails, malware on your computer, or a data breach at another company where you reused the same password. Once inside, they can transfer money out or change your contact information to hide the theft.
Unauthorized ACH transfers happen when someone uses your account number and routing number (both printed on your checks) to pull money out. They do not need your password. ACH is the system banks use for direct deposits and bill payments, and fraudsters exploit it because the initial transaction often clears before the bank catches it.
Authorized users who steal are a different problem. If you added a family member or partner to your account, they have full access and can withdraw money legally — the bank will not reverse it as theft. This is a civil matter between you and that person, not a banking fraud case.
Data breaches at your bank expose account numbers, Social Security numbers, and sometimes passwords. The bank is liable for losses if the breach was their fault, but you still have to report the theft and file a dispute to trigger the investigation.
What to do the moment you notice missing money
Call your bank's fraud line when ready — do not wait for business hours or send an email. The phone call starts the clock on your liability protection. Have your account number ready and be specific: the date you last verified the balance, the date you noticed the discrepancy, and the amount missing.
The bank will place a temporary hold on your account while they investigate, which means you may not be able to withdraw funds for a few days. This is normal and protects both you and the bank from further fraud. Ask the representative for a reference number and the name of the investigator assigned to your case.
Follow up in writing within two business days. Send a letter or email to the address the bank provides, stating the date you called, the amount missing, and the dates of the unauthorized transactions. Keep a copy. This written record is your proof that you reported it on time and locks in your $50 liability cap.
How the bank investigates and what the timeline looks like
The bank must acknowledge your dispute within one business day and begin investigating when ready. Within 10 business days, they will either refund the money or send you a letter explaining why they will not. If they need more time, they can extend the investigation to 45 days, but they must refund you provisionally (temporarily) while they continue.
The investigation includes reviewing the transaction details, checking whether your account was accessed from an unusual location or device, and confirming whether you authorized the transfer. If the bank finds the transaction was unauthorized, they refund you in full. If they find you authorized it or cannot prove otherwise, they may deny the claim — but you can dispute that decision.
The timeline varies by bank and by how complicated the fraud is. A straightforward case with clear evidence of unauthorized access might resolve in 10 days. A case involving multiple transactions or a compromised password might take the full 45 days.
Your liability limits and what they depend on
| When You Report | Your Maximum Liability | What This Means |
|---|---|---|
| Within 2 business days | $50 | You lose at most $50 of the stolen amount; the bank covers the rest. |
| 3 to 60 calendar days after the statement | $500 | You lose at most $500; the bank covers the rest. |
| More than 60 calendar days after the statement | Unlimited | You may lose the entire amount if the bank can prove negligence on your part. |
These limits explore under the Electronic Funds Transfer Act, which covers most consumer accounts. Business accounts and money market accounts may have different rules — check your account agreement.
The "statement date" is when your bank sends or makes available your monthly statement, not when you receive it in the mail. Many banks now post statements online when ready, so the clock starts sooner than you might think. Review your statements as soon as they are available, not weeks later.
Steps to prevent theft before it happens
Use a unique, strong password for your bank account — do not reuse passwords from other websites. A password manager like Bitwarden or 1Password makes this easier. Enable two-factor authentication (also called 2FA) on your bank account if the bank offers it. This requires a second form of verification, usually a code sent to your phone, when you log in from a new device.
Do not share your account number, routing number, or Social Security number in emails or texts. Legitimate companies will never ask for these by email. Be skeptical of emails claiming to be from your bank, even if they look official — fraudsters are skilled at mimicking bank emails. When in doubt, call the number on the back of your debit card instead of clicking a link in the email.
Monitor your account regularly. Log in at least once a week and review recent transactions. Many banks let you set up alerts for transactions over a certain amount or for any withdrawal from your account. Use these alerts — they are free and catch theft fast.
If you use online bill pay, review the list of payees you have set up. Fraudsters sometimes add themselves as a payee and schedule transfers. Delete any payee you do not recognize.
What to do if the bank denies your dispute
If the bank investigates and concludes the transaction was authorized or that you were negligent, they will send you a written decision explaining their reasoning. You have the right to dispute that decision. Request the bank's documentation of the investigation — this includes the IP address and device used to access your account, the time of the transaction, and any other evidence they collected.
If you believe the bank made an error, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will forward your complaint to the bank, which must respond within 15 business days. This does not automatically reverse the bank's decision, but it creates a record and sometimes prompts the bank to reconsider.
If the theft involved identity theft — meaning someone opened accounts in your name or used your Social Security number — contact the Federal Trade Commission at identitytheft.gov. They will help you create a recovery plan and provide documentation you can use with creditors and banks.
Frequently Asked Questions
How long does it take to get my money back?
The bank must refund you provisionally within 10 business days if they cannot complete the investigation by then. A full refund usually comes within 45 days. Some banks refund faster if the fraud is obvious, but do not count on it. In the meantime, you may have limited access to your account.
What if someone used my account number to set up a recurring payment?
Report it when ready. The bank will cancel the recurring payment and investigate the initial transaction. You are liable for only the first unauthorized transaction under most circumstances, not for repeated charges that should have been caught. However, if you ignored warnings or failed to review your statement, the bank may argue you were negligent.
Can my bank refuse to refund me if I was careless with my password?
The bank can try to argue negligence, but the burden is on them to prove it. straightforward having a weak password is not negligence under federal law. Negligence means you ignored obvious red flags — like leaving your password written on a sticky note on your desk or sharing it with someone. If the bank denies your claim based on negligence, you can dispute that decision with the CFPB.
What if the thief is someone I know — a family member or roommate?
If they are an authorized user on the account, the bank will not treat it as fraud. You would have to remove them from the account and pursue the matter through small claims court or civil court. If they accessed the account without authorization, report it as fraud even though you know who they are.
Do I need to close my account after theft?
Not necessarily. Closing the account does not erase the fraud from your record, and opening a new account takes time. Instead, change your password, enable two-factor authentication, and monitor the account closely for 60 days. Close it only if the bank cannot explain how the theft happened or if you have lost confidence in their security.