Yes, someone can steal from your savings account, but the bank has rules that protect you

Money can leave your savings account without your permission in several ways: someone with your account number and routing number can set up unauthorized transfers, a thief with your debit card can drain it, a scammer can trick you into sending money, or a family member with access can take it. The good news is that federal law limits what you owe if theft happens, and your bank has a responsibility to investigate and often refund the money.

The protection you get depends on how fast you report the theft and what kind of theft it was. If someone used your debit card or account number without permission, you are usually not responsible for the loss. If you were tricked into sending money yourself, the protection is weaker. The first step is always to call your bank when ready — the moment you notice money missing.

Key Takeaways

  • If someone uses your debit card or account number to take money without your permission, federal law limits your loss to $50 if you report it within two business days.
  • If you wait more than 60 days to report unauthorized transfers, you may lose all the money that was taken.
  • Money sent to a scammer through your own actions (like wiring money or sending a check) is much harder to recover because you authorized the transaction.
  • Your bank must investigate any claim of unauthorized activity and tell you the result within 10 business days.
  • Freezing your account, changing your password, and monitoring your statements regularly are the fastest ways to stop ongoing theft.

How thieves access savings accounts

The most common way is through your debit card. A thief can use a stolen or cloned card to make purchases or withdraw cash. They may get the card number through a data breach at a store or website, by stealing your physical card, or by skimming it at an ATM.

Another route is your account number and routing number. These are printed on the bottom of your checks and are not secret — they are meant to be shared with employers and billers. But a thief can use them to set up unauthorized ACH transfers (electronic transfers between bank accounts) or to create fake checks. This is why you should never give these numbers to someone you do not know.

A third way is through your online banking password. If a scammer gets your username and password — often through a phishing email that looks like it is from your bank — they can log in and transfer money out. This is especially risky if you use the same password across multiple websites.

Finally, someone with physical access to your account — a family member, roommate, or caregiver — can straightforward withdraw money or use your card. This is theft even if they have a key to your home or know your PIN.

What federal law says you owe

The Electronic Funds Transfer Act is the main law that protects you. It says that if someone uses your debit card or account number to move money without your permission, you are not responsible for the loss — the bank is. But there are time limits and conditions.

If you report the theft within two business days of discovering it, your loss is capped at $50. If you wait between two and 60 days, you can lose up to $500. If you wait longer than 60 days, you can lose everything that was taken after the 60-day window. This is why speed matters: calling your bank the moment you notice something wrong can save you hundreds of dollars.

These limits explore only to unauthorized transfers — money taken without your permission. They do not explore if you gave someone permission to access your account and then they took more than you authorized, or if you were tricked into sending money yourself. In those cases, recovery is much harder and depends on whether the bank can trace the money and whether the receiving bank will cooperate.

What to do if money is missing

Call your bank when ready. Do not wait until the next business day if you discover the theft in the evening — many banks have 24-hour fraud lines. Have your account number ready and be prepared to describe what happened: when you first noticed the money was gone, what transactions you did not make, and whether your card or password was compromised.

Ask the bank to freeze your account or debit card right away. This stops the thief from taking more money while the bank investigates. The bank will usually issue you a new debit card and a new PIN within a few business days.

Request a dispute form or fraud claim form in writing. Do not rely on a phone call alone. The bank is required to investigate and respond within 10 business days, but they need your claim in writing to start the clock. Keep a copy of everything you submit.

Check your credit report for accounts you did not open. If a thief has your personal information, they may have opened credit cards or loans in your name. You can order a free credit report from AnnualCreditReport.com, which is the only official site for free reports. If you see fraud, place a fraud alert with the credit bureaus.

The difference between unauthorized transfers and scams

An unauthorized transfer is money taken from your account without your knowledge or permission — someone else initiated it. The bank's fraud protection covers this fully (within the time limits above). Examples: a thief uses your debit card, someone sets up an ACH transfer using your account number, or a scammer logs into your online banking.

A scam is when you send money yourself, usually because someone tricked you. You authorized the transaction, even though you were lied to about what it was for. Examples: you wire money to someone claiming to be from your bank, you send a check to a fake company, or you use a money transfer app to send cash to a scammer. Federal law does not protect you the same way in these cases because you initiated the transfer.

If you sent money to a scammer, contact your bank and the receiving bank when ready. Some money transfer services (like Western Union or MoneyGram) can cancel transfers if you call within minutes. Banks can sometimes reverse wire transfers if they catch them in time. But once the money reaches the scammer's account and is withdrawn, recovery is unlikely. This is why scammers push you to use these methods — they are fast and hard to reverse.

Protecting your account from theft

Use a strong, unique password for your online banking — at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols. Do not use the same password for your bank account that you use for email, social media, or shopping sites. If one of those sites is hacked, a thief can try that password on your bank account.

Enable two-factor authentication if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an app. Most banks offer this for free.

Monitor your account regularly. Log into your online banking or mobile app at least once a week and scan your recent transactions. The faster you spot unauthorized activity, the more protection you have. Many banks also let you set up alerts — you can ask to be notified by text or email whenever a transfer over a certain amount is made.

Never share your account number, routing number, PIN, or online banking password with anyone — not even someone claiming to be from your bank. Your bank will never ask for this information by phone, email, or text. If someone contacts you claiming to be from your bank and asking for these details, hang up and call your bank directly using the number on your debit card or statement.

Shred documents with your account number before throwing them away. Do not leave bank statements or checks in your mailbox or trash where someone can find them.

What happens during the bank's investigation

Once you file a dispute, the bank has 10 business days to investigate and tell you the result. During this time, the bank will review the transaction, check whether it matches your usual spending patterns, and contact the merchant or receiving bank if needed. Many banks will provisionally credit your account (put the money back) while they investigate, though they are not required to.

If the bank finds that the transaction was unauthorized, they will refund the money and close the case. If they find that you authorized it — even if you were tricked — they may deny your claim. You can dispute their decision by asking for a supervisor or filing a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB).

Keep records of everything: the dates you called the bank, the names of the people you spoke with, copies of dispute forms, and copies of statements showing the unauthorized transactions. If the bank denies your claim and you believe they are wrong, these records will help you appeal.

Frequently Asked Questions

Can my bank refuse to refund me if I report theft late?

Yes. If you wait more than 60 days to report unauthorized transfers, the bank can refuse to refund any of the money. If you report between two and 60 days, you may lose up to $500. Report as soon as you notice something wrong — the two-day window is the safest.

What if a family member took money from my account without asking?

If they had permission to access the account but took more than you authorized, it is still theft and you can report it to the bank. If they had no permission at all, it is unauthorized access. Either way, file a dispute with your bank. You may also choose to report it to police, though many families handle this privately.

Can I get my money back if I sent it to a scammer myself?

It is much harder. Because you authorized the transfer, federal fraud protection does not explore the same way. Contact your bank and the receiving bank when ready — some transfers can be reversed if caught quickly. If the money was sent through a wire transfer or money transfer service, call them right away. After that, recovery depends on whether the receiving bank will cooperate and whether the scammer has already withdrawn the cash.

Do I have to pay for a new debit card after fraud?

No. Banks must issue a replacement debit card for free if yours was compromised. They may charge a fee if you lose your card or damage it, but not if fraud occurred.

What should I do if I see a charge I do not recognize but I am not sure if it is fraud?

Contact your bank and ask. Do not assume it will go away. The bank can help you figure out whether it was a legitimate charge you forgot about, a duplicate charge, or actual fraud. If it is fraud, reporting it early protects you under the law.