Yes, someone can steal from your savings account, but the method matters

Money leaves a savings account without your permission through a small number of specific routes: someone uses your debit card or card number, logs into your online account with your password, sets up an unauthorized transfer, or convinces your bank to move funds by impersonating you. Each route has different speed, different detection methods, and different protections. The bank does not automatically refund you for all of them—what you get back depends on how the theft happened and how quickly you report it.

The most common theft is card fraud: someone uses your debit card number (either the physical card or just the number) to make a purchase or withdrawal. This is also the theft you are most protected against. Federal law caps your liability at $50 if you report it within two business days, and $500 if you report it within 60 days. After 60 days, you may lose everything taken.

The slower and often more damaging theft is account takeover: someone obtains your login credentials and transfers money out of your account into theirs. This can happen through phishing emails, password reuse across websites, or malware on your computer. Once the money leaves your account, recovery is harder because the bank sees an authorized transaction from your credentials, even though you did not authorize it.

Key Takeaways

  • Debit card fraud is capped at $50 liability if reported within two business days, but account takeover (someone logging in with your password) has weaker protections and may require you to prove you did not authorize the transfer.
  • Money stolen through unauthorized transfers or ACH payments is not covered by the same federal rules as card fraud, and recovery depends on your bank's fraud investigation.
  • Your bank is required to investigate unauthorized transfers, but you must report them within 60 days to preserve your rights—after that, the burden shifts to you to prove the theft.
  • The fastest way to stop ongoing theft is to call your bank when ready and freeze or close the account, which stops new transfers before they clear.
  • Monitoring your account weekly (not monthly) catches most thefts within days rather than weeks, which matters because some banks process refunds faster when you report early.

How card fraud happens and what your bank must do

Card fraud occurs when someone uses your debit card number—either because they stole the physical card, photographed it, or obtained the number from a data breach—to make a purchase or ATM withdrawal. The transaction appears in your account within hours or days. Your bank sees the transaction as valid because it came through the normal payment network with the correct card number and PIN (if an ATM withdrawal) or signature (if a purchase).

Federal law (Regulation E) requires your bank to refund you if you report the fraud within two business days. The bank must credit your account within one business day of confirming the fraud. If you report between two and 60 days, the bank must still investigate and refund you, but they have up to 10 business days. After 60 days, you have no federal protection, though some banks may still help you if you can prove you did not make the transaction.

The catch: you are liable for up to $50 of the fraud if you report it late, and liable for all of it if you report after 60 days. Some banks waive the $50 fee as a customer service gesture, but they are not required to. A few banks offer zero-liability policies that cover you even if you report late, but this is a marketing choice, not a legal requirement.

Account takeover: when someone logs in as you

Account takeover is theft through your online banking login. Someone obtains your username and password (usually through phishing, a data breach at another website where you reused the password, or malware) and logs into your account to transfer money out. The bank sees the login from your credentials and the transfer request from inside your account, so it looks authorized to their systems.

This theft is harder to recover from because Regulation E's protections are weaker. The bank must still investigate if you report within 60 days, but they have up to 10 business days to refund you—and only if they determine the transfer was truly unauthorized. If the bank believes you authorized it (perhaps because the login came from a device you normally use, or from your home IP address), they may deny the claim.

Your defense is documentation: you need to show you did not make the transfer. This means providing your bank with evidence that you were not at your computer, that you did not receive a confirmation email you would normally receive, or that the transfer went to an account you do not recognize. Some banks ask you to file a police report to strengthen your claim, though this is not required by law.

Unauthorized transfers and ACH payments

An unauthorized transfer is money moved out of your account via ACH (Automated Clearing House), wire transfer, or bill pay without your permission. This usually happens because someone obtained your account number and routing number (information that appears on every check you write) and set up a transfer or bill payment in your name.

ACH transfers take one to three business days to clear, which gives you a window to stop them if you catch the pending transaction. Once cleared, the money is in another bank account, and recovery requires the receiving bank to reverse the transfer—a process that can take weeks.

Regulation E covers unauthorized ACH transfers, but with a condition: you must report them within 60 days. The bank then has 10 business days to investigate and refund you. However, if the bank determines that you authorized the transfer (for example, if you signed up for a service that later charged you), they may deny the claim. This is why documentation matters: keep records of what services you actually signed up for, and report any transfer you do not recognize when ready.

What happens when you report theft to your bank

Call your bank's fraud line when ready—do not email or use online chat for the initial report, because you need a timestamp and a case number. Tell them which transaction is fraudulent, when you first noticed it, and whether you recognize the merchant or receiving account. The bank will freeze or close your account to stop further transfers, issue you a new debit card, and open a fraud investigation.

During the investigation, the bank contacts the merchant (if card fraud) or the receiving bank (if a transfer) to gather evidence. They ask whether the transaction matches the merchant's normal pattern, whether the receiving account is new, and whether there are other fraudulent transactions from the same source. This usually takes five to ten business days.

Once the investigation closes, the bank either refunds you or denies the claim. If they refund you, the money appears in your account within one to three business days. If they deny it, you can dispute the decision by requesting a supervisor review, but you will need to provide additional evidence—usually a police report or documentation that you did not authorize the transaction.

How to reduce your risk of account theft

Use a unique password for your bank account—not one you use anywhere else. If another website is breached and your password is exposed, a thief can try that same password on your bank account. A password manager (like Bitwarden, 1Password, or KeePass) generates and stores unique passwords so you only have to remember one master password.

Enable two-factor authentication (2FA) on your bank account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this through their security settings, though some charge a small fee or require you to opt in.

Monitor your account weekly, not monthly. Check your transactions every few days, especially after making a purchase or visiting an ATM. Most thefts are caught within the first week; the longer you wait, the more money may be taken and the harder recovery becomes. Set up account alerts if your bank offers them—many banks can email or text you when a transaction over a certain amount occurs.

Do not share your debit card number, PIN, or online banking password with anyone, including bank employees. Your bank will never ask for your password. If someone calls claiming to be from your bank and asks for this information, hang up and call your bank's main number (from your statement or their website) to verify the call was real.

What you are not protected against

If you voluntarily give your account number to someone and they steal from you, your bank may not refund you. For example, if you send money to a scammer who promises to return it with interest, or if you pay someone to "fix" your credit, you have authorized the transfer even though the other person is committing fraud. The bank sees an authorized transaction and has no obligation to reverse it.

Similarly, if you use your debit card to pay for something and the merchant never delivers the goods (a purchase dispute rather than fraud), your bank may not refund you. Debit card purchase disputes are handled differently than fraud, and your protections are weaker. This is one reason credit cards are safer for online purchases—credit card companies have stronger purchase protection rules.

If you share your login credentials with someone (a family member, a financial advisor, or a scammer posing as one), the bank may consider any transfers they make to be authorized by you. Sharing credentials is risky because the bank cannot distinguish between you and the person you gave the password to.

Frequently Asked Questions

How long does it take to get money back after I report fraud?

If you report within two business days, the bank must refund you within one business day. If you report between two and 60 days, they have up to 10 business days to investigate and refund you. After 60 days, you have no federal protection and recovery depends on your bank's discretion. In practice, most refunds appear within three to five business days once approved.

Can my bank refuse to refund me if I was careless with my password?

No. Federal law does not allow banks to deny fraud claims based on negligence. However, if you voluntarily shared your password or account number with someone, the bank may argue you authorized the transaction. The difference is between being careless (weak password, reused password) and being complicit (giving your credentials to someone).

What should I do if my debit card is lost or stolen?

Call your bank when ready to report it lost. Your liability for fraudulent charges is $50 if you report within two business days, and $500 if you report within 60 days. The bank will cancel the card and mail you a new one, usually within five to seven business days. Ask for a temporary card or emergency cash advance while you wait.

Does my bank have to investigate if I report fraud after 60 days?

No. After 60 days, you lose your federal protections under Regulation E. Some banks may still investigate as a courtesy, but they are not required to refund you. This is why reporting quickly matters—the 60-day window is your legal important date, not a suggestion.

Can someone steal money if I only give them my account number and routing number?

Yes. With your account number and routing number, someone can set up an ACH transfer or bill payment in your name. This is why you should not write checks to strangers or give this information to anyone you do not trust. If unauthorized transfers occur, report them within 60 days and your bank must investigate.