Yes, a scammer can take money directly from your bank account if they have certain information about you

A scammer does not need your debit card or login credentials to drain your account. They can pull money out using your routing number and account number alone—the same numbers printed on the bottom left of your checks. They can also use your Social Security number, driver's license number, or information from a data breach to set up unauthorized transfers or create fake accounts in your name. The method depends on what information they have and how much time they have before you notice.

The good news is that federal law limits your liability, and your bank has a legal obligation to investigate. But speed matters. The moment you notice unauthorized activity, the clock starts on your protection window. Waiting weeks to report it can cost you money that you may not recover.

Key Takeaways

  • Scammers can initiate transfers using only your routing number, account number, and name—information that appears on your checks or can be found in public records.
  • Federal law (Regulation E) limits your liability to $50 if you report unauthorized transfers within two business days, but waiting longer can increase your loss to $500 or more.
  • You must report the fraud to your bank in writing within 60 days to preserve your legal protection, even if you call first.
  • Your bank must investigate and return your money within 10 business days if the transfer was clearly unauthorized, though some cases take longer.
  • Scammers often use information from data breaches, phishing emails, or public records rather than stealing your physical card.

The methods scammers use to access your account

ACH transfers are the most common way a scammer moves money out of your account without your card. ACH stands for Automated Clearing House—it is the system banks use to move money between accounts. A scammer who has your routing number, account number, and name can initiate an ACH transfer to their own account or a money mule's account. Your bank does not verify identity the way a credit card processor does; they assume the person initiating the transfer has authority to do so.

Check fraud works similarly. A scammer with your account number can write checks against your account, either by ordering counterfeit checks or by using the information to create digital checks through a bill-pay service. The check clears before you notice it is missing from your checkbook.

Account takeover happens when a scammer uses your Social Security number, date of birth, and other personal details to convince your bank's customer service that they are you. They then change your password, add a new phone number, and transfer money out. This usually requires information from a data breach or a phishing email that tricks you into giving up your login details.

Debit card fraud is different—a scammer uses a stolen or counterfeit card with your account number. This is easier to dispute than an ACH transfer because card transactions have stronger fraud protections built in.

What information puts your account at risk

Your routing number and account number are the most dangerous combination. These appear on every check you write and are not secret. If a scammer has both, they can initiate an ACH transfer. You may have shared these numbers with a landlord, employer, or contractor for legitimate reasons—but if that person's records are breached or if you gave them to someone who was not legitimate, your account is exposed.

Your Social Security number combined with your name and date of birth allows a scammer to call your bank and impersonate you. They do not need your password if they can answer security questions or convince a representative that they are you. This information is often available from data breaches, phishing emails, or public records.

Login credentials (username and password) give a scammer direct access to your online banking. They can change your contact information, set up transfers, and lock you out of your own account. Phishing emails are the most common way scammers get this information—they send you a fake login page that looks identical to your bank's site.

Your debit card number alone is less dangerous than your account number because card transactions have stronger fraud protections. But combined with your CVV and expiration date, it can be used for online purchases or to create a counterfeit card.

Your legal protection and the 60-day window

Regulation E is the federal rule that protects you. If you report an unauthorized transfer within two business days, your liability is capped at $50. If you wait longer than two business days but report it within 60 days, your liability can be up to $500. If you wait longer than 60 days, you may lose all the money and have no legal recourse.

The clock starts when the unauthorized transaction appears on your statement or when you discover it, whichever comes first. "Two business days" means two days the bank is open—Saturday, Sunday, and federal holidays do not count. If you discover fraud on a Friday evening, you have until Monday to report it and keep your liability at $50.

You must report the fraud in writing to preserve your legal protection. A phone call is a good first step and will usually freeze your account when ready, but your bank may ask you to follow up with a written statement, email, or form. Do this within 24 hours of your phone call. Some banks have online dispute forms; others require a signed letter. Ask your bank what they need and get confirmation in writing that they received it.

Your bank must investigate and tell you the outcome within 10 business days if the transaction is clearly unauthorized. If the investigation is more complex, they have up to 45 days. During the investigation, they must return your money temporarily so you have access to it, even if they are still investigating whether the transaction was truly fraudulent.

Steps to take when ready after discovering unauthorized activity

Call your bank's fraud line right now. Do not use the number on the back of your card if you are calling from a phone that may be compromised. Look up the number on your bank's official website or your statement. Tell them you have unauthorized transactions and ask them to freeze your account and debit card when ready. They will usually do this within minutes.

Ask them to send you a fraud dispute form. Some banks call this a "claim form" or "unauthorized transaction form." Get the name of the representative you spoke to, the date and time of the call, and a reference number. Write all of this down.

Complete the form and return it within 24 hours. Include the date, amount, and description of each unauthorized transaction. Attach any evidence you have—screenshots of your statement, emails from the scammer, or records of when you discovered the fraud. Send it by email if your bank offers that option, or by certified mail if you must mail it. Keep a copy for yourself.

Monitor your account daily for the next 30 days. Scammers sometimes make multiple attempts. If you see another unauthorized transaction, report it when ready using the same process. Each transaction is a separate dispute.

Place a fraud alert on your credit report. Contact Equifax, Experian, or TransUnion—you only need to contact one, and they will notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. This is free and lasts one year. You can renew it if needed.

Consider a credit freeze. This is stronger than a fraud alert. A freeze prevents anyone, including you, from opening new accounts in your name without unfreezing it first. It is free and lasts until you remove it. If you freeze your credit, you will need to unfreeze it temporarily if you want to open a new account or explore for credit.

What happens if your bank denies your dispute

If your bank investigates and concludes the transaction was authorized, you have the right to appeal. Ask them in writing what evidence they used to reach that conclusion. If they say you authorized the transaction, ask them to provide the authorization—a signed form, a recorded phone call, or a log of your login activity. Many banks cannot produce this evidence, and you can escalate the dispute.

You can file a complaint with your bank's regulator. If your bank is a national bank (has "National" in its name or "N.A." after its name), contact the Office of the Comptroller of the Currency (OCC) at occ.gov. If it is a state bank, contact your state's banking regulator. If it is a credit union, contact the National Credit Union Administration (NCUA). These agencies can force your bank to reconsider.

You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB does not resolve individual disputes, but they track complaints and can take action against banks that have a pattern of denying legitimate fraud claims.

How to prevent scammers from accessing your account in the first place

Do not share your routing number and account number with anyone you do not trust completely. If a landlord, employer, or contractor asks for these numbers, ask why they need them and whether they can use your debit card instead. Legitimate businesses usually have other ways to process payments.

Use a strong, unique password for your online banking—at least 12 characters with uppercase, lowercase, numbers, and symbols. Do not reuse passwords across different websites. If one website is breached, a scammer can use that password to try your bank account.

Enable multi-factor authentication on your bank account if it is available. This means your bank will send you a code via text or email every time someone logs in from a new device. Even if a scammer has your password, they cannot access your account without this code.

Check your bank statement every week, not just once a month. The faster you catch unauthorized activity, the more protection you have. Set up account alerts if your bank offers them—many banks will text or email you when a large transfer is initiated or when your balance drops below a certain amount.

Be skeptical of emails and texts that ask you to "verify your account" or "confirm your identity." Banks do not ask for passwords or account numbers via email. If you receive a suspicious message, call your bank directly using the number on your statement.

Frequently Asked Questions

Can a scammer drain my entire bank account?

Yes, if they have your routing number, account number, and name, they can initiate an ACH transfer for any amount. However, your bank may flag unusually large transfers and contact you before processing them. Your legal liability is capped at $50 if you report it within two business days, so you will not lose money permanently if you act quickly.

How long does it take to get my money back?

Your bank must return the money temporarily within 10 business days so you have access to it during the investigation. The full investigation can take up to 45 days. If the bank concludes the transaction was unauthorized, the money is yours permanently. If they conclude it was authorized, you can appeal or file a complaint with their regulator.

Will my bank catch the fraud before I do?

Sometimes. Banks use automated systems to flag suspicious activity—large transfers, transfers to new accounts, or transfers at unusual times. But these systems are not perfect, and many fraudulent transfers go through without triggering an alert. Do not rely on your bank to catch it; check your statement yourself.

What if the scammer used my information to open a new account in my name?

This is account takeover, not just unauthorized transfers. Report it to your bank when ready and ask them to close the fraudulent account. Then place a fraud alert and consider a credit freeze. Contact the three credit bureaus and ask them to add a note to your credit report explaining that accounts opened after a certain date may be fraudulent.

Can I get my money back if I wait more than 60 days to report it?

You lose your legal protection under Regulation E after 60 days, but you may still be able to recover the money through other means. Your bank may have its own fraud policy that extends beyond 60 days. You can also file a complaint with the CFPB or your bank's regulator. However, waiting longer makes recovery much harder, so report fraud as soon as you discover it.