Yes, scammers can steal money directly from your bank account—but the method matters for how you recover it
Scammers can move money out of your bank account through several routes: they can trick you into handing over your login credentials, use stolen account numbers to set up unauthorized transfers, or pose as your bank to intercept payment information. The speed of the theft and your chances of recovery depend on which method they used and how quickly you notice.
The good news is that bank accounts have more legal protection than other payment methods. Federal law limits your liability for unauthorized transfers, and banks are required to investigate claims within specific timeframes. But you have to report the theft quickly—waiting weeks or months makes recovery much harder.
Key Takeaways
- Scammers access bank accounts most often through phishing emails, fake login pages, or by tricking you into revealing your credentials over the phone.
- Federal law (Regulation E) limits your liability to $50 if you report unauthorized transfers within two business days, and to $500 if you report within 60 days.
- Your bank must investigate your claim and either restore the money or explain in writing why they will not, usually within 10 business days.
- Money moved to another bank account can sometimes be recovered through the receiving bank, but only if you report it within days, not weeks.
- Scammers who have your login credentials can set up recurring transfers or bill pay, so change your password when ready and review your account settings.
The most common ways scammers access your account
Phishing emails and fake login pages are the most frequent entry point. A scammer sends an email that looks like it came from your bank, asking you to "verify your account" or "confirm your identity." The link goes to a fake website that looks identical to your bank's real site. When you enter your username and password, the scammer captures it and logs in as you.
Real banks never ask you to log in through a link in an email. If you receive an email claiming to be from your bank, go directly to the bank's website by typing the address into your browser—do not click any link in the email.
Phone calls from people posing as your bank work the same way. A scammer calls and says there is suspicious activity on your account, then asks you to "verify" your password, PIN, or card number to "find" it. Legitimate banks will never ask for this information over the phone. If you are unsure, hang up and call your bank's customer service number on the back of your card.
Malware and keyloggers sit on your computer or phone and record everything you type, including passwords and account numbers. You might pick this up by clicking a link in a suspicious email, downloading a file from an untrusted website, or installing what looks like a legitimate app. Once installed, the scammer sees your login credentials in real time.
What happens after a scammer logs into your account
Once a scammer has your login credentials, they can move money in several ways. The fastest is an ACH transfer (Automated Clearing House), which moves money to another bank account. This usually completes within one to three business days. A scammer can also set up bill pay through your bank's system, which sends money to an address they control. Some scammers set up recurring transfers so money leaves your account automatically every week or month until you notice.
The longer the scammer has access, the more damage they can do. They might change your password so you cannot log in, add a new email address or phone number to your account, or set up alerts to go to their email instead of yours. This buys them time before you realize what happened.
If a scammer has your debit card number (but not your PIN), they can attempt to make purchases at stores or online. These show up as pending transactions and can sometimes be stopped before they clear, but not always.
Your legal protection under federal law
Regulation E is the federal rule that protects you when someone uses your account without permission. Your liability depends on how fast you report it:
| When you report it | Your maximum liability | Bank's important date to investigate |
|---|---|---|
| Within 2 business days of noticing the unauthorized transfer | $50 | 10 business days (can extend to 45 days if bank needs more time) |
| Between 3 and 60 calendar days after your statement is sent | $500 | 10 business days (can extend to 45 days) |
| More than 60 calendar days after your statement is sent | Unlimited—you may lose the entire amount | No obligation to investigate |
The clock starts when you receive your statement, not when the fraud happened. If your bank sends statements monthly and a scammer drains your account on the 5th, but you do not receive your statement until the 25th, you have 60 days from the 25th to report it.
This protection applies to transfers initiated through your bank's system (ACH, bill pay, wire transfers). It does not cover debit card fraud or checks, which fall under different rules with longer reporting windows.
How to report unauthorized transfers and what happens next
Call your bank when ready—do not email or use the app. Find the phone number on your statement or the back of your card, not from a Google search. Tell them you have unauthorized transfers and ask them to freeze your account and cancel any pending transfers.
Your bank will ask you to describe what happened, when you first noticed it, and which transactions were not yours. They will likely send you a Regulation E dispute form to sign and return. This form documents your claim and starts the official investigation clock.
The bank must acknowledge your claim in writing within one business day. They then have up to 10 business days to investigate and either restore your money or send you a written explanation of why they will not. If they need more time, they can extend the investigation to 45 days, but they must tell you this in writing and give you a provisional credit (temporary refund) while they investigate.
Do not close the account while the investigation is open. Your bank needs access to the account history to trace where the money went.
Recovering money that left your account
If a scammer transferred your money to another bank account, recovery is possible but depends on speed. ACH transfers can sometimes be reversed within one to three business days if the receiving bank cooperates. After that window closes, the money is much harder to recover.
Your bank will contact the receiving bank and ask them to return the funds. If the receiving bank is legitimate and the account holder is not the scammer themselves, they may freeze the account and return the money. If the receiving account is at a smaller bank or credit union, they may move more slowly.
If the money went to a cryptocurrency exchange, wire transfer service, or overseas account, recovery is extremely unlikely. These services do not have the same obligation to cooperate with banks, and by the time you report it, the money is often already converted or withdrawn.
This is why reporting within 48 hours is critical. The difference between reporting on day two and day five can mean the difference between recovering the money and losing it permanently.
Protecting your account after a breach
Once you have reported the fraud, take these steps when ready:
- Change your password to something long and unique—at least 12 characters with uppercase, lowercase, numbers, and symbols.
- Review your account settings for any changes: new email addresses, phone numbers, or authorized users you did not add.
- Check your bill pay list and cancel any payments you did not set up.
- Look at your linked accounts—if you use your bank login to access other services (investment accounts, credit cards), change those passwords too.
- Turn on two-factor authentication if your bank offers it. This means the scammer cannot log in even if they have your password, because they also need a code sent to your phone or email.
- Set up account alerts for large transfers or logins from new devices.
- Request a new debit card if the scammer had access to your card number.
If malware is the cause, run a full antivirus scan on your computer and phone. Consider having a professional check your devices if you are not comfortable doing this yourself.
What your bank is not required to do
Banks are required to investigate and either restore your money or explain why they will not. They are not required to restore your money just because you ask. If they determine that you were negligent—for example, you wrote your password on a sticky note or shared it with someone—they can deny your claim.
They are also not required to cover losses if you authorized the transfer but were tricked about what it was for. For example, if a scammer convinced you that you owed money and you voluntarily sent it, that is not an unauthorized transfer under Regulation E—it is a scam, and recovery is much harder.
If your bank denies your claim, you can file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB). This does not may provide recovery, but it creates a record and may pressure the bank to reconsider.
Frequently Asked Questions
Can a scammer drain my entire bank account?
Yes, if they have your login credentials and you do not notice for more than 60 days. If you report it within 60 days, your liability is capped at $500. If you report it within 2 business days, your liability is capped at $50. After 60 days, you have no legal protection under Regulation E.
If I report fraud, will my bank give me my money back when ready?
Not always when ready, but usually within 10 business days. Your bank must either restore the money or send you a written explanation of why they will not. If they need more time to investigate, they must give you a provisional credit (temporary refund) while they look into it. You can use this money, but if the bank later determines the transfer was authorized, they can take it back.
What if the scammer transferred my money to another bank?
Your bank will contact the receiving bank and ask them to return it. If the receiving bank cooperates and the account is still open, you may get the money back within a few days. If the money was already withdrawn or transferred elsewhere, recovery is unlikely. This is why reporting within 48 hours is critical.
Do I have to pay my bills while my bank investigates the fraud?
If your bank gives you a provisional credit, you can use that money to pay bills. If they do not, contact your creditors and explain that you are a victim of fraud and your bank is investigating. Many creditors will work with you on late payments if you can show proof of the fraud report.
Can scammers access my account if I use a strong password?
A strong password helps, but it is not enough on its own. Scammers can still access your account through phishing, malware, or by tricking you into revealing it. Two-factor authentication (a code sent to your phone or email) is much more effective because even if a scammer has your password, they cannot log in without that second code.