Yes, money can be stolen from checking and savings accounts, but the theft usually follows one of a few specific paths

Money leaves your account when someone gains access to it — either by learning your login credentials, intercepting a transaction, or using your debit card number. The theft itself is straightforward: they move money out, and it is gone until you report it and your bank investigates. What matters most is how fast you notice and report it, because your bank's responsibility to refund you depends partly on how quickly you act.

The good news is that federal law limits your liability for unauthorized transactions, and banks have processes to recover stolen funds. The bad news is that the process takes time, and you may be without that money while the investigation happens. Understanding how the theft occurred helps you prevent it from happening again.

Key Takeaways

  • Federal law limits your liability to $50 if you report unauthorized debit card charges within two business days, and to $500 if you report within 60 days.
  • Money stolen through account access (login credentials or wire fraud) may not be covered by the same liability limits, so reporting speed matters even more.
  • Your bank will freeze the account, investigate, and typically refund stolen funds within 10 business days if the theft is confirmed.
  • Thieves most often gain access through phishing emails, password reuse, or data breaches at other companies where you used the same password.

How thieves access checking and savings accounts

The most common entry point is your login credentials. A thief obtains your username and password through a phishing email (a fake message pretending to be from your bank), a data breach at another company, or by watching you type. Once they have your credentials, they log in as you and transfer money out, either to another account they control or through a wire transfer.

The second path is your debit card number. If your card number is stolen — through a data breach at a store, a skimming device at an ATM, or a compromised website — a thief can make purchases or withdraw cash without having your PIN. This is why debit card fraud is often caught faster: the transactions appear on your statement within days.

A third, less common path is account takeover through social engineering. A thief calls your bank, impersonates you, and convinces a representative to change your password or add themselves as an authorized user. This requires them to know personal details about you (your Social Security number, mother's maiden name, or recent transactions), which they may have gathered from public records or previous breaches.

What happens when you report the theft

Call your bank when ready — do not wait for a statement to arrive. Most banks have a fraud line that operates 24/7. Tell them which transactions are unauthorized, and ask them to freeze your account. The bank will cancel your debit card and issue a new one, usually within 5 to 10 business days.

Next, the bank opens an investigation. They will pull transaction records, check IP addresses and device information if the theft was through online access, and contact any receiving accounts to recover the money. This process typically takes 10 business days, though complex cases can take longer. During the investigation, your account remains frozen, so you cannot use your debit card or make online transfers.

Once the bank confirms the theft, they refund the stolen amount to your account. If the money was transferred to another bank account, the receiving bank may hold it while they investigate on their end. If it was spent at a store or withdrawn as cash, recovery is harder — the bank may still refund you, but the money is often gone for good.

Your liability depends on how fast you report

Federal law (Regulation E) protects you from most unauthorized debit card charges, but the amount you are liable for depends on when you report the theft. If you report unauthorized charges within two business days of discovering them, you are liable for no more than $50. If you report within 60 days, you are liable for up to $500. After 60 days, you may lose all protection.

This timeline is stricter for debit cards than for credit cards, which is one reason financial advisors often recommend using credit cards for everyday purchases. Credit card fraud is covered under different rules that give you more time to report and stronger protections.

For unauthorized transfers from your account (not debit card charges), the rules are less clear-cut. If a thief accessed your account through your login credentials and transferred money out, your bank may treat it differently than a stolen card number. Some banks refund these transfers quickly; others investigate longer. This is why reporting when ready — even before you have all the details — protects you.

Steps to take right now if money is missing

First: Call your bank's fraud line. Have your account number and a list of unauthorized transactions ready. Ask them to freeze your account and cancel your debit card.

Second: Ask the bank to send you a written confirmation of the fraud report. You will need this for your records and for any follow-up disputes.

Third: Check your other accounts — email, social media, other banks. If a thief accessed one account, they may have tried others. Change passwords on all accounts, especially if you used the same password across multiple sites.

Fourth: Place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) by calling one of them and asking them to notify the others. This makes it harder for a thief to open new accounts in your name. You can also place a credit freeze, which is stronger but requires you to unfreeze it when you want to open new accounts yourself.

Fifth: File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and gives you a recovery plan.

How to prevent account theft going forward

Use a unique password for your bank account — one you do not use anywhere else. If another company is breached and your password is exposed, a thief cannot use it to access your bank. A password manager (like Bitwarden, 1Password, or KeePass) makes it straightforward to create and store long, random passwords.

Enable two-factor authentication on your bank account if it is available. This means that even if a thief has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Some banks offer this as an option; others require it.

Do not click links in emails claiming to be from your bank. Instead, go directly to your bank's website by typing the address into your browser, or call the number on the back of your debit card. Phishing emails are designed to look identical to real bank messages, and clicking the link takes you to a fake site that captures your credentials.

Monitor your account regularly — weekly is not excessive if you have been a victim of fraud before. Set up account alerts through your bank's app or website so you are notified of large transactions or login attempts from new devices.

What to do if your bank refuses to refund you

If your bank denies your fraud claim, you have the right to dispute it. Ask the bank in writing for the reason for the denial and request that they reconsider. If they still refuse, you can file a complaint with your bank's regulator — usually the Office of the Comptroller of the Currency (OCC) for national banks, or your state's banking regulator for state-chartered banks. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov.

These agencies investigate complaints and can pressure banks to refund you if the bank made an error. The process takes weeks or months, but it is free and does not require a lawyer.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Most banks refund stolen funds within 10 business days if the fraud is confirmed. If the money was transferred to another bank, the receiving bank may take additional time to investigate. In complex cases, the process can stretch to 30 days or longer.

Can a thief drain my entire account?

Yes, if they have access to your login credentials, they can transfer out as much money as your account holds. This is why reporting when ready is critical — the sooner you freeze the account, the less damage they can do. Your bank's liability limits protect you from the loss, but you will be without the money during the investigation.

What if I shared my password with someone I trusted and they stole from me?

This is treated as fraud if you did not authorize the specific transactions. Report it to your bank the same way you would report any other unauthorized access. The fact that you shared your password does not automatically disqualify you from protection, though some banks may investigate more carefully to confirm you did not authorize the withdrawals.

Do I need to close my account after fraud?

Not necessarily. Once your bank issues a new debit card and you change your password, the account is find again. Many people keep the account open because closing it and opening a new one takes time and can affect your banking history. However, if you feel unsafe or if the bank is unresponsive, closing the account and moving to a different bank is a reasonable choice.

Can my savings account be stolen from if I never use the debit card?

Yes. If a thief accesses your online banking login, they can transfer money from savings to checking and then withdraw it. Debit card theft is just one path. This is why a strong, unique password and two-factor authentication matter for all accounts, not just checking.