Yes, a scammer can access your savings account if they have certain information about you

A scammer does not need your debit card or to walk into your bank branch. They can drain a savings account with just your account number, routing number, or online login credentials. Some can do it with even less — a Social Security number, a photo of your ID, or answers to your security questions. The good news is that your bank has legal responsibility to refund most fraudulent transfers, and you have concrete steps to take right now to reduce your risk.

How much damage a scammer can do depends on what information they have and how quickly you notice. Someone with your online banking password can transfer money out within minutes. Someone with your account and routing number can set up unauthorized automatic withdrawals that drain your account over weeks. Someone with your Social Security number and other personal details can open a new account in your name at a different bank entirely.

Key Takeaways

  • Scammers can access your savings account using your account number, routing number, online login, or personal information like your Social Security number.
  • Federal law requires your bank to refund fraudulent transfers in most cases, but you must report the fraud within 60 days of receiving your statement.
  • The fastest way to stop ongoing fraud is to call your bank's fraud line directly — do not use the phone number on your card or a number the scammer gave you.
  • Freezing your credit with the three major credit bureaus prevents a scammer from opening new accounts in your name, even if they have your Social Security number.
  • Passwords, security questions, and two-factor authentication make it much harder for a scammer to log into your account, even if they have your account number.

What information gives a scammer access to your account

Online banking login credentials are the most direct path in. If a scammer has your username and password, they can log in from anywhere and transfer money out. They often get these through phishing emails that look like they come from your bank, fake websites that copy your bank's login page, or malware on your computer that records what you type.

Your account number and routing number allow a scammer to set up automatic transfers or bill payments from your account without logging in. These numbers are printed on every check you write, so if you throw away a check stub without shredding it, a scammer who finds it can use those numbers. They can also get them by calling your bank and pretending to be you, if they know your name, address, and Social Security number.

Your Social Security number, date of birth, and address let a scammer call your bank and answer security questions to reset your password or add themselves as an authorized user. They can also use this information to open a completely new savings account at a different bank in your name, which is why this combination is so dangerous.

Answers to your security questions — your mother's maiden name, the street you grew up on, your first pet's name — can be found on social media, public records, or by calling people who know you. If a scammer has these answers, they can reset your password without needing the original one.

How to stop a scammer who is actively draining your account

Call your bank's fraud department when ready. Do not use the phone number on the back of your card or any number a scammer gave you — look up the number on your bank's official website or your most recent statement. Tell them you suspect fraud and ask them to freeze your account right away. A freeze stops all transfers in and out until you unfreeze it, which buys you time to figure out what happened.

Ask your bank to cancel any automatic transfers or bill payments you did not set up. If a scammer has set up recurring withdrawals, your bank can delete those authorizations. They can also reverse individual fraudulent transfers, though this takes longer — usually a few business days to a few weeks.

Request a new debit card and new online banking password. Do not reuse a password you have used before, and do not use one that contains your name, birth year, or other information a scammer might know. A strong password has at least 12 characters and mixes uppercase letters, lowercase letters, numbers, and symbols.

Ask your bank whether they offer two-factor authentication on your account. This means that even if a scammer has your password, they cannot log in without a code sent to your phone or generated by an app. Turn this on as soon as possible.

What your bank is legally required to refund

Federal law, called Regulation E, requires banks to refund unauthorized transfers from your savings account in most cases. An unauthorized transfer is one you did not approve — either because a scammer logged into your account, or because they set up a transfer using your account number without your permission.

You have 60 days from the date your bank statement shows the fraudulent transfer to report it. If you report within this window, your bank must refund the money while they investigate, which usually takes 10 business days. If you report after 60 days, your bank may still refund you, but they are not legally required to, and the process takes longer.

There is one major exception: if a scammer had your account number and routing number and set up a transfer that looks like it came from you — for example, a bill payment or an ACH transfer — the rules are different. These are called unauthorized ACH transfers, and you have 120 days to report them instead of 60. Your bank still must refund them, but the timeline is longer.

Report fraud in writing as well as by phone. Call your bank's fraud line first to freeze your account and stop the bleeding, but then send a written statement describing what happened, when you noticed it, and what transfers were unauthorized. Keep a copy for your records. This creates a paper trail that protects you if your bank disputes the refund later.

Preventing a scammer from opening new accounts in your name

A credit freeze is the single most effective tool against identity theft. When you freeze your credit, the three major credit bureaus — Equifax, Experian, and TransUnion — will not let anyone open a new credit card, loan, or savings account in your name without a PIN that only you know. A scammer with your Social Security number and address cannot get around this.

You can place a credit freeze for free by visiting each bureau's website or calling them. Equifax's number is 1-800-685-1111, Experian's is 1-888-397-3742, and TransUnion's is 1-888-909-8872. You will need to provide your name, address, date of birth, and Social Security number. Each bureau will give you a PIN — write these down and store them somewhere safe, because you will need them if you want to unfreeze your credit later to open a legitimate account.

A credit freeze does not affect your existing accounts or your credit score. It only stops new accounts from being opened. If you need to open a new account yourself, you can temporarily unfreeze your credit, and then freeze it again once the account is open.

Protecting your account from future scams

Never share your account number, routing number, password, or Social Security number by email, text, or phone — not even if someone claims to be from your bank. Your bank already has this information and will never ask you for it. If you get a message asking for it, it is a scam.

Check your bank statements every week, not just once a month. The sooner you spot a fraudulent transfer, the sooner you can report it and the easier it is for your bank to reverse it. Many banks let you set up alerts that notify you by text or email whenever a transfer over a certain amount leaves your account.

Use a unique, strong password for your online banking account — one you do not use anywhere else. If a scammer steals your password from another website, they cannot use it to access your bank account. A password manager like Bitwarden or 1Password can generate and store strong passwords for you.

Turn on two-factor authentication on every account that offers it, starting with your bank and email. Two-factor authentication means you need both your password and a code from your phone to log in. Even if a scammer has your password, they cannot get in without that second code.

Be cautious about what personal information you share on social media. Scammers use details from your public posts — your pet's name, where you went to school, your mother's maiden name — to answer security questions and reset your passwords.

What to do if you think your information has been compromised

Place a fraud alert on your credit report by contacting one of the three credit bureaus. A fraud alert tells creditors to verify your identity before opening new accounts in your name. Unlike a credit freeze, you only need to contact one bureau — they will notify the other two. A fraud alert lasts one year and is free.

Check your credit report for accounts you did not open. You can view your credit report for free once a year at annualcreditreport.com, which is the official government site. Look for credit cards, loans, or other accounts listed under your name that you do not recognize. If you find any, contact the creditor and report them as fraudulent.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record of the fraud and gives you a recovery plan tailored to your situation. You can also file a police report with your local police department, which may be required by your bank before they refund the fraud.

Frequently Asked Questions

Can a scammer drain my entire savings account?

Yes, if they have your online banking password or your account and routing number. However, your bank is legally required to refund unauthorized transfers under Regulation E, as long as you report the fraud within 60 days of your statement. Report fraud when ready by calling your bank's fraud line to freeze your account and stop further transfers.

Do I have to pay back money a scammer transferred out of my account?

No. Your bank is responsible for refunding unauthorized transfers. You are only liable if you were negligent — for example, if you wrote your password on a sticky note and left it on your desk. Even then, your liability is capped at $50 under federal law if you report the fraud within 60 days.

What if my bank refuses to refund the fraud?

File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. You can also contact your state's banking regulator or attorney general's office. Keep copies of all written communication with your bank, including emails and letters, to support your complaint.

Can a scammer access my savings account if I only give them my name and address?

Not directly, but they can use that information along with your Social Security number to call your bank and reset your password. If they also know answers to your security questions, they can log in. This is why a credit freeze is important — it stops them from opening new accounts even if they have this information.

Is my money safer in a savings account or a checking account?

Both are protected equally under Regulation E. The difference is that checking accounts are used more frequently, so fraud is often caught faster. Savings accounts have fewer transactions, which means fraudulent transfers might go unnoticed longer. The protection level is the same — report within 60 days and your bank must refund it.