Yes, scammers can take money directly from your bank account — but not without your account information or permission

A scammer needs one of three things to pull money from your account: your account number and routing number, your debit card details, or access to your online banking login. They cannot straightforward guess these. What makes account theft possible is that you give them the information — sometimes knowingly through a fake website or phone call, sometimes unknowingly because the request looked legitimate.

The good news is that your bank has rules about what happens after money leaves. You are not automatically responsible for fraudulent charges, and the process for getting your money back is clearer than most people think. Understanding how the theft happens and what your bank must do afterward is the first step to protecting yourself.

Key Takeaways

  • Scammers need your account number, routing number, debit card details, or online banking password to access your account — they cannot take money without one of these.
  • The most common entry point is a fake website or phone call that tricks you into sharing your information or authorizing a payment yourself.
  • Your bank is required by federal law to investigate unauthorized charges and return your money if the charge was genuinely fraudulent, though the timeline depends on the type of transaction.
  • Debit card fraud is easier to dispute than ACH transfers or wire transfers, because debit card rules give you stronger protections.
  • Reporting the fraud quickly — within 60 days of seeing it on your statement — is essential, because your liability increases if you wait longer.

The three ways scammers get your account information

Phishing is the most common route. A scammer sends you an email or text that looks like it comes from your bank, PayPal, or another service you use. The message says your account is locked, a suspicious login was detected, or you need to confirm your information. The link takes you to a fake website that looks identical to the real one. You enter your username, password, and sometimes your account number or card details. The scammer now has everything they need.

Phone calls work the same way. A caller claims to be from your bank's fraud department and says they noticed suspicious activity. They ask you to confirm your account number, PIN, or card details "to verify it is really you." Once you provide it, they have access. Real banks never ask for your PIN or full account number over the phone.

Malware and keyloggers are less common but more dangerous. Malware is software that installs on your computer or phone without your knowledge and records everything you type — including your passwords and account numbers. You might read it by clicking a link in an email, visiting a compromised website, or opening an infected attachment. Once installed, the scammer can see your login credentials in real time.

What happens after a scammer has your information

Once a scammer has your account number and routing number, they can set up an ACH transfer — an electronic transfer between bank accounts. They do not need your permission; they straightforward initiate the transfer from their own account to yours, then withdraw it. This is why ACH fraud is particularly dangerous: the transaction happens in the background, and you might not notice for days.

If they have your debit card number, they can make purchases online or in person. If they have your online banking password, they can log in directly and transfer money out themselves. If they have your full account details and a blank check, they can forge checks in your name.

The speed depends on the method. Debit card fraud shows up on your statement within one or two days. ACH transfers can take three to five business days. Wire transfers are nearly when ready and nearly impossible to reverse, which is why scammers prefer them when they can get you to authorize one yourself.

Federal protections for unauthorized charges

The Electronic Funds Transfer Act (EFTA) is the federal law that protects you when someone uses your account without permission. Under EFTA, your bank must investigate any transaction you report as unauthorized and return your money if they determine it was fraudulent. The timeline depends on the type of transaction.

For debit card fraud, your liability is limited to $50 if you report it within two business days of discovering it. If you wait longer than two business days but report it within 60 days, your liability goes up to $500. After 60 days, you may lose the entire amount. This is why checking your statement weekly matters.

For ACH transfers and other electronic transfers, the same 60-day window applies, but the investigation takes longer. Your bank has up to 45 days to investigate and tell you whether they found fraud. If they determine the transfer was unauthorized, they must return your money, though it may take another few business days to appear in your account.

For wire transfers, protections are weaker. If you authorized the wire yourself — even if a scammer tricked you into doing it — it is much harder to get your money back. This is why wire transfers are a common scam target: once the money leaves, it is usually gone.

How to report fraud to your bank

Call your bank's fraud line when ready. Do not use the number on the back of your card if you suspect the card itself was compromised; instead, look up the number on your bank's official website or a recent statement. Explain which transaction is fraudulent and when you first noticed it.

Your bank will ask you to confirm that you did not authorize the transaction. They may freeze your account temporarily while they investigate. Ask them to send you a written summary of the investigation, including their findings and the date your money will be returned.

Follow up in writing. Send a letter to your bank's fraud department (the address is usually on your statement or website) describing the unauthorized transaction, the date you reported it, and the name of the person you spoke with. Keep a copy for your records. Written documentation protects you if the investigation takes longer than expected or if you need to dispute the bank's decision later.

Steps to take after discovering fraud

First, change your online banking password when ready — from a different device if possible, in case malware is still on your computer. Use a password that is at least 12 characters long and includes numbers, uppercase letters, and symbols.

Second, check your credit report for new accounts opened in your name. You can view your credit report free once per year at annualcreditreport.com, which is the official site run by the three major credit bureaus. If you see accounts you did not open, contact the credit bureau and the creditor to report fraud.

Third, consider placing a fraud alert on your credit file. This tells creditors to verify your identity before opening new accounts in your name. You can place a fraud alert free by calling any of the three credit bureaus (Equifax, Experian, or TransUnion). The alert lasts one year and can be renewed.

Fourth, monitor your bank account closely for the next few months. Scammers who have your information sometimes try again. Set up account alerts through your bank's app so you are notified of every transaction, or check your account several times per week.

How to prevent scammers from accessing your account in the first place

Never share your account number, routing number, PIN, or online banking password with anyone — not over the phone, not in an email, not in a text message. Your bank will never ask for these. If someone asks, it is a scam.

Verify the sender before clicking links. If you receive an email claiming to be from your bank, do not click the link in the email. Instead, go directly to your bank's website by typing the address into your browser, or call the number on your debit card. Ask whether they sent the email. Usually they did not.

Use a strong, unique password for your online banking account. A password manager like Bitwarden or 1Password can generate and store complex passwords so you do not have to remember them. Never reuse the same password across multiple websites.

Enable two-factor authentication on your bank account if it is available. This means that even if a scammer has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this as an option in your account settings.

Keep your computer and phone updated. Software updates patch security holes that scammers use to install malware. Turn on automatic updates so you do not have to remember to do it manually.

Frequently Asked Questions

Can a scammer drain my entire bank account?

Yes, if they have your account number and routing number, they can set up multiple ACH transfers to drain your account over time. However, your bank is required to return the money if you report it within 60 days. The challenge is catching it quickly — ACH transfers can take several days to appear on your statement, so checking your account weekly is important.

What if my bank says the fraud was my fault because I authorized it?

If a scammer tricked you into authorizing a transfer — for example, by pretending to be your bank and asking you to move money to a "find account" — the situation is more complicated. EFTA protections are weaker for transfers you authorized yourself, even if you were deceived. You can still dispute it, but your bank may argue that you authorized it. Document everything and ask for a written explanation of their decision if they deny your claim.

How long does it take to get my money back?

For debit card fraud, your bank usually returns the money within 5 to 10 business days. For ACH transfers, the investigation can take up to 45 days, and the refund may take another few business days after that. Wire transfers are much slower to reverse, if they can be reversed at all. Ask your bank for a specific timeline when you report the fraud.

Do I need to close my account after fraud?

Not necessarily. Closing the account does not erase the fraud from your record, and it can make the investigation harder. Keep the account open while your bank investigates, then decide whether to close it once the fraud is resolved. If the fraud happened because of a security breach at the bank itself, ask whether they will waive any fees related to closing the account.

What if the scammer used my information to open a new bank account?

Contact the bank where the fraudulent account was opened and explain that the account was opened without your permission. Provide a copy of your ID and any documentation of the fraud. The bank should close the account. Also report the fraud to the credit bureaus and place a fraud alert on your credit file to prevent the scammer from opening more accounts in your name.