Yes, scammers can take money directly from your savings account if they obtain your account number and routing number, or if they trick you into authorizing a transfer yourself.

The money does not have to be stolen through a data breach. Most account drains happen because someone gave the scammer the information willingly—often without realizing what they were authorizing. A scammer might pose as your bank, a utility company, or a government agency and ask you to "verify" your account details over the phone. They might send you to a fake website that looks identical to your real bank's login page. Or they might convince you that you need to move money to a "safe account" to protect it from fraud.

Once a scammer has your account number and routing number, they can set up an ACH transfer (Automated Clearing House transfer) to pull money out. They can also authorize recurring payments in your name. If they have your online banking password, they can log in and transfer funds directly. The speed depends on the method: some transfers clear within hours, others take one to three business days.

Key Takeaways

  • Scammers need either your account and routing number, your online banking login, or your authorization to move money out of your savings account.
  • The most common route is social engineering—calling or texting you and convincing you to share information or approve a transfer yourself.
  • Money taken through ACH transfer or unauthorized wire can sometimes be recovered if you report it within a specific window, usually 60 days for ACH and up to one year for wire fraud.
  • Your bank is required to investigate unauthorized transfers, but you must report the fraud promptly and in writing to start the clock.

How scammers get your account information

The most direct route is you. A scammer calls claiming to be from your bank's fraud department and says suspicious activity has been detected on your account. They ask you to confirm your account number "for verification." You give it to them. They now have what they need.

Phishing emails and texts work the same way. You receive a message that looks like it came from your bank, with a link to "confirm your identity" or "update your security information." The link takes you to a fake website that copies your bank's design exactly. You enter your username and password. The scammer now has your login credentials and can access your account directly.

Scammers also obtain account information through data breaches at retailers, healthcare providers, or other companies where you have given your banking details. They buy stolen data in bulk from dark web marketplaces. But even with your account number alone, they cannot transfer money without either your authorization or your routing number—which is often printed on your checks or available through a straightforward search.

The authorization trap: when you approve the transfer yourself

Many account drains happen because the victim authorized the transfer, not knowing what they were actually approving. A scammer might tell you that you need to move money to a "find account" while they "investigate fraud" on your current account. They walk you through the steps: log into your bank, go to transfers, enter the destination account (which is actually theirs), and confirm. You do it because you believe you are protecting your money.

Another common scenario: a scammer poses as a representative from a payment app like PayPal, Venmo, or Cash App and tells you that your account has been compromised. They ask you to send them a test payment to "verify" your account is working. Once you send it, the money is gone and the account they gave you is untraceable.

A third variation involves a fake loan or investment opportunity. The scammer tells you that you have been pre-approved for a loan or that you can invest in a high-return opportunity. To proceed, you need to transfer a deposit or fee to their account. You authorize the transfer yourself. The loan or investment does not exist.

What happens after money leaves your account

If the scammer used an ACH transfer, the money typically moves to another bank account within one to three business days. Once it arrives, the receiving bank deposits it into an account the scammer controls—often opened with fake identification or under a money mule's name (someone paid to receive and forward stolen funds). The scammer then withdraws the cash or transfers it again to make it harder to trace.

If the scammer used a wire transfer, the money moves faster—usually within hours—and is even harder to recover because wire transfers are generally irreversible once sent. If they used your online banking login to transfer funds directly, the money may move when ready to an external account you have never seen before.

The key point: once the money leaves your account and lands in another bank, your bank has less power to recover it. The receiving bank is supposed to freeze the account if notified of fraud, but this only works if you report it quickly and the receiving bank cooperates.

How much protection your bank actually provides

Your bank is required by federal law to investigate unauthorized transfers and return your money if the transfer was genuinely unauthorized. But the timeline and your responsibility depend on how quickly you report it.

For ACH transfers, you have up to 60 days from the date your statement shows the unauthorized transfer to report it. If you report within this window, your bank must investigate and return the money unless they can prove you authorized it or that you were negligent in protecting your account information. If you report after 60 days, your bank may still investigate, but they are not required to refund you.

For wire transfers, the rules are different. You have up to one year to report wire fraud, but recovery is much harder because wire transfers are designed to be final. Your bank will contact the receiving bank and ask them to freeze the account, but if the money has already been withdrawn or transferred again, recovery is unlikely.

For unauthorized online transfers made through your own login, your bank may argue that you authorized the transfer (even if a scammer tricked you into doing so). This is a gray area. If you can show that you were socially engineered—that the scammer impersonated your bank or another trusted entity—you have a stronger case for recovery.

Steps to take if money has been taken from your account

Call your bank when ready using the phone number on the back of your debit card or on your bank statement—not a number from an email or text message. Tell them that an unauthorized transfer has occurred. They will freeze your account and begin an investigation.

Follow up with a written report. Send a letter or email to your bank's fraud department documenting the date of the unauthorized transfer, the amount, and the destination account if you know it. Keep a copy. This creates an official record and starts the 60-day clock for ACH disputes.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This does not recover your money, but it creates a record that may help law enforcement and alerts other agencies to the scam.

If the scammer posed as a government agency or used a payment app, file a separate report with that organization. PayPal, Venmo, and Cash App all have fraud reporting processes. The FBI's Internet Crime Complaint Center (IC3) also accepts reports of wire fraud and other financial crimes.

Change your online banking password when ready and enable two-factor authentication if your bank offers it. If the scammer has your login credentials, they may try to access your account again.

How to prevent account drains before they happen

Never give your account number, routing number, or online banking password to anyone who contacts you—even if they claim to be from your bank. Your actual bank will never ask for this information over the phone or email.

If someone calls claiming to be from your bank, hang up and call your bank directly using the number on your statement. Do not use a number they provide.

Check your account regularly—at least weekly. Set up account alerts through your bank's app so you are notified of any transfer over a certain amount. The faster you spot unauthorized activity, the faster you can report it.

Use strong, unique passwords for your online banking account. Enable two-factor authentication, which requires a second form of verification (usually a code sent to your phone) before anyone can log in, even with the correct password.

Be skeptical of unsolicited calls, emails, and texts asking you to move money or verify account information. Legitimate companies do not contact you this way to ask for sensitive details.

Frequently Asked Questions

Can a scammer drain my account if they only have my account number?

They can attempt to set up an ACH transfer, but most banks require additional information like your routing number or a verification step. However, your routing number is not secret—it is printed on your checks and can be found online. The real barrier is that your bank should catch unauthorized ACH transfers and allow you to dispute them within 60 days.

What if I authorized the transfer but the scammer tricked me into doing it?

You may still be able to recover the money if you can show that you were socially engineered—that the scammer impersonated your bank or another trusted entity and you would not have authorized the transfer otherwise. Report it to your bank as fraud, not as an error, and explain how you were deceived. Your bank will investigate.

How long does it take to get my money back?

Your bank has up to 10 business days to investigate an ACH dispute and up to 45 days to complete the investigation. They may return your money provisionally while they investigate. Wire fraud investigations take longer and recovery is less certain, especially if the money has already been withdrawn.

What if the scammer used a fake name to open the receiving account?

Banks are required to verify identity when opening accounts, but scammers sometimes use stolen identification or pay someone else to open an account for them. If the receiving bank can identify the account holder, they may be able to freeze the account and recover the funds. This is why reporting quickly matters—the longer you wait, the more time the scammer has to move the money.

Can my bank refuse to refund me if I was scammed?

Your bank can refuse if they can prove you authorized the transfer or if you were negligent in protecting your account information (for example, if you wrote your password on a sticky note). But if the transfer was truly unauthorized and you reported it within 60 days, your bank is required to refund you under federal law.