Can a Company Take Money From Your Bank Without Permission?

No. A company cannot legally take money from your bank account without permission. Federal law — the Electronic Fund Transfer Act and its implementing rule, Regulation E — requires your explicit authorization before any electronic debit hits your account, and recurring withdrawals require a signed or similarly authenticated written authorization that you’re entitled to receive a copy of.¹ A company that pulls funds without that authorization is breaking federal law and can be forced to pay damages, statutory penalties, attorney fees, and in willful cases face criminal fines and prison time.

What Counts as Authorization

Regulation E sets a clear bar. Before the first withdrawal, the company must disclose the types of transfers it will make, any limits on frequency or dollar amounts, and the terms of the arrangement. For recurring debits, your authorization has to be in writing (or authenticated electronically) and you must get a copy. If the amount of a scheduled recurring withdrawal changes from what you originally approved, the company or your bank has to send you written notice at least 10 days before the transfer.¹

Vague contract language doesn’t rescue a company that skipped these steps. Courts read ambiguous contract terms against the party that wrote the contract, so buried or unclear withdrawal clauses tend to work against the company, not you.

The Narrow Cases Where Money Can Leave Without Your Consent

A private company acting on its own cannot pull from your account without authorization. But there are a handful of situations where money can leave your account without your affirmative permission, and they’re worth knowing so you don’t confuse them with a violation.

IRS tax levies. If you owe back taxes, the IRS can send a levy directly to your bank. The bank must freeze the funds and hold them for 21 days, giving you a window to dispute or arrange payment before the money is remitted.²

Bank setoff. If you owe money to the same bank that holds your deposit account, most account agreements let the bank apply your funds against the defaulted debt without a court order. Setoff generally cannot be used to collect overdue consumer credit card balances, and most courts have held it cannot reach funds otherwise exempt under federal law, such as Social Security or disability payments.

Court-ordered garnishment. A creditor with a judgment against you can obtain a writ directing your bank to freeze and turn over funds. Federal rules require notice and an opportunity to object.³ Social Security, veterans’ benefits, and certain other income sources are generally protected.

What to Do the Moment You See an Unauthorized Withdrawal

Call your bank right away. Don’t wait to gather paperwork first. An oral report is enough to start the clock in your favor, and you can send documentation afterward.

Once you notify the bank of an error, it generally has 10 business days to investigate, and it must provisionally credit your account within that same period while the investigation continues.⁴ The bank can withhold up to $50 of that provisional credit if it reasonably believes the transfer was unauthorized. For accounts opened within the past 30 days, the bank has 20 business days rather than 10. If the investigation confirms the transaction was unauthorized, the provisional credit becomes permanent.

If the bank doesn’t handle the dispute properly, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372.⁵ The CFPB forwards the complaint to the company and tracks the response.

How Much You Could Lose Depends on When You Report

Federal law caps your liability on a sliding scale tied to how fast you notify your bank of an unauthorized electronic transfer.

Report within 2 business days: maximum liability of $50.
Report after 2 business days but within 60 days of the statement showing the transfer: maximum liability of $500.
Report more than 60 days after that statement: you can lose everything taken during the delay, with no cap.

These tiers come from Regulation E, and to hold you to the higher amount the institution has to show it could have prevented the later transfers had you reported sooner.⁶ Many banks advertise “zero liability” policies on debit cards that go beyond the federal minimums, but those are voluntary and can carry conditions you won’t see until you file a claim.

Stopping a Recurring Withdrawal You Once Agreed To

If you previously authorized a company to bill your account and want it to stop, take two steps rather than one.

First, tell the company in writing that you’re revoking authorization. Some billers honor this immediately; others drag their feet.

Second, and more important, notify your bank. Under Regulation E, you can stop any preauthorized electronic transfer by telling your bank at least three business days before the scheduled date.⁷ The request can be oral or written. Your bank may ask you to follow up an oral request in writing within 14 days; if it requires written confirmation and you don’t send it, the oral stop-payment order expires at the end of those 14 days.

If you give a valid stop-payment order at least three business days before the transfer and the bank lets it go through anyway, the bank is liable for your losses.⁶ Banks know this, which is why stop-payment orders on preauthorized debits tend to be taken seriously.

Scam Transfers and the Authorization Gray Area

Regulation E protects you against “unauthorized” transfers, which the statute defines as transfers initiated by someone other than you, without actual authority, from which you received no benefit.⁸

If a scammer tricks you into revealing your debit card number, login credentials, or a one-time confirmation code, and then uses that information to move money out of your account, the transfer is considered unauthorized. The CFPB has confirmed that Regulation E protections apply when a third party fraudulently induces you to share account access information and then uses it to initiate a transfer.⁹

Two situations shift the analysis against you. If you voluntarily gave someone your card or access device and they misused it, you are not protected unless you had already notified your bank that you’d revoked that person’s access.⁹ And if you initiated the transfer yourself, even after being deceived, recovery is much harder because you pushed the button. Sending money to a scammer through a peer-to-peer app on a false story falls into this second category.

What Companies Face for Unauthorized Withdrawals

Under the EFTA, a company that violates the law is liable to the consumer for actual damages, plus statutory damages between $100 and $1,000 per individual claim, along with reasonable attorney fees and costs when the consumer prevails.¹⁰ Class actions can reach the lesser of $500,000 or 1% of the company’s net worth. The attorney fee provision is what makes individual cases financially viable to bring, even when the withdrawal itself is small.

Willful violations carry criminal penalties of up to $5,000 in fines, up to one year in prison, or both.¹¹ Using a stolen or counterfeit debit instrument in transactions totaling $1,000 or more within a year raises the exposure to $10,000 in fines and up to 10 years in prison.

On the regulatory side, the CFPB can investigate, bring enforcement actions, and impose civil penalties.¹² The FTC can act against non-bank companies, and state financial regulators can pursue license revocations and cease-and-desist orders.

Recovering Your Money in Court

If the bank’s error resolution process doesn’t fully restore your funds, you have options beyond the dispute desk. A private lawsuit under the EFTA can recover actual damages, statutory damages of up to $1,000, and attorney fees.¹⁰ For smaller amounts, small claims court is usually the fastest route; filing limits vary by state, generally between $2,500 and $25,000, and you don’t typically need a lawyer.

One thing to check before filing: many bank and service agreements contain mandatory arbitration clauses that require disputes to be resolved through arbitration rather than court, and often bar class actions. Read the dispute resolution section of any agreement you signed, because that clause controls your options if something goes wrong.

1
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
2
eCFR. 26 CFR 301.6332-3 – The 21-Day Holding Period Applicable to Property Held by Banks
3
Office of the Law Revision Counsel. 28 USC 3205 – Garnishment
4
eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
5
Consumer Financial Protection Bureau. Submit a Complaint
6
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
7
eCFR. 12 CFR 205.10 – Preauthorized Transfers
8
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
9
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
10
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
11
Office of the Law Revision Counsel. 15 USC 1693n – Criminal Liability
12
Consumer Financial Protection Bureau. Enforcement Actions