Someone can withdraw money from your account through six main pathways: a thief using stolen card data or credentials, a joint owner or someone you named under a power of attorney, a merchant running a recurring debit you once authorized, a creditor with a court garnishment order, the IRS or another government agency collecting a debt, and the bank itself pulling funds to cover what you owe it. Each one has its own rules, and your options for stopping or reversing a withdrawal depend on which pathway was used.
Theft Through Card Skimming, Phishing, and Malware
Criminals reach bank accounts through a mix of technology and social engineering. Skimming devices attached to ATM slots or gas pumps capture your card’s magnetic stripe data, which is then cloned onto a blank card. Phishing emails and texts impersonate your bank and route you to a fake login page that captures your username and password. Once a thief has your credentials, they can sign in and move money as if they were you.
Malware is more invasive. Keyloggers installed through a bad download or email attachment record your keystrokes and hand your banking credentials to the attacker in real time. Older methods still work too: a check stolen from your mailbox can be altered, or its account and routing numbers used to print counterfeits. Under the Uniform Commercial Code, your bank is generally liable for paying a check with a forged signature, but that protection erodes if you fail to review statements and report the forgery promptly.
Your Rights After Unauthorized Transactions
Federal law caps what you can lose to unauthorized electronic transactions, but the cap depends on how fast you report. Under the Electronic Fund Transfer Act, three tiers apply to debit cards, ATM cards, and electronic account access:1GovInfo. 15 USC 1693g – Consumer Liability
- Report within two business days of learning about the theft, and your liability is capped at $50 or the amount taken before you notified the bank, whichever is less.
- Report after two business days but within 60 days of the statement showing the transaction, and your liability can rise to $500.
- Wait more than 60 days after that statement, and there is no cap on losses from unauthorized transfers that happen after the 60-day mark.
The 60-day cliff is where most people get burned. Ignore your statements for a few months while a thief drains the account, and the bank has no obligation to reimburse transfers that occurred after day 60.
Once you report, the bank must investigate within 10 business days and tell you the results within three business days of finishing. It can extend the investigation to 45 days, but must provisionally credit your account within 10 business days so you’re not without the money during the review.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The bank can hold back up to $50 of that provisional credit if it reasonably believes the transfer was unauthorized. New accounts (first deposit less than 30 days old) get 20 business days for the initial investigation and up to 90 days total.
People You’ve Given Legal Access
Not every withdrawal you didn’t make is fraud. If someone else’s name is on the account, they can walk into the bank and take the entire balance. That is the reality of joint ownership: every co-owner has equal access to all the money, and the bank doesn’t need permission from the other owners to process a withdrawal. Joint accounts also usually carry a right of survivorship, so when one owner dies, the survivor automatically owns the balance without probate. Adding someone to your account gives them irrevocable access to every dollar in it while the account exists.
A power of attorney creates similar exposure. The document lets you name an “agent” to handle financial transactions on your behalf, and depending on how it’s drafted, the agent can sign checks, transfer funds, pay bills, or close the account entirely. Banks are required to honor a properly executed power of attorney and treat the agent’s instructions the same as yours. A limited version might only cover one transaction; a general or durable version can cover everything and can survive your incapacity. If you revoke a power of attorney, notify the bank directly. Until the bank receives that notice, the agent can still act.
Recurring Debits You Once Authorized
When you give a utility, gym, or subscription service your account and routing numbers, you authorize them to pull money through the Automated Clearing House network. Those preauthorized debits keep running on schedule even if you cancel the underlying service with the merchant, because the bank treats each debit as pre-approved based on your original authorization. This is where people lose money after they think they’ve cancelled something.
Federal law gives you a way to stop them. You can order your bank to block a preauthorized debit by notifying them at least three business days before the scheduled transfer, either by phone or in writing.3Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers If you call, the bank may require written confirmation within 14 days; skip that follow-up and the oral stop-payment order expires.4Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers Once the order is in place, the bank must block all future debits from that merchant, even if the merchant resubmits the charge. Revoke the authorization directly with the merchant in writing too, so you have a paper trail on both sides.
Court-Ordered Garnishments
A creditor who wins a lawsuit can ask the court for a garnishment order directed at your bank. The bank receives the order, freezes the funds, and eventually turns them over to the creditor or the court. Your bank has no discretion here; it must comply with a valid court order regardless of what you want.
You should receive notice and an opportunity to claim that some or all of the funds are exempt. How much time you have to respond and which exemptions are available depend on the jurisdiction. Federal debt collection procedures, for example, require a hearing within 10 days of a debtor’s objection request.5Office of the Law Revision Counsel. 28 USC 3205 – Garnishment State procedures vary, but the constitutional principle is the same: notice and a chance to be heard.
Banks typically charge a processing fee for handling the garnishment, often around $100, which comes out of your balance on top of the amount the creditor is owed.6Internal Revenue Service. Information About Bank Levies Post-judgment interest keeps accruing until the debt is paid, so the total pulled from your account often exceeds the original judgment.
IRS Levies and Other Government Collections
The IRS does not need a court order to take money from your bank account. If you owe federal taxes and ignore the notice and demand for payment, the IRS has statutory authority to levy your deposits.7Office of the Law Revision Counsel. 26 USC 6331 – Levy and Distraint Before it does, the IRS must send a written Notice of Intent to Levy at least 30 days in advance, which also spells out your right to a Collection Due Process hearing with the IRS Independent Office of Appeals.8Taxpayer Advocate Service. Notice of Intent to Levy
When the levy hits your bank, the bank must hold the funds for 21 days before sending them to the IRS.9Office of the Law Revision Counsel. 26 USC 6332 – Surrender of Property Subject to Levy Those 21 days are your last window to negotiate a payment plan, prove the funds are exempt, or otherwise resolve the debt. A bank levy only reaches the balance in the account on the day it’s served; future deposits are safe from that particular levy, though the IRS can issue another one.10eCFR. 26 CFR 301.6331-1 – Levy and Distraint
Other government collections work through different channels. The Treasury Offset Program intercepts federal payments owed to you, such as tax refunds, and redirects them to satisfy debts like defaulted student loans or overdue child support.11Bureau of the Fiscal Service. Treasury Offset Program State child support enforcement agencies can also garnish bank accounts through administrative processes, without filing a separate lawsuit.
The Bank’s Own Right of Setoff
Your bank can pull money from your account to cover a debt you owe to that same bank. If you’re behind on a credit card, car loan, or personal loan with the institution that holds your checking or savings, the bank can apply your deposits toward that debt without a court order and often without advance notice. This right of setoff comes from common law and is reinforced by the fine print in almost every deposit agreement.
The practical takeaway: if you’re behind on payments to your bank, the deposits in that bank are exposed. Some people keep their operating funds at a different institution from any lender they owe. Setoff generally does not reach government benefit deposits that are federally protected, but ordinary wages and other funds are fair game.
Funds That Can’t Be Touched
Not everything in your account is available to a garnishing creditor. Federal law protects certain benefit payments. When your bank receives a garnishment order that isn’t from a federal agency or a state child support enforcement agency, it must review your account within two business days to see whether protected federal benefits were directly deposited during the previous two months.12eCFR. 31 CFR 212.5 – Account Review
Protected deposits include Social Security, Supplemental Security Income, VA benefits, and federal retirement payments. The bank calculates a “protected amount” equal to the total of those deposits over the two-month lookback (or the current balance, whichever is less) and must leave that amount fully accessible. It cannot freeze the protected amount and cannot charge a garnishment fee against it.13Federal Deposit Insurance Corporation. Garnishment of Accounts Containing Federal Benefit Payments
These protections have limits. They don’t apply to garnishment orders from federal agencies or from state child support enforcement, both of which can generally reach federal benefit payments. And the lookback only shields directly deposited benefits; if you cashed a paper check and deposited the cash, proving those dollars are protected becomes much harder.
Access to the Account After the Owner Dies
Death changes who can withdraw. If the account is jointly held, the surviving co-owner keeps full access immediately under the right of survivorship, with no court proceedings required. The bank simply removes the deceased owner’s name.
A payable-on-death (POD) designation works the same way in effect. You direct the bank to transfer the balance to a named beneficiary when you die, bypassing probate.14Federal Deposit Insurance Corporation. Trust Accounts The beneficiary has no rights and no visibility into the account while you’re alive, and claims it after your death by presenting a death certificate and identification.
Without a joint owner or POD beneficiary, the account enters the estate. A probate court must appoint a personal representative before the bank will release funds. Some states offer a simplified affidavit process for smaller estates, with thresholds and waiting periods that vary. Until someone produces proper legal authority, the bank freezes the account and denies withdrawal requests.