Someone Used My Bank Account to Pay Their Bills: Limits and Recovery

If someone used your bank account to pay their bills without permission, call your bank’s fraud department today, ask them to freeze the account, and file a written notice of error within 60 days of the statement that first showed the charges. Federal law — specifically the Electronic Fund Transfer Act and Regulation E — generally requires your bank to investigate and refund unauthorized electronic transfers, and when the thief used only your account and routing numbers (no debit card), your maximum liability can be zero as long as you report in time.¹ Every day you wait shifts more risk onto you and gives the perpetrator more time to drain the account.

What to Do Today

Your first call is to the bank’s fraud line. Tell them transactions on your account are unauthorized and ask them to freeze or close the compromised account and open a new one. If the perpetrator set up recurring bill payments, request a stop-payment order on those charges. Banks generally need at least three business days’ notice before the next scheduled payment to block it, and while many charge $20 to $30 per stop-payment, your bank may waive the fee when fraud is the reason.

Then file a formal notice of error. This is the step that triggers the federal investigation timelines and the provisional credit rules. You can start it by phone, but put it in writing within 10 days so the bank cannot later say you missed a confirmation deadline.² Change every password, PIN, and login tied to the account. If you reused that password anywhere else, change it there too.

File a police report the same day if you can. You will need the report number for the bank’s dispute process, any insurance claim, and the FTC identity theft report. Finish by going to IdentityTheft.gov and completing the FTC form; it generates a personalized recovery plan and an official Identity Theft Report you can hand to creditors and law enforcement.³

How Much You Can Be Forced to Lose

The Electronic Fund Transfer Act and Regulation E set the ceiling on your out-of-pocket loss when someone makes unauthorized electronic transfers from your account. Two things decide where you land: whether the thief used a physical access device like a debit card, and how fast you reported.

When Only Your Account Number Was Used

If the person paid their bills by typing your account and routing numbers into an online payment system, or by setting up an ACH debit, and never had your debit card, the familiar $50 and $500 tiers do not apply. You owe nothing as long as you report within 60 days of the statement date that first showed the problem. Miss that 60-day window and you become liable for any unauthorized transfers that happen after the deadline and before you finally notify the bank.¹ Most advice online focuses on the debit card tiers, but for account-number-only fraud, that 60-day reporting window is the deadline that matters.

When a Debit Card or PIN Was Used

If the perpetrator used your stolen or cloned debit card, a tiered structure applies:

Report within 2 business days of learning of the loss, and your maximum liability is $50 or the amount taken before notice, whichever is less.
Report after 2 business days but within 60 days of your statement, and your liability can rise to $500.
Report after 60 days, and you could lose everything taken after that mark with no cap.⁴

Many banks advertise zero-liability policies that go beyond these federal minimums. Those are voluntary and come with fine print, so do not rely on them as a substitute for fast reporting.

One boundary worth naming: if somehow the person put the charges on your credit card rather than your checking account, a different federal law caps your liability at $50 for unauthorized charges with no tiered deadlines, and most issuers waive even that. The EFTA rules above are the ones that govern the typical situation here, where a bank account was used.

What the Bank Must Do After You Report

Once you file the notice of error, the bank has to investigate and report its findings within 10 business days. If it needs more time, it can extend to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. That provisional credit is yours to use while the investigation continues.²

The timelines stretch in a few situations. For accounts opened within the last 30 days, the bank gets 20 business days instead of 10 and up to 90 days instead of 45. The same 90-day extension applies to point-of-sale debit card transactions and to transfers initiated from outside the United States.⁵

If the bank finds no error, it has to explain its reasoning in writing and return any documents you submitted. It can then reverse the provisional credit, but it has to give you notice first. Watch for one procedural trap: if you reported by phone, the bank can require written confirmation within 10 days. Skip the written step and the bank has no obligation to issue provisional credit while it investigates.²

If the Bank Denies Your Claim

Banks deny fraud claims more often than people expect, especially when the transactions do not fit the usual fraud pattern or when the perpetrator had any prior connection to the account. Start by asking the bank for its written explanation and whatever documents it relied on. You have a right to both.

Then file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards the complaint to the bank, which generally responds within 15 days and must give a final response within 60 days. You then have 60 days to push back if the resolution is unsatisfactory.⁶ A CFPB complaint does not guarantee a reversal, but it creates a regulatory record, and banks treat it more seriously than another call to customer service.

You can also complain to your state attorney general or state banking regulator. If the amount is large, talk to a consumer protection attorney. The EFTA lets successful plaintiffs recover actual damages, statutory damages, and attorney’s fees, which can make a case economical even for smaller sums.

When the Person Who Took the Money Is Someone You Know

This is where claims get complicated. If a family member, roommate, or ex used your account, the legal picture turns on whether you ever gave that person access. Under Regulation E, a transfer is not “unauthorized” if it was made by someone you furnished with an access device, like a debit card or login, unless you had already told the bank that person’s authority was revoked.⁷

Put plainly: if you once handed your partner your debit card and later they used it to pay a phone bill without asking, the bank may not treat those charges as unauthorized. You would need to show you told the bank to cut off that person before the disputed transactions. If you never revoked access in writing or by phone, the bank has a strong basis to deny.

If you haven’t revoked yet, do it now. Contact the bank, remove the person’s authorization, close the compromised account, and open a new one. Anything that person does after that is clearly unauthorized. For transactions already made, you may have to go after the person directly through civil court or criminal charges rather than the bank’s error resolution process.

If They Used Checks Instead

Paper checks are governed by a different rulebook. The Uniform Commercial Code, adopted in some form by every state, requires you to review your statements and report any unauthorized signature or alteration promptly. If the same person forges multiple checks and you do not catch the first one within a reasonable time, which the UCC caps at 30 days from when the statement was available, you lose the right to dispute later forgeries by that same person that the bank paid before it received your notice.⁸

There is a hard outer deadline too. You have one year from the date a statement was made available to report any unauthorized signature or alteration on a check. Miss it and the bank owes you nothing, whatever the circumstances.⁸

What the Person Who Did This Is Facing

Using someone else’s bank account to pay bills is a crime, and the federal exposure is serious. The specific charges depend on how the person accessed the account and how much they took.

Federal bank fraud covers anyone who uses false pretenses to obtain money from a financial institution. Convictions carry fines up to $1 million and up to 30 years in prison.⁹ Those maximums are reserved for large-scale schemes, but even smaller cases can bring real prison time.

Identity fraud applies when the person used your personal identifying information to get into the account. The base penalty is up to 15 years in prison, plus fines and forfeiture of anything obtained through the crime.¹⁰ If the identity theft happened during another felony like bank fraud, aggravated identity theft adds a mandatory two-year sentence that runs consecutively, meaning it stacks on top of the sentence for the underlying crime.¹¹

Smaller amounts or less sophisticated schemes usually fall to state theft laws, which classify theft by dollar value, from misdemeanor fines on the low end to felony prison time on the high end. A criminal conviction can also include a restitution order requiring the perpetrator to repay what was taken, which does not depend on you filing a separate civil case. Collecting on that order is a different matter if the person has no assets.

Prosecutors are more likely to pursue cases where the victim shows up with organized documentation. Bring your police report, the bank statements that show the unauthorized transactions, and anything that links the perpetrator, such as the bill accounts your money went to.

Going After the Money in Civil Court

Criminal charges punish the person; they do not always make you whole. You can pursue civil claims at the same time.

Conversion and Unjust Enrichment

The most direct claim is conversion, the legal term for someone using your property without permission. You have to show the person intentionally used funds from your account and that you lost money as a result. Courts can award the amount taken and, where the conduct was egregious, punitive damages. A related claim, unjust enrichment, looks at the benefit the person received. If they used your account to pay their electric bill, they were enriched at your expense by the amount of that payment, and a court can order them to give it back without any contract between you.

Breach of Fiduciary Duty

If the person held a position of trust over your finances — a caretaker, power of attorney, financial advisor, or legal guardian — you may also have a breach of fiduciary duty claim, which carries potentially higher damages because courts take the violation of a trust relationship seriously. Elder financial abuse statutes in many states add further protections and enhanced penalties when the victim is elderly.

Small Claims Court

For amounts under your state’s small claims limit, which ranges from $2,500 to $25,000 depending on where you live, small claims court is faster and cheaper than a full lawsuit. You file in the county where the defendant lives, pay a filing fee, and arrange for the defendant to be served. You usually do not need a lawyer. Bring the bank statements, the police report, and anything that ties the defendant to the payments. Statutes of limitations vary by claim type, so file before yours runs.

Locking Down the Rest of Your Identity

Someone with enough information to drain your bank account probably has enough to cause more damage. Shut the door now.

A credit freeze is the strongest tool. It blocks anyone, including you, from opening new credit in your name until you lift it. Freezes are free, last indefinitely, and have to be placed separately with each of the three major credit bureaus: Equifax, Experian, and TransUnion. You can temporarily lift the freeze when you need to apply for credit.¹²

A fraud alert is lighter. It tells lenders to verify your identity before opening new accounts but does not block them from pulling your credit. An initial alert lasts one year and can be renewed. If you have filed a police report or FTC identity theft report, you qualify for an extended fraud alert lasting seven years. You only need to contact one bureau; that bureau notifies the other two.¹²

Beyond credit, review your other financial accounts for anything that looks off, pull free copies of your credit reports from all three bureaus, and turn on transaction alerts on your new account so you see any future charge the day it posts.

1
Consumer Financial Protection Bureau. Regulation E Section 1005.6 – Liability of Consumer for Unauthorized Transfers
2
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
3
Federal Trade Commission: IdentityTheft.gov. Identity Theft Recovery Steps
4
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
5
Consumer Financial Protection Bureau. Regulation E Section 1005.11 – Procedures for Resolving Errors
6
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
7
Consumer Financial Protection Bureau. Regulation E Section 1005.2 – Definitions
8
Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
9
Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
10
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
11
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
12
Federal Trade Commission. Credit Freezes and Fraud Alerts