A bank can take money from your account without permission in a narrow set of situations: to collect a debt you owe the same bank (called setoff), to comply with a garnishment or tax levy, and to charge fees you agreed to when you opened the account. Anything outside those categories — fraud, a bank error, an overdraft fee you never opted into, a seizure of protected benefits — is disputable, and federal rules often require the bank to give the money back if you report the problem in time.
The first move is figuring out which category your missing money falls into, because the rules, deadlines, and protections are completely different for each.
Setoff: When the Bank Pays Itself From Your Account
If you owe money to the same bank where you keep your checking or savings — a car loan, a personal loan, a line of credit — the bank may have contractual authority to reach into your deposit account and take what you owe. This is called the right of setoff, and it is almost always buried in the account agreement you signed when you opened the account.
Two conditions generally have to be met. The debt has to be past due, and the account and debt need to be in your name at the same institution. The bank doesn’t need a court order, and it doesn’t have to warn you first. You may only discover the setoff when your balance drops or a payment bounces.
Joint accounts complicate things. Whether a bank can pull funds from a joint account to satisfy one holder’s individual debt depends on the account agreement and state law.
There is one firm federal limit worth knowing. A credit card issuer cannot offset your credit card balance against funds in your deposit account at the same bank.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions If you are behind on a bank-issued credit card, the bank cannot simply pull the balance from your checking account. It has to go through the same collection process as any other creditor. This carve-out applies only to credit card debt; loans and lines of credit are treated differently.
If you think a setoff was improper, pull your loan agreement and account disclosures. Confirm the debt was actually past due, that the agreement authorizes setoff, and that the bank didn’t touch exempt funds like Social Security. If any of those conditions weren’t met, you have grounds to push back.
Garnishments and Tax Levies
A garnishment or levy is a legal order from a court or a government agency directing the bank to freeze your money and hand it over to someone you owe. The bank has no discretion. Once it receives a valid order, it must comply. Common triggers include unpaid federal or state taxes, child support arrears, and civil court judgments.
IRS Bank Levies
When the IRS levies your bank account, the bank freezes the funds as of the moment the levy is received. There is then a 21-day waiting period before the bank sends the money to the IRS.2Internal Revenue Service. Information About Bank Levies That window exists so you can contact the IRS to resolve the debt, arrange a payment plan, or flag errors in the levy itself. The levy normally applies only to funds sitting in the account on the date it is received; money deposited afterward is generally not affected.
Judgment Creditor Garnishments
A creditor with a court judgment against you can obtain a writ of garnishment, which the bank must honor by freezing funds up to the judgment amount. You typically get notice of the garnishment and an opportunity to claim exemptions, but the timing of that notice varies by state.
Federal Benefits the Bank Must Protect Automatically
Certain federal benefits are shielded from most garnishments and levies. When a bank receives a garnishment order, it must look back at the account’s deposit history over the prior two months for protected federal payments. If it finds any, it must keep the lesser of your current balance or two months’ worth of those benefits accessible to you, with no freeze and no seizure.3eCFR. 31 CFR Part 212 – Garnishment of Accounts Containing Federal Benefit Payments
The protected payments include:
- Social Security and Supplemental Security Income (SSI)
- Veterans benefits
- Railroad retirement and railroad unemployment insurance benefits
- Federal employee retirement benefits under CSRS and FERS
You do not have to file paperwork for this protection to kick in. The bank is supposed to identify and shield those deposits on its own. If you receive protected benefits and your entire account was frozen anyway, call the bank immediately and point to the direct deposits on your statement.
Fees the Bank Can Charge Without Asking Each Time
Some withdrawals you didn’t authorize in the moment are ones you agreed to in your account’s fine print. Banks are permitted to charge monthly maintenance fees, low-balance penalties, out-of-network ATM surcharges, and inactivity fees on dormant accounts, as long as those fees were disclosed when you opened the account.4Office of the Comptroller of the Currency. The Bank Is Charging High Service / Activity / Maintenance Charges / Bank Fees on My Checking Account
Overdraft fees are the big exception. Before a bank can charge you a fee for covering an ATM withdrawal or a one-time debit card transaction that overdraws your account, it must get your clear, affirmative consent to enroll you in overdraft coverage. Without that opt-in, the bank should simply decline the transaction and charge no fee.5Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2024-05 – Improper Overdraft Opt-In Practices If you never opted in and the bank is hitting you with overdraft fees anyway, that’s a violation worth disputing.
When the Withdrawal Isn’t Legitimate
Everything above is a taking the bank is allowed to make. Now the other category: money that left your account through fraud, a bank error, or a merchant mistake. Here, federal law generally puts the loss back on the bank if you speak up in time.
Regulation E and Unauthorized Electronic Transfers
Regulation E governs unauthorized electronic fund transfers — debit card charges, ACH transfers, ATM withdrawals, and transfers through payment apps like Zelle, Venmo, and Cash App. The CFPB has confirmed that when a fraudster hacks your account or steals your credentials and pushes money out through one of those apps, Regulation E protections apply.6Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
A transfer is “unauthorized” when someone other than you initiated it without your permission and you didn’t benefit from it.7eCFR. 12 CFR 1005.2 – Definitions One catch: if you voluntarily gave someone your debit card or login, transfers by that person are not considered unauthorized until you tell the bank to revoke their access.
How Fast You Report Controls What You Lose
Under Regulation E, the timing of your report determines your maximum liability:8eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning about the theft, and your maximum liability is the lesser of $50 or the amount stolen before you notified the bank.
- Report after 2 business days but within 60 days of the statement being sent, and liability can climb to $500.
- Wait longer than 60 days from the statement date, and you face unlimited liability for further unauthorized transfers that happen after that window closes.
Those dollar caps apply regardless of how much was stolen. Most people who lose money to bank fraud lose it here, by waiting too long to check statements.
Check Fraud Is Different
Regulation E doesn’t cover paper checks. If someone steals a check from your mailbox and alters the payee or amount, the dispute runs through the Uniform Commercial Code, which requires you to review your statements with reasonable promptness. The hard outer deadline is one year: if you don’t discover and report an unauthorized signature or alteration within one year of the statement being made available, you lose the claim against the bank entirely.9Cornell Law School. Uniform Commercial Code 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
The Bank’s Investigation Clock
Once you report an unauthorized electronic transfer, the bank must investigate and reach a conclusion within 10 business days. If it can’t finish in time, it has to provisionally credit your account for the disputed amount while the investigation continues, and the full investigation has to wrap up within 45 days.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Some situations get longer clocks: new accounts (opened within 30 days of your first deposit), point-of-sale debit card disputes, and foreign-initiated transfers can stretch the investigation window to 90 days.
How to Dispute a Withdrawal You Didn’t Authorize
Secure the Account First
Change your online banking password and PIN immediately. If a debit card was involved, ask the bank to cancel it and issue a replacement. If you suspect someone has your login credentials, turn on two-factor authentication. The point is to stop further unauthorized transfers while you deal with the one already on your statement.
Call the Bank
Call as soon as you spot the problem. Under Regulation E, an oral report is enough to start the bank’s investigation clock; the bank can’t wait for a written notice.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Note the date, time, and name of the representative you spoke with.
Follow up with written confirmation within 10 business days, whether the bank asks for it or not. A written record protects you if the bank later claims you never reported the issue. Include your name, account number, the dollar amount and date of the transaction, and why you believe it was unauthorized. Send it by certified mail with a return receipt.
Getting the first report in within two business days of learning about the fraud is the single most important thing you can do. It’s the difference between a $50 cap on your liability and a $500 one.
Gather Evidence
Build a paper trail:
- Bank statements showing the unauthorized debit
- Correspondence proving you didn’t initiate the charge
- A police report if the withdrawal involved criminal fraud
- An FTC Identity Theft Report from IdentityTheft.gov if someone used your personal information
If the issue is a bank setoff, gather your loan agreements and account disclosures to see whether the setoff was actually authorized and whether any exempt funds were taken. If it’s a garnishment or levy, request a copy of the court order or IRS notice the bank received.
If the Bank Denies Your Claim
When the bank finishes its investigation and decides no error occurred, it has to give you a written explanation within three business days and let you know you can request the documents it relied on.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Ask for those documents. Denials often rest on IP address logs, device fingerprints, or geolocation data that can be explained once you see it.
File a Regulatory Complaint
If the bank won’t reverse the denial, escalate to a federal regulator. Which one depends on how the bank is chartered:
- National banks and federal savings associations: Office of the Comptroller of the Currency (OCC)
- State-chartered banks: FDIC or your state banking department
- Any bank or deposit product: Consumer Financial Protection Bureau (CFPB)
The CFPB complaint process tends to be the most effective for individual consumers. You file online, the bureau forwards the complaint to the bank, and most banks respond within 15 days.11Consumer Financial Protection Bureau. Submit a Complaint12OCC. Consumer Protection A federal agency forwarding your complaint tends to get more attention than a second call to customer service.
Arbitration or Small Claims
Before you sue, check your account agreement for a mandatory arbitration clause. Many bank deposit agreements include one, meaning you may have waived your right to court when you opened the account. If the agreement has no arbitration clause, or if it carves out small claims, small claims court is a practical route. Filing fees are low, you don’t need a lawyer, and state dollar limits typically run from $5,000 to $25,000.