No, a company cannot take money from your bank account without permission. Federal law requires your explicit authorization before any electronic withdrawal, and a company that pulls funds without it is exposed to civil damages, criminal penalties, and regulatory action. The harder questions are what counts as authorization, what to do when a withdrawal you never agreed to shows up on your statement, and how quickly you have to move to get your money back.
What Counts as Authorization Under Federal Law
The Electronic Fund Transfer Act and its implementing rule, Regulation E, govern electronic debits from consumer accounts. A recurring or preauthorized withdrawal requires a signed or similarly authenticated written authorization, and the company must give you a copy. Before the first debit, the company has to disclose the types of transfers, any frequency or dollar-amount limits, and the terms of the arrangement. If the amount of a scheduled recurring withdrawal changes, you’re entitled to written notice at least 10 days before the new amount is pulled.1eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
Ambiguous contract language does not save a company here. Courts read unclear terms against the party that drafted them, so a company that hides withdrawal rights in vague fine print is not on solid ground.
When Money Can Leave Your Account Without Your Consent
A private company acting on its own cannot lawfully take your money without authorization. There are, however, a few outside situations where funds can leave without your say-so, and it helps to recognize them so you don’t confuse them with an unauthorized company debit.
The IRS can issue a levy to your bank for unpaid taxes. The bank must freeze the funds and hold them for 21 days before sending them to the IRS, giving you time to dispute or resolve the debt.2eCFR. 26 CFR 301.6332-3 – The 21-Day Holding Period Applicable to Property Held by Banks
If you owe the same bank that holds your account, the bank can exercise a right of setoff and pull funds to cover the defaulted debt, without a court order. Most account agreements include a setoff clause.
A creditor with a court judgment against you can obtain a writ of garnishment ordering your bank to freeze and turn over funds. You are entitled to notice and a chance to object, with a hearing available shortly after you file the objection.3Office of the Law Revision Counsel. 28 USC 3205 – Garnishment Social Security, veterans’ benefits, and certain other federal benefits are generally protected.
How to Stop Recurring Withdrawals You Already Authorized
If you signed up for something and now want the debits to stop, take two steps and do both.
Tell the company in writing that you are revoking authorization. Some companies honor this promptly; others do not.
More importantly, tell your bank. Regulation E lets you stop any preauthorized electronic transfer by notifying your bank at least three business days before the scheduled date, orally or in writing.4eCFR. 12 CFR 205.10 – Preauthorized Transfers The bank can require you to follow up an oral request with written confirmation within 14 days, and the oral order lapses after that window if you don’t. If you give a valid stop-payment order in time and the bank lets the debit through anyway, the bank is liable for your losses.5eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
When a Transfer Counts as Unauthorized
The strength of your legal position depends on whether the transfer was “unauthorized” as the statute uses that word: initiated by someone other than the consumer, without actual authority, and from which the consumer received no benefit.6Office of the Law Revision Counsel. 15 USC 1693a – Definitions
If a scammer tricks you into sharing a card number, login, or one-time code and then uses that information to move money, the transfer is unauthorized and Regulation E protections apply. The CFPB has confirmed this covers fraudulent inducement to hand over account access.7Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
Two situations fall outside that protection. If you voluntarily gave someone access to your card or account and they misused it, you are not covered unless you had already notified the bank that their access was revoked.7Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs And if you pushed the button yourself, sending money through a peer-to-peer app after being lied to, recovery is much harder because the transfer was technically authorized by you.
How Fast You Report Controls How Much You Lose
Regulation E ties your maximum liability to how quickly you notify your bank of an unauthorized electronic transfer.
- Report within 2 business days of learning about it: your liability caps at $50.
- Report after 2 business days but within 60 days of the statement showing the transfer: liability can rise to $500.
- Report more than 60 days after the statement: there is no cap on losses from transfers made after that 60-day window.
The bank must be able to show that earlier notice would have prevented the later transfers.5eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Many banks advertise “zero liability” policies on debit cards that go further than the federal minimums, but those are voluntary, and their conditions vary.
How to Report and What the Bank Must Do
Call your bank as soon as you spot the withdrawal. Don’t wait until you have paperwork lined up; an oral report starts the clock in your favor, and you can send documentation later.
Once you notify the bank of an error, it generally has 10 business days to investigate. If it needs more time, it must provisionally credit your account within those 10 business days and can then take up to 45 days total to finish investigating.8eCFR. 12 CFR 205.11 – Procedures for Resolving Errors New accounts get 20 business days instead of 10. If the investigation confirms the transfer was unauthorized, the provisional credit becomes permanent.
If your bank mishandles the dispute or the company involved is uncooperative, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372.9Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards complaints and tracks the company’s response.
What the Company Faces
A company that violates the EFTA is liable to the affected consumer for actual damages plus statutory damages between $100 and $1,000 per claim. Class actions can reach the lesser of $500,000 or 1% of the company’s net worth. The statute also lets a winning consumer recover reasonable attorney fees and court costs, which is what makes small-dollar cases economically viable to litigate.10Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
Willful violations of the EFTA carry criminal penalties of up to $5,000 in fines, up to one year in prison, or both. Using a stolen or counterfeit debit instrument for transactions totaling $1,000 or more in a year raises the ceiling to $10,000 in fines and up to 10 years in prison.11Office of the Law Revision Counsel. 15 USC 1693n – Criminal Liability
Regulators add another layer. The CFPB investigates companies, brings enforcement actions, and imposes civil penalties.12Consumer Financial Protection Bureau. Enforcement Actions The FTC handles non-bank entities, and state regulators can revoke licenses and issue cease-and-desist orders.
Recovering Money the Bank Won’t Refund
If the error resolution process doesn’t put you back where you started, you can sue under the EFTA for actual damages, statutory damages up to $1,000, and attorney fees.10Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability For smaller amounts, small claims court is usually faster and doesn’t require a lawyer; state limits typically fall between $2,500 and $25,000. When a company has taken money from many people the same way, a class action can aggregate the claims into a case worth pursuing.