Someone Used My Bank Account to Pay Their Bills: Liability and Refunds

If someone used your bank account to pay their bills, call your bank’s fraud department today, ask them to freeze the account, and file a written notice of error within 10 days. Federal law requires the bank to investigate and, in most cases, refund unauthorized electronic transfers, but your protections depend on how fast you report. Report within 60 days of the statement date that first shows the problem and your maximum liability can be as low as zero when only your account and routing numbers were used.¹ Every day you wait shifts more risk onto you.

What to Do in the First Few Hours

Start with the bank. Tell the fraud department someone made unauthorized transactions, and ask them to freeze or close the compromised account and open a new one. If the person set up recurring payments, request a stop-payment order on those charges. Banks generally need at least three business days’ notice before the next scheduled payment to block it. Many banks charge $20 to $30 per stop-payment order, but your bank may waive the fee for fraud-related requests.

Then file a formal error notice with your bank. This is what triggers the investigation timelines and provisional credit rules under federal law. You can do it by phone, but follow up in writing within 10 days so the bank cannot later claim you missed a confirmation deadline.² While you have the bank on the line, change every password, PIN, and login associated with the account. If you reused any of those credentials elsewhere, change those too.

File a police report the same day if you can. You will need the report number for the bank’s dispute process, for any insurance claim, and for an FTC identity theft report. Then go to IdentityTheft.gov and complete the FTC’s form. The site generates a personalized recovery plan and an official Identity Theft Report you can use with creditors and law enforcement.³

How Much You Can Be On the Hook For

The Electronic Fund Transfer Act and Regulation E set the rules for how much you can lose on unauthorized electronic transfers. Two things drive the number: whether the person used a physical debit card, and how quickly you reported.

When Only Your Account and Routing Numbers Were Used

If someone paid their bills by entering your account and routing number into an online payment system, or set up an ACH debit without ever touching your debit card, the standard $50 and $500 tiers do not apply. You owe nothing as long as you report the unauthorized transfers within 60 days of the statement date that first showed the problem. Miss the 60-day window and you become liable for any unauthorized transfers that happen after the deadline and before you finally notify the bank.¹ This catches many people off guard, because most published advice focuses on debit card tiers. For account-number-only fraud, the 60-day reporting window is the deadline that matters.

When a Debit Card or PIN Was Used

If the person used your stolen or cloned debit card, a tiered liability structure kicks in:

Report within 2 business days: your maximum liability is $50, or the amount transferred before you notified the bank, whichever is less.
Report after 2 business days but within 60 days of your statement: liability can rise to $500.
Report after 60 days: you can lose everything taken after the 60-day mark, with no cap.⁴

Many banks advertise zero-liability policies that go beyond these federal minimums. Those policies are voluntary and often have conditions in the fine print, so treat them as a bonus rather than a substitute for fast reporting.

One boundary worth noting: if the person somehow charged their bills to your credit card instead of your bank account, a separate federal law caps your liability at $50 for unauthorized charges, with no tiered deadlines, and most issuers waive even that. The rules described above apply specifically to your checking account.

What the Bank Must Do After You Report

Once you file a notice of error, the bank must investigate and report its findings within 10 business days. If it needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. During the extended investigation, that provisional credit is yours to use.²

Some situations stretch the clock. For accounts opened within the last 30 days, the bank gets 20 business days instead of 10, and up to 90 days instead of 45. The 90-day extension also applies to point-of-sale debit card transactions and transfers initiated from outside the United States.⁵

If the bank decides no error occurred, it must explain its reasoning in writing and return any documentation you submitted. It can then reverse the provisional credit, but only after notifying you. Watch for this procedural trap: if you initially reported by phone, the bank may require written confirmation within 10 days. Skip that step and the bank has no obligation to give you provisional credit during its investigation.²

If the Bank Denies Your Claim

Banks deny fraud claims more often than people expect, especially when the transactions do not fit obvious fraud patterns or the person had some prior connection to the account. Ask for the bank’s written explanation and any documents it relied on. You have a right to that information.

Your next move is a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards your complaint to the bank, which generally responds within 15 days and must provide a final response within 60 days. After the bank responds, you have 60 days to provide feedback if the resolution is unsatisfactory.⁶ A CFPB complaint does not guarantee a reversal, but it creates a regulatory paper trail, and banks tend to take these complaints more seriously than a repeat call to customer service.

You can also complain to your state attorney general or your state’s banking regulator. If the amount is large, a consumer protection attorney may be worth the call. The EFTA lets successful plaintiffs recover actual damages, statutory damages, and attorney’s fees.

When It Was Someone You Know

Claims get complicated fast when a family member, roommate, or ex-partner is the one who used the account. Under Regulation E, a transfer is not “unauthorized” if it was made by someone you furnished with an access device like a debit card or login credentials, unless you had already notified the bank that the person’s authority was revoked.⁷

In practice: if you once handed your partner your debit card and they later used it to pay their phone bill without permission, the bank may refuse to treat that as unauthorized. You would need to show that you told the bank to cut off that person’s access before the disputed transactions. If you never revoked access in writing or by phone, the bank has a strong basis to deny the claim.

If you have not already revoked access, contact your bank now to remove the person’s authorization, close the compromised account, and open a new one. Anything the person does going forward is clearly unauthorized. For the past transactions, you may have to pursue them directly through criminal charges or civil court.

If Checks Were Involved

Stolen or forged checks fall under a different set of rules. The Uniform Commercial Code, adopted in some form by every state, requires you to review your statements and report unauthorized signatures or alterations promptly. If the same person forges multiple checks and you fail to catch the first one within a reasonable time (which the UCC caps at 30 days from when the statement was available), you lose the right to dispute later forgeries by that same person that the bank paid before receiving your notice.⁸

There is a hard outer deadline too. You have one year from the date your statement was made available to report any unauthorized signature or alteration on a check. Miss that window and the bank owes you nothing.⁸

Going After the Person Who Did It

Using someone else’s bank account to pay bills is a crime. The specific charge depends on how the person accessed the account and how much they took.

Bank fraud under federal law covers anyone who uses false pretenses to obtain money from a financial institution. Convictions can carry fines up to $1 million and up to 30 years in prison, though those maximums are reserved for large schemes.⁹ Identity fraud applies when the person used your personal identifying information to reach your account, with a base penalty of up to 15 years, fines, and forfeiture.¹⁰ Aggravated identity theft, charged when the identity theft happens during another felony like bank fraud, adds a mandatory two-year prison sentence that runs consecutively.¹¹ For smaller amounts, state theft laws typically apply, with penalties tied to the dollar value taken.

A criminal conviction can include a restitution order requiring repayment. Restitution does not depend on filing a separate civil suit, though collecting is a different matter if the person has no assets. To help the case along, bring your police report, bank statements showing the transactions, and any evidence linking the person to the bill accounts where your money went. Prosecutors are more likely to pursue cases where the victim has organized documentation.

Civil Claims to Recover the Money

Criminal prosecution punishes; it does not always make you whole. Civil remedies give you a separate path, and you can pursue both.

The most straightforward claim is conversion, the legal term for someone taking or using your property without permission. You show the person intentionally used funds from your account and that you suffered a loss. Courts can award the amount taken, plus punitive damages in some cases if the conduct was egregious. A related claim, unjust enrichment, focuses on the benefit the person received: if they used your account to pay their electric bill, they were enriched by that amount at your expense, and a court can order them to return it even without a contract between you.

If the person held a position of trust over your finances (a caretaker, power of attorney, financial advisor, or legal guardian), you may also have a breach of fiduciary duty claim, which can carry higher damages. Elder financial abuse statutes in many states add further protections when the victim is elderly.

For amounts under your state’s small claims limit, which ranges from $2,500 to $25,000 depending on where you live, small claims court is faster and cheaper than a full lawsuit. You file in the county where the defendant lives, pay a filing fee, and arrange for service. You usually do not need a lawyer. Bring your bank statements, the police report, and any communications tying the defendant to the payments. Statutes of limitations vary, so file before your deadline runs.

Locking Down Your Identity After the Breach

Someone who had enough information to reach your bank account probably has enough to cause more damage. A few defensive steps now prevent a second round.

A credit freeze is the strongest protection. It blocks anyone, including you, from opening new credit accounts in your name until you lift it. Freezes are free, last indefinitely, and must be placed separately with each of the three major credit bureaus: Equifax, Experian, and TransUnion. You can temporarily lift the freeze when you need to apply for credit.¹²

A fraud alert is less restrictive. It tells lenders to verify your identity before opening new accounts but does not block them from pulling your credit. An initial alert lasts one year and can be renewed. If you have filed a police report or FTC identity theft report, you qualify for an extended alert lasting seven years. You only need to contact one credit bureau; it is required to notify the other two.¹²

Beyond credit, review every other financial account for suspicious activity, request free copies of your credit reports from all three bureaus, and set up transaction alerts on your new bank account so you catch anything the same day it happens. Some homeowners and renters insurance policies also include identity theft endorsements with coverage limits between $5,000 and $50,000, but nearly all of them require a police report before they will pay a claim. That is one more reason to file the report today rather than next week.

1
Consumer Financial Protection Bureau. Regulation E Section 1005.6 – Liability of Consumer for Unauthorized Transfers
2
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
3
Federal Trade Commission: IdentityTheft.gov. Identity Theft Recovery Steps
4
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
5
Consumer Financial Protection Bureau. Regulation E Section 1005.11 – Procedures for Resolving Errors
6
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
7
Consumer Financial Protection Bureau. Regulation E Section 1005.2 – Definitions
8
Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
9
Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
10
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
11
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
12
Federal Trade Commission. Credit Freezes and Fraud Alerts