Is a car loan company allowed to repossess and put a hold on your bank account then over draft it in New York?

What did you sign? Do you have copies of all the paperwork you signed and that was ever associated with the loan?

They repossessed the car, and then put a hold on your account? Generally an ACH (if that's the way it was done) has to have your signed authorization to do a withdrawal, which is why it's important to know what was signed.