What a bank account number alone lets someone do
A bank account number by itself is not enough to drain your account or make purchases. Someone would need your account number and your routing number together to set up a transfer out of your account — and even then, most banks require additional verification before moving money. A scammer with only your account number cannot log into your online banking, cannot use a debit card, and cannot make a purchase at a store.
The real risk is more specific: your account number can be used to set up an ACH transfer (an electronic bank-to-bank transfer) out of your account if the person also has your routing number. This is why both pieces of information together matter. A single number is incomplete.
Key Takeaways
- Your account number alone cannot be used to transfer money, make purchases, or access your account online.
- An ACH transfer out of your account requires both your account number and routing number, plus the sender's bank information.
- Most banks will reverse an unauthorized ACH transfer if you report it within a set window, usually 60 days.
- If you gave your account number to a business for a legitimate reason (payroll, bill payment), that business can only use it for that specific purpose.
- Sharing your account number with a stranger or on an unsecured website is the main scenario where real harm becomes possible.
How ACH transfers work and why both numbers matter
An ACH transfer is a request sent through the banking system to move money from one account to another. To start an ACH transfer, someone needs the receiving account number, the receiving routing number, and the name on the account. Your account number alone does not give them the routing number — they would have to know or find that separately.
Once they have both numbers, they can instruct their own bank to pull money from your account. Your bank will process the transfer unless you have set up blocks or unless the transfer looks obviously fraudulent. This is why ACH fraud is a real concern — it does not require your password or your debit card.
However, most banks allow you to dispute an unauthorized ACH transfer within 60 days of the transaction. If you report it, the bank will usually reverse the charge and return the money to your account while they investigate.
Why businesses ask for your account number
Employers, insurance companies, and utility providers ask for your account number and routing number because they need to send you money (payroll, refunds, reimbursements) or take money from your account (automatic bill payments). They are not asking for your password or your online banking login.
When you give your account number to a business for a legitimate purpose, that business is legally bound to use it only for that purpose. An employer cannot use your account number to make random transfers. A utility company cannot use it to charge you for services you did not order. If they do, you can report the unauthorized transfer to your bank and dispute it.
The risk increases only when you give your account number to someone you do not know or trust, or when you enter it on a website that does not look legitimate.
What scammers actually need to harm your account
To cause real damage, a scammer needs more than just your account number. Here is what different types of fraud actually require:
| Type of Fraud | What They Need | How to Protect Yourself |
|---|---|---|
| ACH transfer out of your account | Account number + routing number + your name | Monitor your account for unauthorized transfers; report within 60 days |
| Debit card fraud | Card number, expiration date, CVV | Your account number is not on your debit card; this is separate |
| Online banking access | Username + password + possibly a security code | Your account number is not your password; never share login credentials |
| Opening a new account in your name | Social Security number + name + address + ID | Your account number alone cannot be used for identity theft |
Steps to take if you think your account number was compromised
If you shared your account number with someone you do not trust, or if you entered it on a website that looked suspicious, contact your bank immediately. Tell them the situation and ask them to watch your account for unauthorized activity. Most banks can flag your account for monitoring at no cost to you.
Check your account statements for the next 60 days for any transfers you did not authorize. If you see one, report it to your bank right away. You do not have to wait for the transfer to clear or for money to actually leave your account — report it as soon as you see it pending.
If your bank confirms an unauthorized transfer, they will reverse it and return your money while they investigate. Keep records of all your communications with the bank, including the date, time, and name of the person you spoke with.
When you should be concerned about your account number
You should be cautious if you gave your account number to someone who called you unsolicited and claimed to be from your bank, the IRS, or a government agency. Real banks and government agencies do not call asking for your account number. If someone calls claiming to be from your bank, hang up and call your bank directly using the number on the back of your card or on your statement.
You should also be cautious if you entered your account number on a website that did not have a secure connection (look for "https://" and a lock icon in the address bar) or if the website looked poorly designed or had spelling errors.
In contrast, you should feel safe giving your account number to your employer for direct deposit, to your insurance company for refunds, or to a utility company for automatic bill payment. These are standard, expected uses of your account number.
What to do if someone is making unauthorized transfers
If you see unauthorized ACH transfers on your account, call your bank immediately — do not wait. Tell them the date of the transfer, the amount, and the name of the account or business it came from if you can see it. Your bank will start an investigation and can reverse the transfer while they look into it.
You may also want to place a fraud alert on your credit report by contacting one of the three credit bureaus (Equifax, Experian, or TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts in your name. This is a separate protection from your bank account and takes about 15 minutes to set up.
If the unauthorized transfers continue or if your bank does not help, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints about banks and can push your bank to resolve the issue.
Frequently Asked Questions
Can someone use my account number to open a credit card in my name?
No. Opening a credit card in your name requires your Social Security number, date of birth, and usually a government ID. Your account number alone cannot be used for identity theft. However, if someone has your Social Security number and other personal information, that is a different and more serious problem.
What if I gave my account number to a website and now I am worried?
Monitor your account for the next 60 days for any transfers you did not authorize. If you see something suspicious, report it to your bank immediately. Most banks will reverse unauthorized transfers. If nothing appears within a few weeks, the risk has likely passed.
Is it safe to put my account number on a check?
Yes. Your account number is printed on every check you write, and checks are handled by mail carriers and store employees all the time. The account number on a check is expected and necessary. The risk is much lower than giving your account number to a stranger online.
Can my bank hold me responsible for an unauthorized ACH transfer?
No, not if you report it within 60 days. Federal law (Regulation E) requires banks to reverse unauthorized ACH transfers and return your money. If your bank refuses, you can file a complaint with the CFPB.
Do I need to close my account if someone has my account number?
Not necessarily. Closing your account is a last resort. Start by monitoring your account and asking your bank to flag it for fraud. If unauthorized transfers continue and your bank does not help, then consider closing the account and opening a new one.