What a checking account number alone does and does not let someone do

A checking account number by itself is not enough to drain your account or make purchases. Someone would need both your account number and your routing number to set up a transfer or automatic payment, and even then, most banks require additional verification before money moves. A scammer with only your account number cannot log into your online banking, cannot order a debit card in your name, and cannot access your balance or transaction history.

That said, your account number is not harmless information. It can be used to set up unauthorized automatic bill payments or ACH transfers if paired with your routing number, and it may be used to attempt fraudulent checks. The risk depends on what else someone has and what they do with it.

Key Takeaways

  • Your account number alone cannot be used to transfer money or make purchases without your routing number and additional bank verification.
  • Someone with both your account and routing number can attempt ACH transfers or set up automatic payments, but most banks will flag or block unauthorized requests.
  • If you believe your account number has been compromised, contact your bank immediately to monitor for fraud and place a fraud alert on your credit file.
  • Your bank can reverse fraudulent transfers and automatic payments, and federal law limits your liability for unauthorized ACH transactions to $50 if you report within 60 days.

What requires your account number and routing number together

An ACH transfer—the electronic movement of money between bank accounts—requires both numbers. So does setting up an automatic bill payment through a biller's website. If someone has both pieces of information, they can attempt to pull money from your account by posing as a business collecting a payment or by initiating a transfer to an account they control.

Banks are required to verify ACH requests, but the verification process varies. Some billers ask only for the account and routing number; others require a one-time authorization code or a phone call. If a fraudulent ACH request comes through, your bank may catch it during its own review, or it may process first and you catch it later when you see the transaction.

What your account number cannot do on its own

Your account number cannot be used to log into your online banking portal—that requires your username and password. It cannot be used to order a replacement debit card or change your address on file. It cannot be used to view your balance, transaction history, or account details. A scammer cannot use it to apply for a credit card or loan in your name, because credit applications require a Social Security number and identity verification.

Fraudulent checks are a separate risk. If someone has your account number and routing number, they can print checks and attempt to cash them. However, checks require a signature, and most retailers and banks verify the signature or the check number sequence. A check with a mismatched signature or an unusual number range is more likely to be caught.

How to respond if your account number has been shared

If you believe your account number has been compromised—whether you shared it accidentally, it was stolen, or you saw it on a receipt or statement—contact your bank by phone immediately. Do not wait for a statement or for fraud to appear. Tell them you want to monitor the account for unauthorized activity and ask whether they recommend closing the account and opening a new one.

Your bank can flag your account for suspicious activity and may require verbal authorization before processing any ACH transfers or automatic payments for a set period. Some banks offer this as a temporary hold; others can make it permanent. Ask what options are available and what the process is if a legitimate payment is blocked.

Place a fraud alert with the three major credit bureaus (Equifax, Experian, and TransUnion) by contacting one of them; the alert will be shared with the others. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can do this online or by phone, and it costs nothing.

What federal law says about unauthorized ACH transfers

The Electronic Funds Transfer Act limits your liability for unauthorized ACH transfers to $50 if you report the fraud within 60 days of the transaction appearing on your statement. If you report after 60 days, your liability can be higher, up to $500 or more depending on the circumstances and your bank's policies.

Your bank is required to investigate any claim of unauthorized transfer and must either reverse the transaction or explain in writing why they believe it was authorized. The investigation typically takes 10 business days, though your bank may credit your account provisionally while they investigate.

This protection applies to ACH transfers and automatic bill payments. It does not cover debit card fraud or check fraud, which have different rules and different liability limits.

Steps to take if unauthorized transactions appear

As soon as you see a transaction you did not authorize, call your bank's fraud line. Do not use the number on the back of your debit card if you suspect the card itself has been compromised; instead, look up the bank's fraud number on their website or your statement. Explain what happened and ask them to reverse the transaction immediately.

Follow up with a written dispute letter within 60 days of the transaction date. Include your account number, the date and amount of the unauthorized transaction, and a brief explanation of why you believe it was unauthorized. Send it certified mail with return receipt so you have proof of delivery. Your bank must respond in writing within 10 business days.

Keep copies of all correspondence, including the certified mail receipt, your bank's response, and any transaction records. If your bank refuses to reverse the transaction, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator.

When to close your account and open a new one

If your account number has been used for multiple unauthorized transactions, or if you believe it has been compromised in a data breach affecting many people, closing the account and opening a new one may be the safest option. Your bank can do this in one visit or over the phone.

Before you close, make sure all automatic payments and direct deposits are set up with your new account number. Update your employer's payroll system, any subscription services, and any billers you pay automatically. This usually takes a few days to process, so plan ahead if you have bills due soon.

Your old account will remain open for a short period to allow pending transactions to clear, then it will be closed. You will not be charged for closing an account due to fraud.

Frequently Asked Questions

Can someone use my account number to buy things online?

Not directly. Online purchases require a debit card number, expiration date, and CVV code—not a checking account number. However, if someone has your account and routing number, they could attempt to set up an automatic payment or ACH transfer to a merchant account they control, which is a different kind of fraud.

What if I gave my account number to a business and they charged me without permission?

Contact your bank and report it as an unauthorized ACH transfer. Your bank can reverse it if you report within 60 days. You are liable for only $50 under federal law. The business may claim you authorized it, but your bank will investigate your account history and the transaction details.

Do I need to close my account if someone sees my account number?

Not necessarily. If your account number was seen once but not used, monitoring your account for 30 to 60 days is usually enough. If you see unauthorized activity, contact your bank immediately. Closing is a better option if the number has been compromised in a breach or used multiple times.

Will my bank refund me if someone steals money using my account number?

Yes, if you report it within 60 days. Your liability is capped at $50 under federal law. Your bank must investigate and either reverse the transaction or prove you authorized it. The process takes about 10 business days, though your bank may credit your account while they investigate.

How do I know if my account number was part of a data breach?

Check your bank's website or call their customer service line. Major breaches are usually announced publicly, and your bank will contact you directly if your account was affected. You can also monitor your credit reports at annualcreditreport.com for signs of fraud.