No, someone cannot drain your account with only your account number
A bank account number alone—without your routing number, PIN, password, or online login credentials—is not enough for someone to withdraw money, transfer funds, or access your account. Banks use multiple layers of verification before allowing any transaction. Your account number is one piece of information, but it is not a key to your money.
That said, your account number is not completely harmless information. It can be used in specific ways that create real problems, even if direct theft is not one of them. Understanding what is actually at risk helps you decide when to worry and when not to.
Key Takeaways
- Someone with only your account number cannot withdraw money, transfer funds, or log into your online banking without additional information like your password or PIN.
- Your account number can be used to set up unauthorized automatic payments or recurring charges if combined with your routing number and other details.
- A bad actor with your account number and routing number together can attempt ACH transfers or direct debits, which is why you should monitor your statements regularly.
- Your account number appears on checks, bills, and statements you receive regularly, so treat it like information that will eventually become public.
- If you notice unauthorized activity, contact your bank immediately—federal law limits your liability for fraudulent transfers if you report them within 60 days.
What requires more than just your account number
Online banking access requires your username and password, which are separate from your account number. Your bank does not use your account number as a login credential. Even if someone has your account number, they cannot guess or brute-force their way into your online account without knowing your login details.
Withdrawing cash at an ATM requires your debit card and PIN. Your account number alone will not open an ATM or dispense money. Similarly, writing a check requires the physical check itself, which has your account number printed on it, but also requires a signature—and even then, the check must clear through the banking system, which includes verification steps.
Wire transfers and most electronic transfers require authentication through your bank's secure system. You typically have to log in, verify your identity a second time, and confirm the transfer amount and recipient. Your account number is part of the routing information, but it is not the authentication itself.
What someone can attempt with your account number and routing number together
If someone has both your account number and your routing number, they have the information needed to attempt an ACH transfer—an automated clearing house transfer that moves money between bank accounts. This is the real risk. ACH transfers are how employers deposit paychecks, how you pay bills online, and how businesses collect recurring payments.
A bad actor with both numbers can try to set up an unauthorized automatic payment from your account. They might attempt to pull money out for a fake subscription, a fraudulent utility bill, or a phony loan payment. The transfer may go through initially, but it will show up on your bank statement, and you can dispute it.
Your routing number is not secret—it is printed on every check and is publicly available for every bank. Your account number is semi-public: it appears on your checks, your statements, and anywhere you have set up automatic payments. Together, they are enough to attempt a transaction, but not enough to complete one without your bank catching it or you noticing it on your statement.
How your bank protects you even when fraud happens
Federal law limits your liability for unauthorized electronic transfers. If you report fraudulent activity within 60 days of your statement date, your bank must investigate and typically refund the money. If you wait longer than 60 days, your liability increases, but you are still protected in most cases.
Banks also monitor accounts for suspicious activity. An ACH transfer from an unknown source to an unfamiliar recipient may trigger a fraud alert or be blocked outright. Large transfers or transfers to high-risk destinations are often flagged automatically. Your bank may contact you to verify before the transfer clears.
Dispute processes are built into the system. If you see a charge you did not authorize, you can call your bank, file a dispute, and the bank will reverse the charge while they investigate. This is different from credit card fraud—with a bank account, the money comes out first, but you can get it back.
When your account number does appear in public
Your account number is printed on every check you write. Anyone who receives a check from you has your account number. This is why checks are considered less secure than other payment methods—the account information is visible on the physical document.
Your account number also appears on bank statements, bills you pay, and anywhere you have authorized a company to pull money from your account. Utility companies, insurance providers, and subscription services all have your account number on file. This is normal and necessary for those transactions to work.
If you are concerned about your account number being exposed, you do not need to close your account or change your number. Instead, monitor your statements regularly—weekly or monthly—and report any unauthorized activity immediately. This is more practical than trying to keep your account number secret.
Steps to take if you think your account number has been compromised
First, check your bank statement for any unauthorized charges or transfers. Look for ACH debits, wire transfers, or automatic payments you did not set up. If you see something suspicious, contact your bank by phone immediately. Do not use email or online chat for fraud reports—call the number on the back of your debit card or on your statement.
Ask your bank to review your account for unauthorized activity in the past 30 to 60 days. They can see all transactions, including pending ones. If fraud is confirmed, your bank will reverse the charges and may issue you a new debit card and account number.
Consider placing a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) if you believe your personal information has been compromised beyond just your account number. A fraud alert makes it harder for someone to open new accounts in your name. You can place one for free by contacting any of the three bureaus.
When to worry less about your account number being public
If your account number was exposed in a data breach from a company you do business with—a utility, an insurance company, or a subscription service—you do not need to panic. These companies already have your account number as part of normal business. The risk is not significantly higher than it was before the breach.
If someone found a check you wrote or saw your account number on a bill, the risk is low. Millions of checks are processed every day, and account numbers are visible on all of them. Fraud from a single exposed account number is rare because the bad actor would need to know your routing number as well, and even then, the transaction would show up on your statement.
If you are worried about a specific situation—a lost check, a data breach notification, or a suspicious email—contact your bank directly. They can tell you whether your account is at elevated risk and what steps to take. Most of the time, the answer is to monitor your statement and report anything unusual.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, government ID, and a signature. Your account number alone cannot be used to create an account in someone else's name. If you are concerned about identity theft, monitor your credit report and place a fraud alert with the credit bureaus.
What if someone has my account number and routing number but not my name?
They can attempt an ACH transfer, but it will likely fail or be flagged because the account holder's name will not match. Banks verify that the name on the receiving account matches the name on the sending account for most transfers. A mismatch triggers a review or rejection.
Should I change my account number if it has been exposed?
Not necessarily. Changing your account number is inconvenient—you have to update automatic payments, direct deposits, and any recurring charges. Monitor your statement instead. If unauthorized activity occurs, your bank will reverse it and can issue you a new number then. Most people never need to change their account number.
How often should I check my bank statement for fraud?
Check at least once a month, ideally more often. Many banks offer daily or weekly statement summaries through their app or email. The sooner you spot unauthorized activity, the sooner you can report it and the easier the dispute process becomes. You have 60 days to report fraud, but reporting within days is better.
What is the difference between a debit card dispute and an ACH dispute?
A debit card dispute is for charges made with your physical card or card number. An ACH dispute is for automatic transfers pulled from your account using your account and routing numbers. Both are protected by federal law, but the process and timeline differ slightly. Your bank can explain which type applies to your situation.