What a bank account number alone lets someone do
A bank account number by itself is not enough to drain your account or make unauthorized transfers. Your account number identifies where money goes, but it does not authorize who can move it. To actually take money out, someone needs either your PIN, your online banking password, your debit card, a signed check, or access to your account through your bank's website or app.
That said, your account number is not harmless. Someone with your account number and routing number can set up automatic payments from your account, deposit money into it (which sounds good but can be a scam), or use it to attempt ACH transfers. They can also use it to open a new account in your name at a different bank, or to apply for credit using your information.
The risk depends on what else they have. Your account number alone is a piece of a larger puzzle. Combined with your name, address, and Social Security number, it becomes much more dangerous.
Key Takeaways
- Someone with only your account and routing number cannot withdraw money without your PIN, password, or debit card.
- They can set up automatic payments from your account or attempt ACH transfers, which your bank may block or which you can dispute.
- The real danger is when your account number is combined with your name, address, and Social Security number, which enables identity theft or fraudulent account opening.
- If you notice unauthorized activity, contact your bank immediately and file a dispute; federal law limits your liability for unauthorized transfers.
- Sharing your account number for legitimate payments (direct deposit, bill pay) is safe as long as you trust the recipient.
Automatic payments and ACH transfers from your account
Someone with your account and routing number can attempt to set up an automatic payment or ACH (Automated Clearing House) transfer from your account. This is how payroll deposits and bill payments work — they use only your account number, not a password. A scammer can try to do the same thing.
However, most banks require additional verification before allowing a new automatic payment to be set up. Some require you to confirm it through your online banking portal or via a code sent to your phone. Others allow the payment to start but send you a notice so you can stop it. If you see an unauthorized automatic payment pending, contact your bank immediately and ask them to reverse it. You can also dispute the charge, and federal law protects you from liability for unauthorized ACH transfers.
The window to stop an ACH transfer is narrow — usually one business day before it processes — so speed matters. Set up account alerts through your bank's app so you are notified of any new payments or transfers.
Opening accounts or taking out credit in your name
Your account number alone will not let someone open a bank account in your name, but combined with your name, address, and Social Security number, it becomes part of a complete identity theft toolkit. Someone with all four pieces of information can walk into a bank branch and open a new account, or apply for credit cards and loans online.
This is why your Social Security number is the most dangerous piece of your financial identity. Your account number is just the routing destination. If you have shared your account number with someone and later suspect identity theft, place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) by calling 1-888-397-3742. You can also request a free credit report at annualcreditreport.com to check for accounts you did not open.
When it is safe to share your account number
Sharing your account number for legitimate purposes is safe. Your employer needs it to set up direct deposit. Your utility company needs it to set up automatic bill pay. Your mortgage lender needs it to collect payments. These are all standard transactions that require only your account and routing number.
The key is trusting the organization you are sharing it with. If you initiated the request — you called your bank, you signed up for a service, you filled out a form — the risk is low. If someone contacted you out of the blue asking for your account number, that is a red flag. Legitimate companies rarely ask for your account number via email, text, or unsolicited phone call.
When you share your account number, you are not giving someone access to your account. You are giving them a way to send money to it or pull money from it through a specific, traceable method. Your bank can see who initiated each transaction and can reverse it if it was unauthorized.
What to do if your account number has been compromised
If you believe your account number has been shared with someone you do not trust, you have options. You do not need to close your account unless unauthorized activity has already occurred. Instead, monitor your account closely for the next 30 to 60 days. Set up alerts for any deposits, withdrawals, or new automatic payments.
If you see unauthorized activity, contact your bank immediately. Report the specific transaction, the date it occurred, and whether it was a withdrawal, deposit, or automatic payment. Your bank will investigate and can reverse unauthorized transfers. Under the Electronic Funds Transfer Act, your liability for unauthorized transfers is limited to $50 if you report it within two business days, and $500 if you report it within 60 days.
If the unauthorized activity involves checks or debit card fraud rather than ACH transfers, different rules apply and your liability may be different. Ask your bank which rules cover your specific situation.
The difference between account number and debit card number
Your debit card number is different from your account number, and it carries different risks. Someone with your debit card number (but not the card itself) can attempt to make online purchases, but most merchants require the three-digit security code on the back of the card. Someone with your account number cannot make purchases at all — they can only move money in or out through banking channels.
If your debit card is lost or stolen, call your bank immediately to freeze it. If your account number is compromised, you do not need to freeze anything — you just need to watch for unauthorized activity. The account number is a routing tool, not a key to your money.
Deposits into your account using your account number
Someone can deposit money into your account using your account number and routing number. This sounds harmless, but it can be part of a scam. In some schemes, a scammer deposits a check or makes a transfer into your account, asks you to wire the money somewhere else, and then the original deposit bounces. You are left responsible for the money you wired out.
If someone you do not know deposits money into your account and asks you to send it somewhere, do not do it. Contact your bank and ask them to reverse the deposit. If the deposit came from a check, your bank will hold it for several business days before making the funds available anyway, giving you time to investigate.
Frequently Asked Questions
Can someone pay my bills without my permission if they have my account number?
They can attempt to set up an automatic payment, but most banks require verification before allowing a new payment to start. If you see an unauthorized payment pending, contact your bank immediately to stop it. You can dispute the charge and are protected from liability under federal law.
Do I need to close my account if someone has my account number?
Not unless unauthorized activity has already occurred. Monitor your account for 30 to 60 days and set up alerts. If nothing suspicious happens, your account is safe. Closing it unnecessarily disrupts your direct deposits and automatic payments.
Is my account number the same as my routing number?
No. Your routing number identifies your bank; your account number identifies your specific account at that bank. Both are needed together to send money to or from your account, but neither one alone is enough to authorize a transaction.
What should I do if I gave my account number to someone I now do not trust?
Monitor your account closely for unauthorized activity over the next 30 to 60 days. Set up account alerts through your bank's app. If you see anything suspicious, contact your bank immediately and report it. You are protected from liability for unauthorized transfers if you report them within 60 days.
Can someone use my account number to get a loan in my name?
Your account number alone cannot be used to open credit. However, if combined with your name, address, and Social Security number, it becomes part of an identity theft toolkit. If you suspect identity theft, place a fraud alert with the credit bureaus and check your credit report for accounts you did not open.