Your account number alone is not enough to drain your account, but it is part of what a scammer needs
A thief who has only your account number and routing number cannot log into your online banking or move money out on their own. Banks use multiple layers of verification — passwords, security questions, two-factor authentication — to prevent that. However, your account number is valuable to a scammer because it is one piece of a larger puzzle. Combined with other information, it can be used to set up unauthorized transfers, create fraudulent checks, or open accounts in your name.
The real risk is not that someone will guess their way into your account. The risk is that they will use your account number as part of a coordinated fraud scheme where they already have or can obtain your other personal details.
Key Takeaways
- Your account number and routing number alone cannot be used to log into your bank account or withdraw money directly.
- A scammer with your account number plus your name and address can set up unauthorized ACH transfers or create fake checks.
- The most common fraud using account numbers is ACH debit fraud, where someone initiates a transfer from your account without permission.
- If you notice unauthorized activity, contact your bank immediately and file a dispute within 60 days to receive a provisional credit.
- Sharing your account number with trusted payees (employers, utilities, subscription services) is standard and generally safe.
What a scammer can do with your account number
If someone has your account number, routing number, and name, they can attempt to initiate an ACH (Automated Clearing House) transfer from your account. This is a bank-to-bank transfer that does not require a password or login. They can also order checks printed with your account information and routing number, then write fraudulent checks against your account. In some cases, they may try to set up bill payments or recurring debits tied to your account.
The barrier to all of these actions is that your bank has fraud detection systems in place. Large or unusual transfers often trigger alerts. Checks take time to clear and can be stopped. Bill payments sometimes require verification. But if a scammer is patient and knows your full name and address, they can sometimes get past these defenses.
Where your account number gets exposed
You give your account number to people and organizations regularly: your employer (for direct deposit), your utility company, your mortgage lender, your insurance company, subscription services, and anyone you pay by check. This is normal and necessary. The risk is not that these organizations will misuse it — most are regulated and have security requirements — but that their systems could be breached, or that an employee could steal the information.
Account numbers also appear on the bottom of every check you write. If you throw away checks without shredding them, or if a check is lost in the mail, someone could find it. Phishing emails and fake websites designed to look like your bank can trick you into entering your account number. Scammers may also call pretending to be from your bank and ask you to "verify" your account number.
Signs that your account number has been misused
Check your bank statements regularly for unauthorized transactions. Look for ACH debits you did not authorize, especially small test charges (scammers sometimes start with $1 to see if the transfer goes through). Watch for checks you did not write or bill payments you did not set up. Your bank may also alert you to unusual activity via email or text, though be cautious — scammers sometimes send fake alerts to trick you into calling a fraudulent number.
If you notice something wrong, do not wait. Contact your bank by phone using the number on the back of your card or on your statement, not a number from an email or text message. Report the unauthorized transaction and ask your bank to reverse it and issue you a new account number if necessary.
How banks protect you if fraud happens
Federal law limits your liability for unauthorized ACH transfers and fraudulent checks. If you report the fraud within 60 days of the transaction appearing on your statement, your bank must issue you a provisional credit while they investigate. If the bank confirms the transaction was unauthorized, the credit becomes permanent and you owe nothing.
If you wait longer than 60 days to report it, your liability increases. After 120 days, you may not be protected at all, depending on the type of fraud and your bank's policies. This is why checking your statements regularly — weekly or at least monthly — matters. Many banks also offer free monitoring services and fraud alerts if your account is compromised.
Steps to take if you think your account number is compromised
First, contact your bank immediately by phone. Tell them you believe your account number has been compromised and ask them to monitor your account for suspicious activity. Request a new account number and new debit card. Your bank can usually issue these within one to three business days.
Second, review your statements for the past three to six months for any unauthorized transactions. If you find any, dispute them with your bank in writing within 60 days. Third, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) if you are concerned about identity theft beyond just your bank account. A fraud alert is free and lasts one year; a credit freeze is also free and lasts until you remove it.
When it is safe to share your account number
Sharing your account number with your employer for direct deposit is safe. Sharing it with your bank, your mortgage lender, your insurance company, and utility companies is standard practice and generally safe because these organizations are regulated and have security obligations. Sharing it with a trusted friend or family member for a one-time payment is usually fine.
Do not share your account number with someone who contacts you unsolicited, even if they claim to be from your bank. Do not enter it into a website unless you initiated the contact and you are certain the website is legitimate (check the URL and look for a lock icon). Do not share it in response to an email, text, or phone call asking you to "verify" your information. Your bank already has your account number and will never ask you to provide it this way.
Frequently Asked Questions
Can someone withdraw money from my account with just my account number?
Not directly. They cannot log into your online banking or use an ATM with only your account number. However, they can attempt to initiate an ACH transfer or create a fraudulent check if they also have your name and routing number. Your bank's fraud detection systems are designed to catch these attempts, but it is not impossible for them to succeed.
What should I do if I gave my account number to someone I do not trust?
Contact your bank immediately and tell them you are concerned about fraud. Ask them to monitor your account closely and consider requesting a new account number. Review your statements for the next several months for any unauthorized activity. If nothing appears within 30 days, the risk has likely passed, but continue checking regularly.
Is it safe to write checks if someone has my account number?
Yes, as long as you are the one writing them. Your account number is printed on every check you write, so anyone who receives a check from you has it. The risk is if someone uses your account number to print counterfeit checks or to forge your signature. If you are concerned, ask your bank to flag your account for check fraud and monitor for unusual check activity.
How long does it take to get a new account number?
Most banks can issue a new account number within one to three business days. Your old account number will be closed, and your new one will be active once the bank confirms the change. You will need to update your direct deposit information with your employer and update any automatic bill payments with your new account number.
Do I need to file a police report if my account number is used fraudulently?
You do not need to file a police report to dispute the transaction with your bank, but filing one creates an official record that can be useful if the fraud is part of a larger identity theft scheme. Some banks request a police report if the fraud amount is large. Check with your bank about their requirements.