Yes, but only with additional information
A bank account number alone is not enough to drain your account. A thief needs your account number and your routing number to set up a transfer or payment. Even with both, they still cannot access your account through online banking or an ATM — they would need your password and login credentials for that. What they can do is initiate an ACH transfer (a bank-to-bank electronic transfer) or set up a bill payment in your name, which moves money out but leaves a clear trail.
The real risk is not that someone steals your account number from a public source. The risk is that you give it to someone you should not have trusted, or that a data breach at a company you do business with exposes it along with other details. A scammer with only your account number might try to pose as you to a bank representative, but most banks will not process transfers over the phone without additional verification.
Key Takeaways
- Your account number alone cannot be used to log into your account or withdraw cash, so online banking and ATM theft are not possible with this information only.
- A thief with your account number and routing number can attempt an ACH transfer or bill payment, but the transaction will show your account as the source and can be reversed.
- The most common way someone uses a stolen account number is to pose as you when calling your bank, so verify the caller's identity before confirming any account details.
- If you discover unauthorized activity, contact your bank immediately and file a dispute; federal law limits your liability to $50 if you report within two business days.
What an ACH transfer looks like and how it can be reversed
An ACH (Automated Clearing House) transfer is a bank-to-bank electronic payment. If someone has your account number and routing number, they can attempt to initiate an ACH transfer out of your account by posing as you to another bank or payment processor. The transfer will show your account as the source, and your bank will receive a record of it.
The key difference between an ACH transfer and a credit card charge is that ACH transfers are not protected by the same fraud rules. However, you can still dispute the transfer with your bank. If you report it within 10 business days, your bank must investigate. If you report it after 10 days but within 60 days, your bank may still reverse it, though they have more leeway to deny the dispute. After 60 days, reversal becomes much harder.
Your bank may also place a hold on the receiving account if the transfer is flagged as suspicious. Many banks now monitor for unusual ACH activity and will contact you to confirm large or unexpected transfers before they go through.
Phone and email scams that use your account number
The most common scenario is not a hacker stealing your account number from a database. It is a scammer calling you or emailing you, claiming to be from your bank or a company you do business with, and asking you to confirm your account number. Once they have it, they call your actual bank, claim to be you, and try to convince a representative to process a transfer or change your contact information.
Banks are trained to resist this, but it still works sometimes. The scammer might say they are calling from a different branch, or that they need to verify information for a fraud investigation. They may already have your name, address, and last four digits of your Social Security number (from a data breach), which makes the call sound legitimate. If the bank representative is rushed or undertrained, they might process the request.
This is why you should never confirm your full account number over the phone unless you initiated the call to a number you looked up yourself. If someone calls you claiming to be from your bank, hang up and call the number on the back of your debit card or on your bank's official website.
Data breaches and where your account number might be exposed
Your account number can be exposed in a data breach at a company that stores it — a payroll processor, an online retailer, a utility company, or a healthcare provider. When this happens, your number is usually part of a larger dataset that includes thousands or millions of other account numbers. Scammers buy these datasets and use them in bulk attempts to find accounts that are vulnerable.
A breach does not mean your money is gone. It means your account number is now in circulation. The real danger is if the breach also included your name, address, phone number, and email — information that makes it easier for a scammer to impersonate you. Some breaches expose only the account number; others expose the full profile.
If you learn that your account number was exposed in a breach, contact your bank and ask them to monitor your account for suspicious activity. Many banks offer free credit monitoring or fraud alerts as part of their response to breaches. You can also place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) by contacting any one of them.
How to monitor your account and spot unauthorized activity
Check your bank account at least once a week, or set up account alerts through your bank's app or website. Most banks allow you to set alerts for transactions over a certain amount, or for any ACH transfer out of your account. These alerts arrive by email or text message within minutes of the transaction.
Look for small test charges. Scammers sometimes make a small withdrawal (a few dollars or cents) to confirm that an account is active before attempting a larger theft. If you see a charge you do not recognize, report it immediately, even if the amount is small.
Review your bank statements monthly, not just when they arrive. If your bank offers a paperless statement, you can check it online as soon as the statement closes. Many unauthorized transactions are caught weeks after they occur simply because the account holder was not looking.
What to do if you spot unauthorized charges
Contact your bank by phone immediately. Use the number on the back of your debit card or on your bank's official website — do not use a number from an email or text message, even if it looks official. Tell the bank representative that you see unauthorized activity and ask them to freeze your account or place a hold on it while they investigate.
Your bank will likely issue you a new debit card and a new account number. The new account number will not match any of your automatic bill payments or direct deposits, so you will need to update those with your employer, your utility companies, and any services that withdraw money from your account. Your bank can usually provide a list of recent ACH transactions to help you identify which ones need to be updated.
File a dispute for each unauthorized transaction. Your bank will give you a dispute form or allow you to file online. Keep a copy of the dispute for your records. Federal law (Regulation E) limits your liability to $50 if you report within two business days of discovering the unauthorized activity. If you report after two business days but within 60 days, your liability can be up to $500. After 60 days, you may not be protected at all.
Protecting your account number going forward
Do not write your account number on checks unless absolutely necessary. Do not share it via email or text message. Do not read it aloud to someone who called you. If a company asks for your account number over the phone, ask them to mail you a form instead, or offer to call them back at a number you look up yourself.
When you pay bills online, use your bank's bill-pay service rather than giving your account number to individual companies. Your bank's bill-pay system generates a one-time payment authorization that is harder to intercept than your actual account number.
Use strong, unique passwords for your online banking account. Enable two-factor authentication if your bank offers it. This means that even if someone steals your password, they cannot log in without also having access to your phone or email.
Frequently Asked Questions
Can someone use my account number to make purchases online?
No. Online shopping requires a credit or debit card number, expiration date, and CVV code — not a bank account number. If a website asks for your bank account number to make a purchase, it is either a scam or a bill-pay service that will transfer money from your account after the purchase is confirmed.
What if someone has my account number and routing number but not my password?
They can attempt an ACH transfer or bill payment, but they cannot log into your online banking account or use an ATM. The transfer will be traceable to your account, and you can dispute it with your bank within 60 days.
Do I need to close my account if my account number was exposed in a data breach?
Not necessarily. Contact your bank and ask them to monitor your account. Many banks will issue a new account number and card as a precaution. Closing the account is an option if you are concerned, but it is not required unless unauthorized activity has already occurred.
How long does it take to get my money back after I report fraud?
Your bank must begin investigating within one business day of your report. They have up to 10 business days to complete the investigation and return your money if the charge was unauthorized. In practice, many banks return the money within two to three business days while the investigation continues.
Can I be held responsible for unauthorized ACH transfers if I did not authorize them?
Federal law limits your liability to $50 if you report within two business days, and up to $500 if you report within 60 days. After 60 days, you may have no protection. Report any suspicious activity as soon as you notice it.