What a thief can actually do with your account number alone

A thief cannot withdraw money or make purchases using only your account number and routing number. Banks require additional verification — usually a PIN, password, or physical card — before releasing funds. However, your account number is still sensitive information, and there are real ways someone can misuse it.

The most common risk is ACH fraud, where someone sets up an unauthorized automatic transfer or bill payment from your account. This requires your account and routing number but not your password. The transfer can take a day or two to process, which gives you a window to stop it if you catch it early.

Another risk is that a thief uses your account number to open a fraudulent account in your name at a different bank, or to file a false tax return or unemployment claim using your information. These attacks usually combine your account number with other personal details like your Social Security number or name.

Key Takeaways

  • Your account number alone cannot be used to withdraw cash or swipe purchases, but it can be used to set up unauthorized ACH transfers or bill payments.
  • ACH fraud typically takes one to two business days to process, giving you time to contact your bank and stop the transfer if you notice it quickly.
  • If you discover unauthorized activity, call your bank's fraud line immediately — most banks have a 24-hour number on the back of your card.
  • Your bank is required to refund unauthorized ACH transfers if you report them within 60 days, though faster reporting increases your chances of stopping the transfer before it clears.
  • Protect your account number the same way you protect your Social Security number — do not share it with unsolicited callers or unfamiliar websites.

How ACH fraud works and why it is the main risk

ACH stands for Automated Clearing House, the system banks use to move money between accounts electronically. To set up an ACH transfer, a thief needs your account number and routing number — both of which appear on the bottom left of your checks. They do not need your password or PIN.

Once they have those numbers, they can pose as you and set up a transfer to their own account, or authorize a bill payment to a fake company they control. The transfer is submitted to the ACH network, which processes it overnight or over the next business day. By the time the money leaves your account, the thief may already have moved it elsewhere.

The lag between submission and clearing is your advantage. If you check your account daily or set up account alerts, you can spot the transfer before it completes and call your bank to reverse it. Most banks can stop an ACH transfer if you call before it clears, though some transfers cannot be recalled once they have left your bank.

What to do if you see unauthorized activity

Call your bank's fraud line immediately — do not wait. The phone number is on the back of your debit card or on your bank's website. Tell them the specific transaction, the amount, and when it posted or is scheduled to post. Ask them to reverse it and to place a fraud alert on your account.

Your bank is required by federal law to refund unauthorized ACH transfers if you report them within 60 days. However, the faster you report it, the better your chances of stopping the transfer before it clears. Some banks will reverse a transfer within hours; others may take a few business days.

After the transfer is reversed, ask your bank whether they will reissue your account number. Some banks do this automatically after fraud; others only do it if you request it. A new account number makes it harder for the thief to attempt another transfer, though it may take a few days for the new number to be active.

How to reduce the risk of ACH fraud

Do not share your account number with unsolicited callers, even if they claim to be from your bank. Real banks will never call you and ask for your account number — they already have it. If someone calls claiming to be from your bank, hang up and call the number on your card or statement instead.

Be cautious about where your account number appears. Checks are a common source of account number theft because they sit in mailboxes or are thrown away without shredding. If you do not use checks, ask your bank to stop sending them. If you do use them, shred them before throwing them away.

Set up account alerts through your bank's app or website. Most banks let you set a threshold — for example, alert me if any transaction over $100 posts to this account. Alerts are usually free and can help you spot fraud within hours instead of days.

Monitor your credit report for signs that someone has opened accounts in your name. You can get a free credit report once per year from each of the three major bureaus at annualcreditreport.com. If you see accounts you did not open, contact the bureau and the creditor to dispute them.

The difference between ACH fraud and debit card fraud

ACH fraud and debit card fraud are different crimes with different protections. ACH fraud uses your account number to pull money out of your account without your permission. Debit card fraud uses your card number to make purchases or withdrawals.

Debit card fraud is usually easier to spot because it shows up as a purchase or ATM withdrawal. ACH fraud can be harder to notice because it looks like a transfer or bill payment, which you might assume you authorized.

Federal law protects you differently depending on which type of fraud occurred. For debit card fraud, you have 60 days to report it, and your liability is capped at $50 if you report it within two business days. For ACH fraud, you also have 60 days to report it, and the bank must refund it, though your liability may be higher if you wait longer to report it.

What happens if someone uses your account number to open a new account

If a thief combines your account number with other personal information — your name, address, and Social Security number — they may try to open a bank account in your name at a different bank. This is identity theft, not just account number theft.

To prevent this, place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts. You can place a free fraud alert by calling any one of the three bureaus; they will notify the other two.

A fraud alert lasts one year and is free. If you believe your identity has been stolen, you can also place a credit freeze, which is stronger but requires you to unfreeze your credit temporarily whenever you want to open a new account yourself.

Frequently Asked Questions

Can someone use my account number to make online purchases?

Not directly. Online purchases require a debit or credit card number, not a bank account number. However, if a thief has your account number and other personal information, they might try to set up a debit card in your name or use your account number to authorize ACH payments to merchants.

What if the unauthorized transfer already cleared my account?

Call your bank's fraud line immediately. You have 60 days to report it, and your bank is required to refund unauthorized ACH transfers. The sooner you report it, the faster the refund process usually moves. Most refunds take three to five business days after the bank confirms the fraud.

Do I need to close my account if my account number was compromised?

Not necessarily. Closing the account does not erase the fraud that already occurred. Instead, ask your bank to issue a new account number and monitor your old account for 60 days to catch any unauthorized activity. If fraud continues after the new number is issued, then consider closing the old account.

Will my bank refund me if I authorized the transfer but did not read the fine print?

Probably not. Banks distinguish between unauthorized transfers (which they must refund) and transfers you authorized but later regretted. If you signed up for a service and authorized a payment, even if you did not read the terms carefully, the bank may not refund it. However, if you can show the company misrepresented the terms, you may have a case with your bank or a credit card company.

How long does it take for an ACH transfer to clear?

ACH transfers typically take one to two business days to clear. Weekends and holidays do not count as business days. If a transfer is submitted on a Friday, it may not clear until Tuesday. This delay gives you time to spot it and call your bank to stop it before the money leaves your account.