The short answer: someone with only your account number and routing number cannot withdraw money or make charges without additional information
A thief who has your account number and routing number alone cannot drain your account or make purchases. Banks use these numbers to receive deposits and process incoming transfers — not to pull money out. To withdraw funds or charge your account, a person needs either your debit card, online banking password, or authorization from you directly.
That said, having your account number creates real risks, just not the ones most people worry about. The actual danger is what someone can do once they have it: set up unauthorized transfers into accounts they control, create fraudulent checks, or use it as a starting point for identity theft.
Key Takeaways
- Your account number and routing number alone cannot be used to withdraw money, make purchases, or charge your account.
- Someone with your account number can set up incoming transfers to move money out of your account if they also have your online banking password or phone number.
- Fraudulent checks and ACH transfers are the most common ways account numbers are misused, not debit card fraud.
- If you suspect unauthorized activity, contact your bank immediately — federal law limits your liability if you report within 60 days of your statement.
What a thief can do with your account number
The most common misuse is setting up an ACH transfer (automated clearing house transfer) to move money from your account to one they control. This requires your account number and routing number, but also requires either access to your online banking login or a way to authorize the transfer through your bank directly.
Another risk is fraudulent checks. Someone with your account number can print checks against your account and cash them at retailers or deposit them elsewhere. The check will clear against your real account, and you will not see the charge until your statement arrives — sometimes weeks later.
A third route is using your account number as part of a larger identity theft scheme. Combined with your name, address, and Social Security number, it becomes easier for someone to open new accounts in your name or convince a bank representative to change your password over the phone.
Why your account number is safer than your debit card
Your debit card number is far more dangerous in a thief's hands. A debit card can be used immediately for online purchases, in-store transactions, and cash withdrawals at ATMs. Your account number cannot do any of those things on its own.
This is why banks print your account number on checks and statements — they expect it to be seen by other people. Landlords, employers, and utility companies all receive it routinely. The system assumes account numbers are semi-public information.
Your online banking password, by contrast, is what actually protects your account. If someone has your password, they can transfer money out, change your contact information, and lock you out of your own account.
How to reduce the risk if your account number is exposed
If your account number has been shared with someone you do not trust — or if you are not sure — contact your bank and ask them to flag your account for fraud monitoring. This does not cost anything and takes a few minutes on the phone.
You can also request that your bank require a verbal password or additional verification step before processing any ACH transfers or changes to your contact information. Some banks call this a "verbal password" or "security phrase." This makes it much harder for someone to move money out even if they have your account number and password.
Monitor your account regularly — weekly is reasonable if you are concerned. Most banks offer free online access and mobile apps that show transactions in real time. The faster you spot unauthorized activity, the faster you can stop it and recover funds.
What to do if you see unauthorized transactions
Contact your bank immediately by phone using the number on the back of your debit card or on your statement. Do not use a phone number from an email or text message, as those may be fraudulent.
Tell the bank the specific transactions that were not authorized. They will freeze your account, cancel your debit card, and begin an investigation. Federal law (Regulation E) limits your liability to $50 if you report within two business days, and to $500 if you report within 60 days of your statement.
Ask the bank to issue you a new account number if the fraud involved ACH transfers or checks. A new account number stops the thief from using the old one, even if they still have it written down. Your direct deposit and automatic payments will need to be updated with the new number.
The difference between account number fraud and identity theft
Account number fraud is limited — someone uses your existing account to move money out or create fraudulent checks. Identity theft is broader — someone uses your personal information to open new accounts, take out loans, or make purchases in your name.
If you see activity that looks like identity theft (new accounts you did not open, credit inquiries you did not authorize, bills for services you never signed up for), contact the Federal Trade Commission at IdentityTheft.gov. They will help you create a recovery plan and can place a fraud alert on your credit file.
For account number fraud alone, your bank is your first and main contact. For identity theft, you will need to work with the FTC, the credit bureaus, and potentially law enforcement.
Frequently Asked Questions
Can someone use my account number to make online purchases?
No. Online retailers need a debit or credit card number, expiration date, and CVV code — not a bank account number. If someone is making online purchases against your account, they have your debit card number or have set up an ACH transfer, not just your account number.
What if someone has my account number and my phone number?
This is more serious. If they call your bank and convince a representative that they are you, they may be able to authorize transfers or change your password. Call your bank proactively and set up a verbal password or security phrase that must be used for any phone-based requests.
Do I need to close my account if my account number is exposed?
Not necessarily. Closing the account is one option, but it is not required. You can instead request a new account number, set up fraud monitoring, and add a verbal password. Many people find this less disruptive than closing and reopening.
Is my account number visible to other people when I write a check?
Yes. Your account number and routing number are printed on every check. This is normal and expected — the system is designed with the assumption that these numbers will be seen by the people you pay.
How long does it take to get my money back after unauthorized transactions?
Your bank must begin investigating within one business day and complete it within 10 business days. They will usually return your money within 5 to 10 days if the fraud is clear. If the investigation takes longer, they must return a provisional credit within 10 days while they finish.