The short answer: not much without additional information
A thief with only your account number and routing number cannot withdraw money or make purchases on their own. Banks require additional verification — usually a signature, PIN, or online login credentials — before moving money out of your account. Your account number alone is not enough to drain your bank account or commit fraud in your name.
That said, your account number does carry real risk in specific situations. Someone who has it alongside other details — your name, address, or Social Security number — can set up unauthorized transfers, create fraudulent checks, or establish bill payments in your name. The risk depends on what else they know and what they do with it.
Key Takeaways
- Your account number by itself cannot be used to withdraw cash or make card purchases, because banks require additional proof of identity or authorization.
- A thief with your account number plus your name can set up ACH transfers to move money out, or write checks against your account without your permission.
- Fraudulent checks and unauthorized bill payments are the most common ways account numbers are misused, not online banking theft.
- If you suspect misuse, contact your bank immediately and request they freeze the account or flag it for fraud review.
- Federal law limits your liability for unauthorized transfers to $50 if you report within two business days, and $500 if you report within 60 days.
What a thief can do with your account number and name
If someone has your full name plus your account and routing numbers, they can initiate an ACH transfer — an electronic bank-to-bank transfer — to move money out of your account. They do not need your password or permission. They simply submit a transfer request to their own bank using your account details as the destination, then reverse it to pull money from your account instead. This is called a reverse ACH or unauthorized debit.
The same information allows someone to write fraudulent checks against your account. They print checks using your account number and routing number, then cash or deposit them. The checks will clear against your real account, and you will not know until your bank statement arrives or you check your balance online.
A thief can also set up bill payments in your name — paying their own utilities, phone bill, or other services using your account as the source. Some billers require only an account number and name to process a payment; they do not verify ownership.
Why online banking theft is less common with account numbers alone
Online banking requires login credentials — your username and password, or biometric authentication on mobile apps. Your account number is not a login credential. A thief cannot access your online banking portal with only your account number, which means they cannot see your balance, transfer money through your bank's website, or change your account settings.
This is why most account-number theft happens through paper checks or ACH transfers rather than through online banking. Those methods do not require a login. The thief does not need to break into your account; they just need to initiate a transaction using the information they have.
How to tell if someone is using your account number fraudulently
Check your bank statements regularly — at least weekly if you can. Look for withdrawals you did not authorize, especially small recurring charges that might be test transactions. ACH debits appear as "debit" or "withdrawal" on your statement and usually show the name of the business or person who initiated them.
Fraudulent checks may take longer to appear. If someone writes checks against your account, they might not clear for days or weeks. You may first notice the problem when your bank alerts you to overdraft fees or when you see the check image in your online banking portal.
Set up account alerts through your bank's website or app. Most banks let you receive notifications when a withdrawal over a certain amount occurs, when your balance drops below a threshold, or when a login happens from a new device. These alerts can catch fraud before significant damage occurs.
What to do if you discover unauthorized transactions
Contact your bank immediately — by phone, not email. Call the number on the back of your debit card or on your bank statement. Tell them you have discovered unauthorized transactions and ask them to freeze your account or flag it for fraud investigation. Do not wait for business hours if the fraud happened on a weekend; many banks have 24-hour fraud lines.
Request that your bank issue you a new account number and new debit card. They can usually do this the same day. Ask them to reverse the fraudulent transactions and restore your balance. Most banks will do this while they investigate, though they may place a temporary hold on your account.
Follow up in writing. Send a letter to your bank's fraud department describing each unauthorized transaction — the date, amount, and what it was for. Keep a copy for your records. Federal law requires banks to investigate and respond within a specific timeframe.
Your legal protection against unauthorized transfers
Regulation E, a federal rule, limits your liability for unauthorized electronic transfers. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. If you wait longer than 60 days, you may be liable for the full amount.
"Business days" means Monday through Friday, excluding federal holidays. If you discover fraud on a Friday evening, you have until Monday to report it and stay within the two-day window. Many banks have fraud hotlines that operate 24 hours, so you can report even outside normal business hours.
This protection applies to ACH transfers and other electronic debits. Fraudulent checks are handled differently — they fall under different banking rules, and your bank may have different timelines for investigation and reversal.
How to reduce the risk of account-number theft
Do not share your account number with anyone unless you initiated the contact and you trust the recipient. Legitimate businesses you already work with — your employer for direct deposit, your insurance company, your utility — may need it, and that is normal. Unsolicited requests for your account number should raise suspicion.
Be cautious with paper checks. If you write checks regularly, store them securely and do not leave them in your mailbox. If you receive a check from someone else, deposit it promptly rather than leaving it lying around. Stolen checks can be altered or deposited into a fraudster's account.
Monitor your mail. Thieves sometimes intercept bank statements or new debit cards in the mail. If you expect a statement or card and do not receive it, contact your bank. Consider switching to paperless statements if you do not need physical copies.
Use strong passwords for your online banking account and enable multi-factor authentication if your bank offers it. While this does not protect your account number, it protects your login, which is the real gateway to your money.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a bank account requires identity verification — a government ID, Social Security number, and proof of address. Your account number alone cannot be used to open an account in your name. However, if a thief has your Social Security number and other personal information, they could attempt to open an account fraudulently, which is identity theft rather than account-number theft.
What if I gave my account number to a scammer?
Contact your bank immediately and describe what happened — when you gave the number, who you gave it to, and what they said they would do with it. Your bank can monitor your account for suspicious activity and may issue you a new account number as a precaution. The sooner you report, the sooner they can watch for fraud.
Does my bank have to refund fraudulent ACH transfers?
Yes, if you report within 60 days. Your bank is required to investigate and reverse unauthorized ACH debits under Regulation E. However, if you delay reporting beyond 60 days, the bank may deny your claim. Report as soon as you notice the fraud.
Can I be held responsible for fraudulent checks written against my account?
Your liability depends on how quickly you report. If you discover fraudulent checks and report them to your bank within a reasonable time — typically 30 days — the bank will reverse them and restore your balance. If you wait much longer, the bank may argue you were negligent in monitoring your account, though they still have an obligation to investigate.
Should I close my account if my account number was compromised?
Not necessarily. If you caught the compromise early and no fraud has occurred, your bank can issue you a new account number and monitor the old one. If fraud has already happened, ask your bank whether closing the account or keeping it open (with a new number) is better for the investigation. Your bank can advise based on the specific situation.