Yes, someone can use your account number to take money, but not in the way you might think
A bank account number alone—without your routing number—is not enough to drain your account. But it is enough for someone to set up an automatic payment from your account, which is how most account-number theft actually happens. They cannot log into your online banking or transfer money themselves. What they can do is pose as you to your bank, set up a bill payment or ACH transfer to an account they control, and pull money out that way. The damage depends on how quickly you notice and report it.
The real risk is not a stranger randomly using your number. It is someone who has your number plus your name, and who knows enough about you to answer security questions or convince a bank employee they are you. That is why account number theft usually follows a data breach, a phishing email, or a relationship where someone already has access to your personal information.
Key Takeaways
- Someone with only your account number cannot log into your account or make online transfers, but they can set up automatic payments to pull money out.
- Account number theft usually requires your name and enough personal details to pass as you to your bank or to a merchant.
- ACH fraud and unauthorized bill payments are the most common ways stolen account numbers are used.
- Reporting unauthorized transactions within 60 days of your statement date protects you under federal law, though faster reporting gives you more protection.
- Freezing your account or switching to a new number stops ongoing fraud faster than waiting for your bank to investigate.
How someone actually uses a stolen account number
The most common route is an ACH transfer—an automated clearing house payment that moves money between bank accounts. Someone with your account number can initiate an ACH pull from your account to theirs, and many banks will process it without calling you first. They do not need your password or online access. They just need your account number, routing number, and name.
The second route is setting up a bill payment through a merchant or biller. If they know your account number and can convince a utility company, credit card company, or other vendor that they are you, they can authorize a payment from your account to pay down a debt you do not owe or redirect a payment you were already making. Some billers ask only for an account number and a phone number to set this up.
A third, less common route is check fraud. If someone has your account number and routing number, they can print counterfeit checks or order checks in your name and write them from your account. This takes longer to discover but can drain your account over weeks.
What your bank account number alone cannot do
Your account number by itself does not let someone log into your online banking portal. They would need your username and password, or access to your email or phone number to reset them. It does not let them make a wire transfer or Zelle payment using your bank's app—those require authentication you control.
Your account number is also not enough to open a new account in your name, take out a loan, or apply for credit. Those require additional identity verification, a Social Security number, and usually a hard pull on your credit report. Account number theft is not the same as identity theft, though the two often happen together.
Signs that your account number has been misused
Check your bank statements weekly, not monthly. Look for small ACH debits you do not recognize—fraudsters sometimes test with a small amount first ($1 to $5) before pulling larger sums. Look for bill payments you did not authorize, especially to utility companies or online payment processors. Look for checks you did not write.
Set up account alerts through your bank's website or app. Most banks let you flag transactions over a certain amount, or alert you to any ACH transfer out of your account. Some let you block ACH pulls entirely until you turn them back on. These are free and take two minutes to set up.
If you see something wrong, call your bank immediately—do not email or use the app. Verbal reporting creates a record and starts the clock on your fraud protection window. Write down the date, time, and name of the person you spoke to.
How to stop ongoing fraud if your account number is compromised
The fastest way to stop money from leaving your account is to freeze or close the account. Your bank can do this in minutes. Any pending ACH transfers or bill payments will bounce. You will need a new account number and new debit card, which takes three to five business days to arrive, but your old account stops bleeding money immediately.
If you want to keep the account open, ask your bank to block all ACH debits or require authorization for each ACH transaction. This stops automatic pulls but lets you still receive direct deposits and make payments you initiate. Some banks call this "ACH block" or "debit block."
You can also file a fraud dispute for each unauthorized transaction. Your bank has to investigate within 10 business days and give you a provisional credit within three business days while they look into it. If they confirm fraud, the credit becomes permanent. Keep records of every transaction you dispute.
Your legal protection if someone uses your account number
Federal law (Regulation E) protects you if you report unauthorized ACH transfers or bill payments. If you report within 60 days of your statement date, your bank must refund the money. If you report after 60 days, you may not get your money back—the bank can refuse the claim.
The faster you report, the better your position. If you report within two business days, your liability is capped at $50. If you report after two business days but within 60 days, your liability is capped at $500. After 60 days, you have no protection under federal law, though some banks may still help you.
Report fraud in writing as well as by phone. Send a letter to your bank's fraud department with the date, amount, and description of each unauthorized transaction. Keep a copy. This creates a paper trail and protects you if the bank later claims they did not know about the fraud.
How to prevent account number theft in the first place
Do not give your account number to anyone who calls you, even if they claim to be from your bank. Your bank already has your account number. If they need to verify something, hang up, call the number on the back of your debit card, and ask to speak to the same department.
Do not write your account number on checks you mail. Postal theft is real. Do not put it in emails or texts. Do not share it on public Wi-Fi or unsecured websites.
When you give your account number to a merchant or biller, ask what they do to protect it. Ask whether they store it or delete it after the transaction. Ask whether they use encryption. If they cannot answer, consider paying by credit card instead—credit card fraud has stronger protections than ACH fraud.
Use your bank's bill pay feature instead of giving your account number to individual companies. Your bank handles the ACH transfer on your behalf, and the merchant never sees your account number. This is free and takes one extra step.
What to do if your account number was part of a data breach
If you learn your account number was exposed in a breach—through a notice from your bank, a news report, or a breach notification site—do not wait for fraud to happen. Contact your bank and ask them to issue you a new account number and debit card. This is free and takes a few days.
Ask your bank whether they will monitor your account for suspicious activity at no charge. Many banks offer free fraud monitoring for a period after a breach. Take them up on it.
Check your credit report at annualcreditreport.com (the only free, official site) to see whether anyone has tried to open accounts in your name. You can also place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion), which tells lenders to verify your identity before opening new accounts. A fraud alert is free and lasts one year.
Frequently Asked Questions
Can someone use my account number to get a loan or open a credit card?
No. A bank account number is not enough to open credit. Lenders need your Social Security number, date of birth, and a hard pull on your credit report. Account number theft and identity theft are different things, though they can happen together. If someone has your Social Security number and other personal details, that is a bigger problem than account number theft alone.
What if I gave my account number to a website and now I'm worried?
If the website was legitimate and encrypted (look for "https://" and a lock icon), the risk is low. If you are still worried, contact your bank and ask for a new account number. It is free and takes a few days. Monitor your statements for the next 60 days for any unauthorized transactions. Most fraud shows up within two weeks.
Do I have to pay back money that was stolen from my account?
No, if you report it within 60 days of your statement date. Your bank must refund unauthorized ACH transfers and bill payments under federal law. If you report after 60 days, the bank can refuse, but many will still help if you can show you were not negligent. Report fraud in writing and by phone to protect yourself.
Can my bank refuse to refund me if I was careless with my account number?
Only if you were extremely careless—like writing your account number on a check and mailing it, or giving it to someone you knew was untrustworthy. Simply having your account number stolen in a data breach or phishing attack is not your fault. The bank's job is to verify transactions, and if they processed an unauthorized one, they are liable.
Should I close my bank account if my account number was stolen?
Not necessarily. If fraud has already happened, closing the account stops it immediately. If you are just worried it might happen, ask your bank to block ACH debits or require authorization for each one. This gives you protection without the inconvenience of a new account number. If fraud does happen, you can close the account then.