Yes, someone can use your account and routing number to take money, but not in the way you might think
Your account number and routing number alone do not let someone log into your account or see your balance. But they are enough to set up an ACH transfer — an automated bank-to-bank payment — and pull money out without your permission. They can also use those numbers to set up recurring payments, like a subscription you never signed up for. The damage depends on whether your bank catches it, how fast you report it, and what protections your account has.
The real risk is not a hacker stealing your login credentials. It is someone you gave those numbers to — a landlord, employer, utility company, or online seller — using them for something you did not authorize. Or someone who found them on a check, a bill, or a piece of mail.
Key Takeaways
- Your account and routing number can be used to start an ACH transfer out of your account without your password or login.
- Fraudulent ACH transfers are often caught by your bank's fraud filter, but not always, and you have to report them within 60 days to get your money back.
- Legitimate businesses use ACH transfers all the time — payroll deposits, bill payments, rent transfers — so your bank cannot block every transfer from an unfamiliar sender.
- If you spot an unauthorized transfer, contact your bank immediately and file a dispute; waiting longer makes recovery harder.
- Protecting your numbers means not writing them on checks you mail, not sharing them with untrusted vendors, and checking your statements regularly.
How ACH transfers work and why your numbers are enough
An ACH transfer is a request sent through the automated clearing house network to move money between bank accounts. It does not require a password, a card number, or your permission — only your account number, routing number, and the name on the account. Your bank processes it based on those details matching.
This is by design. Employers use ACH to deposit paychecks. Utility companies use it to collect bills. Landlords use it to collect rent. The system assumes that if someone has your account details, they have a legitimate reason. Your bank's fraud detection looks for red flags — like a transfer to an account that has never received money from you before, or an amount that is wildly out of line with your normal activity — but it does not block every transfer from a new sender.
The catch: ACH transfers take one to three business days to clear. That window is your chance to spot the fraud and stop it before the money leaves your account.
What your bank will and will not do to protect you
Most banks have fraud filters that flag suspicious ACH transfers before they go through. A transfer to a brand-new account, or one that is much larger than your usual transactions, may be held for review. But your bank is not required to catch every fraudulent transfer, and many slip through.
If a transfer does go through and you did not authorize it, you have the right to dispute it — but only if you report it within 60 days of the transaction appearing on your statement. The bank will investigate and, if they find it was truly unauthorized, reverse the transfer and refund your money. This process usually takes 10 business days, though it can take longer if the receiving bank contests the claim.
If you wait longer than 60 days, your bank has no obligation to help you. You lose the money.
Common ways someone gets your account and routing number
Checks are the biggest source. Your account number and routing number are printed on every check you write. If you mail a check and it gets lost, or if you throw away a voided check without shredding it, someone can find those numbers. The same goes for bills you mail — many utilities print your account number on the statement.
Online transactions are another route. If you enter your account number to pay a bill or make a purchase on a website that is not secure, or if you use a vendor that gets hacked, your numbers can be stolen. Phishing emails that trick you into entering your banking details also work this way.
Personal connections matter too. If you give your account number to a landlord, employer, or contractor, and that person is dishonest or their computer is compromised, they can misuse it. Even a family member or roommate with access to your mail or statements could do it.
Steps to take if you spot an unauthorized transfer
Call your bank immediately — do not wait for a response to an email or online message. Tell them the transfer was not authorized and ask them to reverse it. Have your statement in front of you so you can give them the exact amount, date, and receiving account if you have it.
Your bank will put a hold on the transfer if it has not cleared yet, or start a dispute if it has. Ask them to send you a written confirmation of your dispute report. Keep that confirmation and any other documentation — screenshots of your statement, emails from the bank, anything that shows the timeline.
If the receiving bank is refusing to return the money, or if your bank is dragging its feet, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can push your bank to act faster and can penalize them if they violate the rules.
How to reduce the risk of unauthorized transfers
Stop writing checks if you can. If you must use checks, shred them after they clear — do not throw them in the trash. For bills, use your biller's online payment system or set up automatic transfers from your own account, rather than mailing a check with your account number on it.
When you have to give your account number to someone — a landlord, employer, or utility company — ask first whether they really need it. Many can take a payment through a credit card, debit card, or third-party payment app instead. If they insist on your account number, use a separate account if you have one, or monitor that account closely for unauthorized activity.
Check your bank statement every week, not just once a month. The sooner you spot a fraudulent transfer, the faster you can dispute it. Set up account alerts with your bank so you get a notification whenever a transfer over a certain amount goes out.
What to do if the same person keeps trying to take money
If you dispute a transfer and your bank reverses it, but the same sender tries again a few days later, contact your bank and ask them to block that account from sending you any more transfers. Most banks can set up a block so that ACH requests from a specific account are automatically rejected.
You can also file a police report if the amount is large enough or if the person is someone you know. This creates a paper trail and may help if the person tries the same thing with someone else. The police report also strengthens your case if your bank is slow to refund you.
If the transfers are coming from a business — a subscription service, online seller, or contractor — contact them directly and tell them to stop. Ask them in writing (email counts) to confirm they have canceled the authorization. Keep that confirmation.
Frequently Asked Questions
Can someone open a new bank account using just my account and routing number?
No. Opening an account requires an ID, a Social Security number, and usually an in-person visit or a video call. Your account and routing number alone are not enough. However, someone could use those numbers to impersonate you in other ways — like signing up for a utility account or a subscription service in your name.
If I give my account number to a business and they overcharge me, is that fraud?
Not necessarily. If you authorized the business to take money from your account, even if the amount was wrong, it is a billing dispute rather than fraud. You can still dispute it with your bank, but the process is different — your bank will contact the business to resolve it rather than automatically reversing it. Keep your receipt or confirmation email showing what you were supposed to be charged.
How long does it take to get my money back after I dispute an unauthorized transfer?
Your bank must investigate within 10 business days and tell you the result. If they find the transfer was unauthorized, they refund you immediately. If they need more time, they can take up to 45 days total, but they must give you a provisional refund within 10 days while they investigate. If the receiving bank contests the claim, the process can stretch to 90 days.
Should I close my account if someone has my account number?
Not necessarily. Closing the account does not erase the damage if fraudulent transfers have already gone through, and it can create problems with automatic deposits like payroll. Instead, monitor the account closely for the next few months and ask your bank to flag any unusual activity. If the fraud continues, then consider closing it and opening a new account.
Can I stop a transfer before it clears if I catch it in time?
Yes, if you call your bank before the transfer clears — usually within one business day of when it was initiated. Your bank can put a hold on it or reverse it before the money leaves your account. This is why checking your statement daily matters. Once the transfer clears and the money reaches the other bank, it is much harder to get back.