Yes, someone can use your checking account number to take money, but only under specific conditions

Your checking account number alone — the one printed on your checks — is not enough for someone to drain your account through an ATM or online transfer. But it is enough for them to set up an automatic debit from your account if they also have your routing number, which is also printed on every check. They can also use it to attempt ACH transfers, wire money out, or set up recurring payments to themselves. The risk is real, but it is not the same as handing over your debit card or PIN.

The key difference: your account number lets someone pull money from your account through the banking system, but not push it out through an ATM or card reader. That requires your debit card or online banking password. What matters most is how quickly you notice and report it.

Key Takeaways

  • Someone with your account and routing number can set up automatic debits or ACH transfers without your permission, but these often take days to process and show up on your statement.
  • Your bank is required to reverse unauthorized ACH debits and transfers if you report them within a specific window — usually 60 days for ACH, though some banks honor claims longer.
  • Checks themselves are lower risk than digital transfers because they require a physical signature and take days to clear, giving you time to spot them.
  • Monitoring your account weekly or setting up low-balance alerts catches most unauthorized activity before significant money leaves.
  • Reporting fraud to your bank in writing creates a paper trail and starts the clock on your bank's obligation to investigate and refund you.

How someone uses your account number to pull money

An ACH transfer (Automated Clearing House) is the most common way someone misuses a checking account number. ACH is the system banks use to move money between accounts — it is how payroll deposits work, how you pay bills online, and how automatic payments are set up. If someone has your account number and routing number, they can initiate an ACH debit that pulls money from your account into theirs. Your bank does not verify the person's identity before the transfer goes through; it only checks that the account number and routing number are valid.

A check fraud scenario works differently. If someone has a blank check or steals one from your checkbook, they can write themselves a check and deposit it. This requires a forged signature, which is a separate crime, but it does happen. The check takes 1 to 3 business days to clear, which gives you time to notice it on your statement and report it before the money is gone for good.

Wire transfers and bill-pay setups are also possible if someone has your account number and gains access to your online banking, but that requires your password or login credentials — the account number alone is not enough.

Your bank's responsibility to reverse unauthorized transfers

Federal law requires your bank to reverse unauthorized ACH debits if you report them within 60 days of the transaction appearing on your statement. This is the Electronic Funds Transfer Act (EFTA). The bank must investigate your claim and refund the money while the investigation is ongoing — you do not have to wait for them to finish before the money goes back into your account.

In practice, many banks honor claims beyond 60 days, especially if you report promptly and the fraud is clear. But 60 days is the legal floor, not the ceiling. Do not assume you have months; report it as soon as you see it.

For checks, the window is longer. You have up to one year to report a forged check, though banks often resolve these faster because the forgery is usually obvious. If someone forged your signature on a check, your bank is liable for the loss unless you were negligent in protecting your checkbook.

What puts your account number at risk

Checks are the most common source of exposure. Every check you write leaves your account number and routing number visible to the recipient. If you mail a check and it is stolen from a mailbox, or if you hand a check to someone you do not fully trust, your account number is now in their hands. Online bill-pay services, merchants who process checks, and even your employer's payroll department have your account number on file.

Data breaches at retailers, healthcare providers, and financial institutions can expose your account number along with other personal information. If you have ever provided a check as payment for something, that business has your number. If they are hacked, your number is compromised.

Phishing emails and fake websites that ask you to "verify" your banking information are another vector. If you enter your account number on a fraudulent site, you have handed it to a criminal directly.

Steps to take if you spot unauthorized activity

First, contact your bank immediately — by phone, in person, or through their secure online message system. Do not use a phone number from an email or text; look up the number on your bank's official website or the back of your debit card. Tell them you see an unauthorized transaction and want to report it. They will freeze the transaction if it has not cleared yet, or begin an investigation if it has.

Second, follow up in writing. Send a letter to your bank's fraud department (the address is usually on your statement or website) stating the date of the unauthorized transaction, the amount, and the date you reported it by phone. Keep a copy. This creates a dated record that starts the 60-day clock for ACH disputes and protects you if the bank later claims they never heard from you.

Third, monitor your account daily for the next 30 days. Fraudsters often test a stolen account number with a small transaction first. If that clears, they attempt a larger one. Catching the first one fast can prevent the second.

If the unauthorized transaction is still pending (not yet cleared), your bank can stop it outright. If it has already cleared, the bank will reverse it and credit your account while they investigate. You should see the refund within 10 business days in most cases.

How to reduce the risk going forward

Stop mailing checks whenever possible. Use online bill-pay through your bank, credit card payments, or digital payment apps. If you must mail a check, use a secure mailbox or mail it directly at the post office rather than leaving it in your home mailbox for pickup.

Do not write checks to cash or to "bearer" — these are high-risk because anyone who finds them can cash them. If someone asks you to pay by check to cash, that is often a sign of a scam.

Set up low-balance alerts through your bank's app or website. If your account drops below a threshold you set, you get a text or email. This catches large unauthorized transfers within hours rather than days.

Request a new debit card and new checks if you suspect your account number has been compromised, even if you have not seen fraudulent activity yet. Your bank can issue these at no cost. A new account number is the only way to fully stop someone who has your old number.

Review your statements weekly, not monthly. The sooner you spot fraud, the faster your bank can reverse it and the less likely a second fraudster will attempt to use the same account number.

Frequently Asked Questions

Can someone use just my account number without the routing number?

Not effectively. An ACH transfer requires both the account number and routing number to work. However, if someone has your full name and account number, they may be able to look up your routing number using your bank's name, since routing numbers are public information tied to specific banks and branches.

What if I gave my account number to a business and they charged me without permission?

Report it to your bank as an unauthorized ACH debit. If you gave the business permission to charge you once but they charged you repeatedly, that is still unauthorized after the first charge. Your bank will investigate and reverse the extra charges. You may also need to contact the business directly to cancel any standing authorization.

How long does it take to get my money back after I report fraud?

Your bank must credit your account within 10 business days for ACH disputes, though many do it faster — sometimes within 2 to 3 days. The investigation itself can take up to 45 days, but you get your money back immediately while they investigate. For forged checks, it depends on the bank, but most resolve these within 5 to 10 business days.

Should I close my account if someone has my account number?

Not necessarily. Closing the account stops future fraud, but it does not erase your liability for past unauthorized transactions — your bank still has to reverse them. If you want a fresh start, ask your bank to issue a new account number and new checks. Some banks can do this without closing the old account, which is cleaner than starting over completely.

Can I be held responsible if someone uses my account number?

No, not for unauthorized ACH transfers or forged checks. Federal law protects you as long as you report the fraud within the required timeframe and did not act negligently — for example, by writing your PIN on a check or leaving blank checks lying around. Your bank bears the loss, not you.