Yes, someone can use your account and routing number to take money, but not in the way most people fear
Your account number and routing number alone do not let someone log into your account or move money without your bank's involvement. But they are enough to set up an ACH transfer — an automated bank-to-bank payment — and pull money out. This is the real risk. A person with these two pieces of information can instruct their bank to withdraw funds from your account, and your bank will process it unless you stop it first.
The second risk is smaller but real: someone can deposit money into your account using your routing and account number. This sounds harmless until you realize they might be depositing stolen funds, counterfeit checks, or money from fraud — which means your bank can freeze your account while it investigates, and you could be held responsible for the deposit.
The third risk is that they can use these numbers to open accounts in your name at other banks, though this usually requires additional identity information.
Key Takeaways
- Your routing and account number are enough for someone to set up an ACH withdrawal from your account without your permission.
- Your bank will process ACH transfers unless you have filed a stop-payment order or fraud claim beforehand.
- Someone depositing stolen or fraudulent money into your account can cause your bank to freeze it while investigating.
- Sharing these numbers with legitimate businesses (payroll, bill pay, direct deposit) is safe because they are required to use them only for the stated purpose.
- If unauthorized transfers happen, contact your bank immediately and file a dispute within 60 days to recover the money under federal law.
How ACH transfers work and why your numbers are enough
An ACH transfer is a request from one bank to another to move money. It does not require a password, a card, or your permission — only your routing number and account number. When someone has these, they can go to their own bank or use an online payment service and instruct it to pull money from your account.
Your bank does not verify that the person requesting the transfer is you. It verifies only that the routing number and account number are real and that the account has funds. If both are true, the transfer goes through. This is by design — ACH is meant to be fast and low-friction for legitimate uses like payroll and bill payments.
The protection comes after the fact. If you notice the transfer and report it as unauthorized, your bank has a window to reverse it and investigate. But you have to catch it and report it quickly.
When it is safe to share your routing and account number
Sharing these numbers with your employer for direct deposit is safe. Your employer is required by law to use them only to deposit your paycheck, and doing so is their legal obligation. The same is true for government agencies sending you tax refunds, stimulus payments, or benefit deposits.
Sharing them with your utility company, insurance company, or mortgage lender for automatic bill payments is also standard and safe. These organizations are bound by contract to use the numbers only for the payments you have authorized.
The risk rises when you share them with someone you do not know or trust, or with a business you cannot verify. If you are unsure whether a request is legitimate, call the organization directly using a phone number from their official website — not a number from the email or letter asking for the information.
What to do if someone makes an unauthorized transfer
Contact your bank immediately by phone. Do not wait for a statement or a letter. Tell them the transfer was not authorized and ask them to reverse it. Write down the date and time of your call, the name of the person you spoke to, and what they told you.
Follow up with a written dispute. Most banks require you to file a formal dispute in writing within 60 days of the unauthorized transfer. Send a letter or use your bank's online dispute tool. Include the date of the transfer, the amount, and a clear statement that you did not authorize it.
Under federal law, your bank must investigate and either reverse the transfer or explain why it was authorized. If the transfer was truly unauthorized, you are protected from liability — your bank absorbs the loss, not you. But you have to report it within 60 days. After that window closes, your protection is weaker.
If your bank refuses to reverse it or takes too long, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. Include copies of your dispute letter and any responses from the bank.
How to reduce the risk of unauthorized transfers
Do not share your routing and account number in emails, texts, or over the phone unless you initiated the contact. Legitimate organizations will not ask for these numbers this way.
If you are concerned about a specific account, ask your bank whether it offers ACH debit blocks. This is a service that prevents ACH withdrawals from your account entirely. Some banks offer it for free; others charge a small monthly fee. It stops all ACH debits, including legitimate ones, so you would need to remove the block if you want to set up payroll direct deposit or bill pay.
Monitor your account regularly — weekly if possible. Set up account alerts through your bank's app so you are notified of any withdrawal over a certain amount. The faster you spot an unauthorized transfer, the faster you can report it and the more likely you are to recover the money.
If you have been the victim of identity theft or fraud, consider placing a fraud alert or credit freeze with the credit bureaus. This does not protect your bank account directly, but it makes it harder for someone to open new accounts in your name.
The difference between ACH debits and other payment methods
Someone with your routing and account number cannot use a credit or debit card, write a check in your name, or log into your online banking. Those require additional security — a PIN, a signature, or login credentials. ACH is different because it is designed for recurring, trusted payments.
Wire transfers also require more information and verification than ACH. A wire transfer typically requires you to provide the recipient's full name, address, and sometimes additional details. Someone cannot wire money out of your account with just your routing and account number.
Checks are safer in the sense that someone cannot cash a check with just your routing and account number — they need a physical check with your signature. But if someone has your account information and a blank check, they can write one and forge your signature, which is why you should keep blank checks secure and monitor your account for unauthorized check activity.
What happens if someone deposits money into your account
If someone deposits stolen funds, counterfeit checks, or money from fraud into your account using your routing and account number, your bank can freeze the account while it investigates. You will not be able to withdraw the money, and you may not be able to use the account for other transactions.
Once the bank determines the deposit was fraudulent, it will reverse it. If you have already spent money from that deposit, you could be held responsible for repaying it. This is rare but possible, especially if the fraud is discovered weeks or months later.
To reduce this risk, be cautious about who you give your account number to. If someone you do not know well offers to send you money via bank transfer, ask them to use a payment app like Venmo or PayPal instead, which offer more fraud protection.
Frequently Asked Questions
Can someone open a bank account in my name with just my routing and account number?
No. Opening an account requires additional identity information — a Social Security number, date of birth, address, and usually a government ID. Your routing and account number alone are not enough. However, if someone has your full identity information, they can open accounts in your name, which is a form of identity theft.
Do I need to worry about sharing my account number for direct deposit?
No. Direct deposit is a safe, standard practice. Your employer is legally required to use your routing and account number only to deposit your paycheck. Millions of people use direct deposit without problems.
What if I gave my account number to someone and now I am worried?
Monitor your account closely for the next few weeks. Set up alerts for any withdrawal. If you see an unauthorized transfer, report it to your bank immediately. If nothing happens after 30 days, the risk has likely passed. You can also ask your bank about placing an ACH debit block on the account if you are very concerned.
How long does it take to reverse an unauthorized ACH transfer?
Your bank must investigate within 10 business days and either reverse the transfer or explain why it was authorized. In practice, reversals often happen within a few days if the transfer is clearly unauthorized. The full investigation can take up to 45 days, but your bank should credit your account provisionally while it investigates.
Can I sue someone who made an unauthorized transfer from my account?
Yes, but your first step should be to report it to your bank and file a dispute. If your bank does not reverse it, you can pursue a civil lawsuit. You can also report the person to local police or the FBI if the amount is large or if it is part of a larger fraud scheme.