What a person can actually do with your account number alone
Someone who has only your account number and routing number cannot withdraw money directly from your account. They cannot walk into a bank, use an ATM, or access online banking. A checking account number by itself does not give anyone the power to move your money without your permission.
What they can do is set up automatic payments or transfers to that account, or initiate ACH transfers from it if they also have your name and permission. The distinction matters: your account number is useful for receiving money or for authorizing outgoing payments, but it is not a key to your account the way a debit card or online login would be.
The real risk is not theft but fraud — someone using your account number to pull money out without your knowledge. That is possible, but it requires more than just the number, and the law protects you if it happens.
Key Takeaways
- Your account number alone cannot be used to withdraw cash or access your account online, because banks require additional verification like a PIN, password, or debit card.
- Someone with your account number can set up direct deposits to your account or request ACH transfers from it if they claim authorization, which is why you should limit who you give it to.
- Unauthorized ACH withdrawals are possible but require the person to initiate a transfer in your name, and federal law requires your bank to refund fraudulent transfers within specific timeframes.
- If you suspect unauthorized activity, contact your bank immediately and file a dispute; the sooner you report it, the stronger your protection.
How ACH transfers work and why your account number matters
An ACH transfer is an electronic movement of money between bank accounts. It runs through the Automated Clearing House network, which is how employers deposit paychecks and how you pay bills online. To initiate an ACH transfer, someone needs your account number, routing number, and your name — but they do not need your permission in the moment, and that is the vulnerability.
When you authorize a company to withdraw money (like a utility bill or gym membership), you give them permission once, and they can pull money repeatedly. If someone fraudulently sets up an ACH withdrawal from your account, they are essentially claiming you authorized them. Your bank processes it because the account number and routing number are correct, and the bank has no way to know the authorization was fake.
This is different from a debit card transaction, where the card itself proves you initiated it. With ACH, the bank relies on the account holder to notice and report fraud.
What federal law says about unauthorized transfers
The Electronic Funds Transfer Act (EFTA) protects you if someone makes an unauthorized ACH withdrawal from your account. Your bank must refund the money, but the timeline depends on how quickly you report it.
If you report the fraud within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report it within 60 days, your liability can go up to $500. If you do not report it within 60 days of your statement, you may lose all protection — your bank is not required to refund anything after that window closes.
The bank itself must investigate and either refund you or explain why the transfer was authorized. Most banks refund first and investigate later, because the law requires them to act quickly.
Steps to take if you see unauthorized activity
Call your bank's fraud line immediately. Do not wait for a statement or for the transaction to "clear." The sooner you report, the sooner the clock starts on your protection. Have your account number and a description of the unauthorized transfer ready.
Your bank will likely freeze the account or flag it for monitoring. They will ask you to confirm which transactions are yours and which are not. Be specific: give dates, amounts, and the names of any companies or people you did not authorize.
Request that your bank issue you a new debit card and a new account number if the fraud was significant or if you are worried about future unauthorized transfers. Some banks do this automatically; others require you to ask.
File a report with the Consumer Financial Protection Bureau (CFPB) if your bank refuses to refund you or if the dispute process stalls. The CFPB tracks complaints and can pressure banks to comply with the law.
How to reduce the risk of unauthorized transfers
Limit who you give your account number to. You need to share it with your employer (for direct deposit), your bank (for online transfers), and any company you authorize to pull money regularly. Beyond that, keep it private. Do not share it via email, text, or phone unless you initiated the contact and you are certain you are talking to your bank.
Review your bank statements monthly, even if you use online banking. Set up account alerts if your bank offers them — many will notify you by text or email when a transfer over a certain amount is initiated. This gives you a chance to dispute it before it fully clears.
If you suspect someone has your account number, contact your bank and ask them to monitor for unusual activity. You can also place a fraud alert with the credit bureaus (Equifax, Experian, TransUnion), which makes it harder for someone to open new accounts in your name, though it does not protect your existing checking account.
The difference between account number sharing and identity theft
Sharing your account number is not the same as identity theft. Identity theft means someone is using your name, Social Security number, or other personal information to open new accounts or commit fraud in your name. Unauthorized ACH transfers are a specific type of fraud that uses your account number but does not necessarily involve identity theft.
However, if someone has your account number, they may also have other information about you. If you discover unauthorized transfers, consider placing a credit freeze with the three major credit bureaus as an extra precaution. A credit freeze prevents anyone from opening new accounts in your name without your permission.
What happens if you authorize someone and then change your mind
If you gave someone permission to withdraw money from your account (a roommate, family member, or contractor) and now want to stop it, you have options. Contact your bank and revoke the authorization. The bank will stop processing transfers from that person or company.
If a transfer has already been initiated but has not cleared yet, your bank may be able to stop it. If it has already cleared, you can dispute it as unauthorized, but the bank may ask you to prove you did not authorize it. This is harder to prove if you previously gave permission, so be clear with your bank about the timeline: "I authorized transfers until [date], but I revoked authorization on [date], and this transfer came after."
Frequently Asked Questions
Can someone use my account number to make a purchase online?
Not directly. Online purchases require a debit card number, expiration date, and CVV, or a credit card. Your checking account number alone is not enough. However, some online retailers allow you to pay by entering your account number and routing number (similar to writing a check), and if someone has both, they could attempt a purchase. Dispute it immediately if you see it on your statement.
What if someone uses my account number to set up a fake direct deposit?
Direct deposits are deposits into your account, not withdrawals from it. If someone sets up a direct deposit to your account by mistake or fraud, the money goes into your account, which is actually in your favor. You can contact the employer or payer to correct the routing or account number, but you are not liable for money that lands in your account.
Do I need to close my account if someone has my account number?
Not necessarily. Closing the account is an option if you are very worried, but it is not required by law and it can be inconvenient. Instead, monitor your account closely, set up alerts, and revoke any authorizations you did not make. If unauthorized transfers continue after you report them, then closing and opening a new account makes sense.
How long does it take to get a refund for an unauthorized ACH transfer?
Banks must refund you within one to three business days if you report within two business days. If you report later, the investigation can take up to 45 days, though most banks refund sooner. Ask your bank for a specific timeline when you report the fraud.
Can I be held responsible for someone else's unauthorized transfer from my account?
Only if you do not report it within 60 days of your statement. If you report within that window, your liability is capped at $50 (if you report within two days) or $500 (if you report later). After 60 days, you may lose all protection, so check your statements regularly.