Your account number alone is not enough to drain your account, but it is sensitive in specific ways
A bank account number by itself cannot be used to withdraw money or transfer funds. Your bank needs both your account number and your routing number to move money, and even then, most transfers require additional verification—a password, a PIN, or a confirmation code sent to your phone. However, your account number is still sensitive because it can be combined with other information to create problems: fraudsters can use it with a fake routing number to set up unauthorized ACH transfers, or they can use it to impersonate you when calling your bank.
The risk depends on who has the number and what else they know about you. Giving your account number to your employer's payroll department or to a business you are paying is normal and safe. Posting it publicly online or giving it to someone who contacted you unsolicited is not.
Key Takeaways
- Your account number alone cannot be used to withdraw money, but it can be used with a fake routing number to set up unauthorized ACH transfers.
- Businesses you pay intentionally—utilities, insurance, loan servicers—need your account number and it is safe to give it to them.
- If someone calls you claiming to be from your bank and asks for your account number, hang up and call your bank directly using the number on your card or statement.
- If your account number is exposed in a data breach, contact your bank to monitor for fraud and ask about changing your account number if you are concerned.
- Your routing number and account number together are more sensitive than either one alone, so do not share both with someone you do not trust.
When it is safe to share your account number
You should give your account number to any business where you are the one initiating the transaction. This includes your employer (for direct deposit), your landlord (for rent payment), utility companies, insurance companies, loan servicers, and any merchant you are paying by ACH transfer. These organizations have a business reason to have it and are regulated or have reputational incentive not to misuse it.
You should also expect to provide your account number when you open a new account at the same bank or when you set up bill pay through your bank's website. In these cases, you are communicating directly with your bank through a secure channel.
When your account number is a red flag
Do not give your account number to someone who contacted you first, especially if they claim to be from your bank, the IRS, or a government agency. Real banks and government offices do not call you asking for account numbers. If someone calls claiming to be from your bank, hang up, wait a few minutes, and call the number on the back of your card or on your most recent statement.
Do not post your account number on social media, in public forums, or in emails. Do not include it in text messages unless you initiated the conversation with a business you trust. Do not give it to someone who says they need it to "verify" your identity—legitimate verification usually works the other way around, with the business proving who they are to you.
What happens if your account number is exposed
If your account number is leaked in a data breach or you suspect someone has it who should not, contact your bank immediately. Tell them you believe your account number has been compromised. Your bank can monitor your account for suspicious activity and may be able to change your account number, though this is not always automatic and may take a few business days.
While your bank is investigating, watch your account for unauthorized ACH transfers or withdrawals. Most banks offer fraud protection that limits your liability if unauthorized transfers occur, but you need to report them within a specific window—usually 30 to 60 days. Check your statements weekly or set up account alerts through your bank's app so you catch problems quickly.
The difference between your account number and your routing number
Your account number identifies your specific account at your bank. Your routing number identifies the bank itself. Together, they form the pair needed to send or receive ACH transfers. Separately, they are less useful to a fraudster, but not useless—someone with your account number and a fake routing number can attempt to set up transfers, and someone with your routing number can try to guess account numbers.
For this reason, you should avoid sharing both numbers with the same person unless you have a clear reason to trust them. If you are paying a bill by check, the routing and account numbers are printed on it, so anyone who handles the check can see both. This is why checks are considered less secure than other payment methods for large amounts.
How fraudsters use account numbers
The most common fraud involving account numbers is unauthorized ACH transfer setup. A fraudster obtains your account number (often from a data breach) and creates a fake routing number or uses a real routing number from a different bank. They then attempt to set up a transfer out of your account. Many of these attempts fail because the fraudster does not have your password or the correct routing number, but some succeed if the bank's verification process is weak.
Another method is social engineering: a fraudster calls your bank pretending to be you, provides your account number and other personal details (name, address, date of birth), and convinces the bank representative to change your password or add a new authorized user. This is why your bank should never ask you for your account number when you call them—they should already know it from your phone number or other verification.
Protecting your account number going forward
Treat your account number the way you treat your Social Security number: share it only when necessary and only with organizations you initiated contact with. Do not write it down and leave it visible. Do not use the same password for your bank account as you use for other websites. Enable two-factor authentication on your bank account if your bank offers it—this means even if someone has your password, they cannot log in without a code sent to your phone.
If you receive mail from your bank, shred statements before throwing them away. If you move, file a change of address with the post office so old statements do not end up in someone else's mailbox. Set up account alerts through your bank's app to notify you of large transfers, new payees, or login attempts from unfamiliar devices.
Frequently Asked Questions
Can someone steal money from my account if they only have my account number?
Not directly. They would also need your routing number and would likely need to pass additional verification steps. However, having your account number makes it easier for them to attempt fraud, so you should still treat it as sensitive and report it if you believe it has been compromised.
Is it safe to give my account number to my employer for direct deposit?
Yes. Your employer needs your account and routing numbers to set up direct deposit, and this is a standard, safe practice. Employers handle this information for thousands of employees and have no reason to misuse it.
What should I do if I gave my account number to someone I do not trust?
Call your bank and tell them you believe your account number may have been compromised. Ask them to monitor your account for unauthorized activity and watch your statements closely for the next 30 to 60 days. Your bank can also change your account number if you request it, though this may take several business days.
Can I change my account number if I am worried about fraud?
Yes, you can request a new account number from your bank, though not all banks do this automatically. Call your bank and explain your concern. Changing your account number means you will need to update it with your employer, any businesses you pay regularly, and any automatic payments you have set up.
Is my account number visible on my checks?
Yes. Your routing number and account number are both printed on every check you write. This is why checks are considered less secure than other payment methods for large amounts or when paying strangers. Never mail a check to an address you are not certain about.