Your account number alone cannot drain your account, but who you give it to matters enormously
A bank account number by itself—the digits at the bottom left of your check—cannot be used to withdraw money or make purchases. A thief needs your routing number and account number together, plus knowledge of your bank's name and your full name. Even then, they can only set up ACH transfers (electronic bank-to-bank moves) or write checks in your name, not swipe funds instantly. The real risk is not the number itself but who you give it to and why.
When you are waiting for a refund, a government payment, or any money owed to you, you will often be asked to provide these numbers. The safety question is straightforward: if you initiated the contact and you know the organization is real, it is safe. If someone contacted you first, it is not.
Key Takeaways
- Your account number alone cannot be used to steal money; a thief also needs your routing number, bank name, and full name to attempt an ACH transfer.
- It is safe to provide your account and routing numbers to your employer for direct deposit, to the IRS for refund delivery, and to legitimate billers you initiated contact with.
- Never give your account number to someone who called or emailed you unsolicited, even if they claim to be from your bank or the government.
- If you give your account number to a refund processor, verify first that the company is real by calling your agency directly, not using a number from their website or email.
- Monitor your account for unauthorized ACH transfers and report them within 60 days to limit your liability to $50.
When it is safe to share your account number
You should provide your account and routing numbers when you initiate the transaction and you know exactly who you are dealing with. This includes direct deposit for your paycheck, setting up automatic bill payments to companies you already do business with, and providing your bank details to the IRS or your state tax authority for a tax refund. In these cases, the organization has no reason to steal from you—they are sending money to you, not taking it.
Refund processors and loan servicers often ask for your account number to deposit funds. This is standard practice. The safety issue here is not the number itself but whether the processor is real. If a company contacts you about a refund you did not request, hang up and call the agency directly using the phone number on their official website or your tax return. Do not use a number the processor gave you.
Government agencies—the IRS, state tax departments, Social Security, unemployment offices—will ask for your account number to send refunds, stimulus payments, or benefits. You can safely provide it. These agencies do not profit from stealing and have no motive to do so. The same is true for insurance companies paying out a claim you filed.
When you should refuse to share your account number
Never give your account number to someone who contacted you first, whether by phone, email, text, or mail. This includes callers claiming to be from your bank, the IRS, or any government office. Real agencies do not call you asking for account numbers. If your bank suspects fraud, they will ask you to verify information you already provided (like the last four digits of your card), not ask for new details.
Scammers use urgency and authority to pressure you into sharing. They may say your account is frozen, your refund is delayed, or you owe back taxes. None of this changes the rule: hang up, find the official number yourself, and call back. A real agency will have a record of your case and can discuss it when you call through official channels.
Be cautious with third-party refund services that promise to speed up your tax refund or get you money faster. Some are legitimate tax preparation companies; others are predatory. If you use one, verify the company's license through your state's tax authority or the Better Business Bureau before handing over banking details. Never pay an upfront fee for a refund you are owed by the government.
What happens if someone gets your account number
If your account number becomes public—posted online, shared with a scammer, or stolen—the immediate risk is an unauthorized ACH transfer. This is slower than a credit card theft but harder to reverse quickly. The thief would need to know your full name and routing number as well, and they would have to set up the transfer through their own bank account, which creates a paper trail.
Federal law limits your liability for unauthorized ACH transfers to $50 if you report the fraud within 60 days of the transfer appearing on your statement. If you wait longer, your liability can rise to the full amount stolen. Check your account regularly—weekly is reasonable if you are concerned—and report any transfer you did not authorize to your bank immediately.
Your bank can reverse an unauthorized ACH transfer, but it takes time. The sending bank must investigate, and the receiving bank must hold the funds. This process usually takes 10 business days. In the meantime, your account may be overdrawn. Contact your bank right away and ask them to freeze the account or flag it for fraud monitoring while they investigate.
How to protect your account number
Treat your account number the way you treat your Social Security number: share it only when you have a clear reason and you initiated the contact. Keep your checks in a safe place—do not leave them in an unlocked desk or car. If you receive a check from a refund or a government payment, deposit it promptly rather than leaving it lying around.
When you provide your account number online, use a secure connection (the URL should start with "https://" and show a lock icon). Do not email your account number or routing number. If a company asks you to email banking details, that is a red flag—legitimate organizations have secure portals or phone lines for this.
Set up account alerts with your bank. Most banks let you receive a text or email when a transfer over a certain amount is initiated. This gives you a chance to stop a fraudulent transfer before it clears. You can also set up a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) if you believe your information has been compromised.
Refunds and account numbers: the common scenario
Tax refunds, stimulus payments, and insurance refunds are often delivered by direct deposit. The agency or company will ask for your account and routing numbers. This is safe as long as you are dealing with the real organization. The confusion arises because scammers impersonate these agencies to collect banking details.
If you are waiting for a refund and someone contacts you about it, do not give them anything. Hang up and call the agency using the number on your official paperwork or their website. If you filed your taxes through a tax preparer, call the preparer directly to confirm whether they need your banking details. Do not use a phone number from an email or a website you found through a search.
Once you have provided your account number to a legitimate refund source, you can track the deposit. The IRS lets you check your refund status on IRS.gov. State tax agencies have similar tools. Insurance companies will tell you the deposit date when they approve your claim. If the deposit does not arrive by the promised date, contact the organization directly to ask why.
What to do if you gave your account number to a scammer
If you realize you shared your account number with someone you should not have, act quickly. Call your bank immediately and tell them you may be a victim of fraud. Ask them to monitor your account for unauthorized transfers and to flag any ACH activity for review. Some banks can place a temporary hold on your account to prevent outgoing transfers while they investigate.
Request a new account number and debit card. Your bank can issue these within a few business days. Update any automatic payments or direct deposits to use your new account number. Contact your employer's payroll department, the IRS (if you are expecting a refund), and any other organization that deposits money into your account.
File a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record and helps law enforcement track scam patterns. If the scammer also obtained other personal information, consider placing a fraud alert or credit freeze with the credit bureaus. A fraud alert lasts one year and tells lenders to verify your identity before opening new accounts.
Frequently Asked Questions
Can someone use just my account number to make purchases?
No. Online and in-store purchases require a credit or debit card number, expiration date, and CVV. Your bank account number alone cannot be used at a store or website. It can only be used to set up an ACH transfer, which requires your routing number and full name as well.
Is it safe to write checks if my account number is on them?
Yes. Checks are designed to be shared—that is their purpose. Your account number is printed on every check you write. The risk is not the number but the check itself: if someone steals a blank check, they can forge your signature and write themselves a payment. Keep blank checks secure and monitor your account for unauthorized checks.
What if my bank asks for my account number over the phone?
Hang up and call your bank back using the number on your debit card or bank statement. Real banks do not call customers asking for account numbers. If your bank needs to verify something, they will ask for information only you would know, like the last four digits of your card or your mother's maiden name—not your full account number.
How long does it take to reverse a fraudulent ACH transfer?
The investigation usually takes 10 business days, but the funds may be held longer if the receiving bank contests the claim. Your bank should credit your account within 10 days if the transfer is confirmed as unauthorized. Ask your bank for a timeline when you report the fraud.
Do I need to give my account number to get a tax refund?
No, but it speeds up delivery. The IRS can mail a check to your address on file, which takes four to six weeks. Direct deposit takes one to two weeks. If you choose direct deposit, you provide your account number on your tax return or through the IRS website—not through a third party or in response to an unsolicited contact.