What a bank account number alone actually enables
A bank account number by itself—without your routing number—is far less dangerous than most people think. Someone who has only your account number cannot withdraw money, transfer funds, or open new accounts in your name. They cannot log into your online banking or change your password. A bank account number is not a key to your account the way a debit card or online login credentials are.
What they can do is limited but real. They can set up a direct deposit to that account—meaning they could route their paycheck or a refund into your account, which creates a mess you have to untangle with your bank. They can attempt to set up automatic bill payments or ACH transfers out of your account if they also have your routing number. They can use the number to research which bank you use, though that information is often public anyway. None of these actions are harmless, but they are also not the same as having access to your money.
Key Takeaways
- Your account number alone cannot be used to withdraw money or transfer funds—a thief also needs your routing number and usually additional verification.
- Someone with your account number can attempt to deposit money into your account or set up bill payments, both of which create problems you must report and reverse.
- The real risk comes when your account number is combined with your routing number, name, and address—that combination is enough for ACH fraud.
- If you discover unauthorized activity tied to your account number, contact your bank immediately and file a dispute; federal law limits your liability.
Direct deposits and refunds sent to your account
If someone has your account number and routing number, they can deposit money into your account without your permission. This sounds like a gift, but it is not. Deposits made this way can be reversed weeks or months later if the sender's bank discovers the transaction was fraudulent or unauthorized. You may spend the money thinking it is yours, then face a sudden withdrawal when the original bank pulls it back.
This happens most often with tax refund fraud or unemployment benefit fraud. A criminal files a false tax return or unemployment claim using your personal information, directs the refund to your account number, and collects the money before the government catches the fraud. You are left holding an account that suddenly goes negative when the government reverses the deposit. Your bank may also freeze your account during the investigation, leaving you unable to access your own money.
ACH transfers and bill payments set up in your name
With your account number, routing number, and name, someone can attempt to set up automatic bill payments or ACH transfers out of your account. They might set up a payment to a utility company, credit card, or loan in your name, or transfer money to an account they control. Unlike a debit card transaction, which requires a PIN or signature, an ACH transfer can be initiated by anyone who knows these three pieces of information.
Banks are required to investigate unauthorized ACH transfers, but the burden is on you to notice and report them. You have up to 60 days from the date your bank statement is sent to report an unauthorized transfer, but waiting that long makes the investigation harder. The sooner you spot the fraud and report it, the faster your bank can reverse it and prevent future transfers. Set up account alerts through your bank's app or website so you are notified of any outgoing transfers immediately.
How much damage requires both account and routing numbers
Your account number alone is nearly useless to a thief. Your routing number alone is also useless—it only identifies your bank, not your specific account. Together, they form what is called your bank details, and that combination is what criminals actually want. With both numbers, a routing number, and your name, someone can drain your account through ACH fraud, set up unauthorized bill payments, or deposit fraudulent refunds.
This is why you should never share your account number and routing number together, especially not to unknown callers or in response to unsolicited emails. Your bank will never ask you to confirm both numbers over the phone. If someone calls claiming to be from your bank and asks for your account number, hang up, look up the bank's official number, and call them back directly. Legitimate banks already have your account number on file.
What to do if someone has your account number
If you believe someone has obtained your account number, contact your bank immediately. You do not have to wait for fraudulent activity to appear—you can ask your bank to flag the account for monitoring or issue you a new account number. Some banks will do this for free if you report the compromise before any fraud occurs. Others may charge a small fee, but the cost is worth the protection.
Ask your bank specifically about their fraud monitoring tools and whether they can set up alerts for any outgoing transfers, large deposits, or changes to your account settings. Request that your bank require additional verification—such as a phone call to a number on file—before processing any ACH transfers or bill payment setup requests. These steps add friction that makes your account a less attractive target.
Your legal protection against unauthorized transfers
Federal law limits your liability for unauthorized ACH transfers and fraudulent deposits. Under Regulation E, if you report an unauthorized transfer within 60 days of your bank statement being sent, your bank must reverse it and return your money. If you report it after 60 days but within one year, your bank may still reverse it, though they are not required to. After one year, the bank has no obligation to help you recover the money.
The key is to monitor your account regularly and report problems quickly. Check your account at least weekly through your bank's app or website. If you see a transfer you did not authorize, a deposit you did not expect, or a bill payment you did not set up, contact your bank the same day. Have your bank send you a written confirmation of the fraud report, and keep records of all communications. If the bank refuses to reverse the transaction, you can file a complaint with the Consumer Financial Protection Bureau.
Protecting your account number going forward
Treat your account number the way you treat your Social Security number—as sensitive information that should not be shared casually. You will need to provide it to your employer for direct deposit, to creditors when you set up payments, and to financial institutions when you transfer money between accounts. In those cases, you are choosing to share it with a known, trusted entity.
Never provide your account number to someone who calls you unsolicited, emails you asking to confirm it, or texts you a link to "verify" your banking information. Scammers often pose as your bank, the IRS, or a utility company to trick you into sharing these details. If you are unsure whether a call or email is legitimate, hang up or close the email and contact the organization directly using a phone number or website you know is real. A few minutes of caution can save you weeks of dealing with fraud.
Frequently Asked Questions
Can someone withdraw money from my account with just my account number?
No. They would also need your routing number, and even then they cannot use an ATM or debit card—they can only attempt ACH transfers or bill payments. To withdraw cash at a teller window, they would need to impersonate you in person, which requires a photo ID.
What if someone deposits money into my account without permission?
Contact your bank immediately. Do not spend the money. The deposit may be reversed weeks or months later, leaving your account overdrawn. Your bank can help you understand whether the deposit is legitimate and what happens next.
Is my account number visible on checks I write?
Yes. Your account number is printed on every check you write, along with your routing number. This is why you should not leave blank checks lying around and should shred old checks before throwing them away.
Do I need to change my account number if someone has it?
Not necessarily, but you can ask your bank to issue you a new one. If there has been no fraud, many banks will monitor the account instead. If fraud has already occurred, a new account number may be the faster solution.
What is the difference between my account number and my routing number?
Your routing number identifies your bank and branch. Your account number identifies your specific account within that bank. Together they form your complete bank details. One without the other is much less useful to a criminal.