What a scammer or thief can actually do with your account number
A scammer with your account number and routing number can set up automatic withdrawals from your account without your permission. They can pose as a business you trust, contact your bank claiming to be you, or use the numbers to create fraudulent checks. They cannot log into your online banking or change your password — that requires separate credentials — but they can drain your account through ACH transfers, bill pay, or by selling the information to someone else who will.
The damage depends on what else they have. Your account number alone is less dangerous than your account number plus your name, address, and Social Security number. But it is still enough to cause real harm, and the longer you wait to report it, the harder it becomes to recover the money.
Key Takeaways
- A scammer can use your account and routing numbers to set up unauthorized ACH transfers or create fake checks in your name.
- They cannot access your online banking login or change your password with account numbers alone, but they can still empty your account.
- Report unauthorized transactions to your bank within 60 days to protect yourself under federal law, though banks often cover fraud reported later.
- Your bank can place a fraud alert on your account and issue you a new account number if the old one has been compromised.
- Freezing your credit with the three major bureaus prevents someone from opening new accounts in your name using your personal information.
How ACH transfers and fake checks work with your account number
An ACH transfer is an electronic bank-to-bank movement of money. A scammer with your account number can initiate an ACH debit — a pull of money from your account — by claiming to be a business collecting a payment. They do not need your permission or your login credentials. They only need your account number, routing number, and your name.
Fake checks are slower but harder to trace. A scammer can print a check using your account number at the bottom, deposit it into their own account at a different bank, and withdraw the cash before the check bounces. You will not see the problem until your bank processes it days later. By then the scammer has the money and you are responsible for the overdraft.
Both methods work because banks process transactions first and verify them later. Your bank trusts the routing number and account number format. It does not call you to confirm every ACH debit or check deposit.
What your bank can do to stop further damage
Call your bank immediately if you notice unauthorized transactions. Do not wait for a statement. Ask them to place a fraud alert on your account, which flags it for suspicious activity. They will also issue you a new account number and debit card.
Your bank can reverse fraudulent ACH transfers and checks if you report them within a specific window. Federal law gives you 60 days from the date your statement shows the unauthorized transaction, but most banks will honor claims filed later if you report the fraud promptly. The bank's fraud department will investigate, contact the receiving bank, and attempt to recover the money.
Ask your bank whether they offer Positive Pay or ACH filters. Positive Pay lets you pre-approve which checks will clear. ACH filters let you block transfers to accounts outside your bank. These tools cost money for business accounts but are sometimes free for personal accounts.
Steps to take after your account number is compromised
First, contact your bank's fraud department by phone — not email or the website chat. Confirm the phone number by looking it up yourself rather than using a number from any email or letter you received. Tell them your account number has been compromised and ask them to freeze the account temporarily while they issue a new one.
Second, request a copy of recent transactions and statements. Look for ACH debits, checks, or transfers you did not authorize. Write down the dates, amounts, and receiving banks or businesses. Your bank will need this information to investigate.
Third, place a fraud alert with the three credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can file this online at any one bureau and they will notify the other two. The alert lasts one year and is free.
Fourth, consider a credit freeze if you believe your Social Security number was also compromised. A freeze prevents anyone from opening new accounts, taking out loans, or applying for credit in your name. You can freeze and unfreeze your credit for free at each bureau's website.
How to prevent someone from getting your account number in the first place
Do not share your account number over the phone unless you initiated the call to a number you looked up yourself. Scammers call claiming to be from your bank, your utility company, or the IRS. They create urgency — "your account will be closed" — to pressure you into giving information.
Shred bank statements, checks, and any mail with your account number before throwing it away. Dumpster diving is a real method used by identity thieves, especially near apartment complexes and office buildings.
Be cautious with checks. Do not leave them in your mailbox for the postal carrier to pick up. Take them directly to the post office or your bank. Do not write your account number on the memo line of a check if it will be seen by a cashier or business employee.
Use your bank's bill pay feature instead of mailing checks when possible. You control the timing and the receiving account, and your account number does not appear on the check your bank sends on your behalf.
What your account number alone cannot do
A scammer cannot log into your online banking account with just your account number. They would need your username and password, or access to your email account or phone number for two-factor authentication. They cannot change your password, request a new debit card, or update your contact information.
They also cannot see your balance, transaction history, or other account details without logging in. Your account number is the routing address for money to move in or out, not the key to your account itself.
However, if they have your account number plus your name and address, they can call your bank's customer service line and attempt to social engineer a representative into revealing information or making changes. This is why you should set up a strong verbal password with your bank — a code only you know that the bank will ask for before discussing your account over the phone.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, government ID, and a signature. Your account number alone is not enough. However, if a scammer has your Social Security number and a fake ID, they can open accounts in your name. This is why a credit freeze is important if you believe your full identity has been stolen.
How long does it take to get a new account number from my bank?
Most banks issue a new account number within one business day. Your old debit card will be deactivated and a new one will arrive in the mail within 7 to 10 business days. You can request a temporary card at a branch if you need one immediately. Your checks will need to be reordered with the new account number.
Will my bank cover the money if someone steals from my account?
Federal law requires banks to cover unauthorized ACH transfers and electronic debits if you report them within 60 days of the statement date. Many banks cover fraud reported after 60 days as a matter of policy, but you lose legal protection. Unauthorized checks are covered under different rules and banks handle them case by case. Report fraud as soon as you notice it.
What if the scammer used my account number to pay a bill I actually owe?
If they paid a legitimate debt in your name without your permission, it is still fraud. Report it to your bank. The creditor will have to reverse the payment once your bank confirms it was unauthorized. You will still owe the debt, but you will not have paid it twice.
Should I close my bank account if my number has been compromised?
You do not have to close it if your bank issues a new account number and places a fraud alert. Closing the account can complicate the fraud investigation and may affect your banking history. Ask your bank whether they recommend closing it or simply switching to the new account number they provide.