What a checking account number alone actually exposes you to

A checking account number by itself — without your routing number — is nearly useless to a criminal. They cannot withdraw money, transfer funds, or open new accounts with just that one piece of information. What they can do is limited: they might use it to pose as you in a phone call to your bank, or they might try to set up a recurring payment if they also have your name and routing number. The real danger arrives when your account number is paired with your routing number, your name, or both.

The distinction matters because it changes what you need to do and how quickly. If only your account number leaked — say, from a receipt or a screenshot — your risk is much lower than if your full banking details were exposed in a data breach.

Key Takeaways

  • An account number alone cannot be used to drain your account or transfer money without additional information like your routing number or name.
  • The real risk arrives when someone has both your account number and routing number, which together form the basis of your bank account identity.
  • You should contact your bank immediately if your account number was exposed in a breach, even if you do not know whether your routing number was also compromised.
  • Changing your account number is free and takes one phone call to your bank, and it stops any recurring payments someone may have tried to set up.
  • Monitoring your account for unauthorized transactions is more important than panic, because your bank is liable for most fraudulent charges if you report them within 60 days.

What criminals can attempt with just your account number

If someone has only your checking account number, they have a few narrow options. They might call your bank pretending to be you and claim they lost their debit card, hoping to trick a representative into revealing information or resetting your PIN. This rarely works with modern banks because representatives ask for verification details the caller should not know.

They might also try to set up a recurring payment — like a subscription or utility bill — if they also know your name and address. Without your routing number, they cannot initiate an ACH transfer (the electronic system banks use to move money between accounts). They cannot write checks in your name. They cannot access your online banking portal. The barrier is real.

Why your routing number changes everything

Your routing number and account number together form a complete banking identity. With both pieces, someone can initiate an ACH debit — pulling money directly from your account to theirs. This is how most account takeovers happen. They do not need your password, your PIN, or access to your email. They just need those two numbers and your name.

ACH fraud is common enough that banks have built-in protections. Most banks will reverse an unauthorized ACH debit if you report it within 60 days. Some will reverse it faster. The law (Regulation E) requires banks to investigate and refund you if you report the fraud promptly. This does not mean you should ignore it — it means you should monitor your account and report anything suspicious — but it does mean you are not personally liable for the loss.

Steps to take if your account number was exposed

Call your bank immediately. Tell them your account number was compromised and ask them to issue you a new account number. This is free and takes one phone call. Your bank will close the old account and open a new one with a different number. Any recurring payments tied to the old number will fail, which is why you should also update your account information with any services you pay regularly (utilities, subscriptions, payroll direct deposit).

Ask your bank whether they saw any unauthorized transactions or attempted transactions on your account. If they did, ask them to document it and explain what protections apply. If you see unauthorized charges yourself, report them in writing (email counts) within 60 days of the statement date. Keep a copy of your report.

Check your credit report at annualcreditreport.com (the only free, official source) to see whether anyone opened new accounts in your name. You can also place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) by calling one of them; they will notify the others. A fraud alert is free and lasts one year.

When your account number was part of a larger breach

If your account number was exposed in a data breach that also included your routing number, name, or both, the risk is higher. Contact your bank the same day you learn about the breach. Do not wait to see whether fraud occurs — waiting makes it harder to prove the fraud was not your fault.

Ask your bank whether they recommend closing the account and opening a new one, or whether they can simply issue a new account number while keeping the account open. Some banks prefer one method over the other. If you close the account, make sure any automatic payments are updated before the old account closes, or they will fail and you may face late fees.

If the breach included your name, routing number, and account number together, consider placing a credit freeze (not just an alert) with all three credit bureaus. A freeze is free and prevents anyone from opening new accounts in your name without your permission. It takes a few minutes per bureau and lasts until you lift it.

Protecting your account number going forward

Your account number appears on every check you write and on receipts from transactions. Do not leave checks or receipts lying around. Do not photograph or screenshot your checks and send them via email or text. Do not give your account number to anyone who calls you claiming to be from your bank — legitimate banks will never ask for it over the phone.

When you pay bills online, use your bank's bill pay feature rather than giving your account number directly to the biller. When you set up direct deposit for payroll, your employer will ask for your routing and account number — that is normal and necessary. When a merchant asks for your account number to process a payment, ask whether they can use your debit card instead.

If you use mobile payment apps like Venmo or PayPal, they do not need your account number — they work through your bank connection or card. If an app asks for your account number directly, that is a red flag.

What to do if you spot unauthorized transactions

Log into your account online or call your bank and review your recent transactions. Look for charges you do not recognize, especially small recurring charges (fraudsters often test with small amounts first). If you find unauthorized activity, contact your bank immediately by phone. Do not use email or online chat for the first report — call so there is a record of the date and time you reported it.

Your bank will open a dispute and typically issue a provisional credit within one to three business days while they investigate. The investigation usually takes 10 business days but can extend to 45 days if the bank needs more information. During this time, the money is usually back in your account, even though the investigation is ongoing.

Keep records of every communication with your bank about the fraud. Write down the date, time, representative's name, and what was discussed. If you reported it by phone, follow up with an email to your bank summarizing the call. This creates a paper trail that protects you if the bank disputes your claim later.

Frequently Asked Questions

Can someone set up a payment plan or loan in my name with just my account number?

Not with just the account number alone. They would need your full name, address, date of birth, and Social Security number to open a loan or credit account. An account number by itself cannot be used for credit applications. However, if your account number was exposed in a breach that also included other personal information, that risk increases significantly.

Do I need to close my checking account if my account number was compromised?

Not necessarily. You can ask your bank to issue you a new account number and keep the same account open. This is simpler than closing and reopening because you do not have to update your direct deposit, automatic payments, or other recurring transactions. Ask your bank which option they recommend based on how the number was exposed.

How long does it take to get a new account number?

Your bank can issue a new account number immediately over the phone. You will receive new checks and debit cards in the mail within 7 to 10 business days. In the meantime, you can use your online banking and mobile app with the new number right away. Some banks will also provide temporary checks or a temporary card number if you need to make payments before the new cards arrive.

What if I gave my account number to a company I thought was legitimate and now I am worried?

Call your bank and describe the situation. Tell them the company name, when you gave the number, and what it was for. Your bank can monitor the account for suspicious activity and may recommend changing the number if they do not recognize the company. Do not assume fraud has occurred — many legitimate businesses request account numbers for payments — but do let your bank know so they can watch for it.

Am I responsible for money stolen from my account if I reported it late?

Federal law (Regulation E) protects you if you report unauthorized ACH transactions within 60 days of the statement date. If you report after 60 days, your liability increases, but your bank may still help you depending on their policies. The sooner you report, the better. If you report within two business days of noticing the fraud, your liability is capped at $50. After two business days but within 60 days, your liability can be up to $500.