Yes, but only certain things — and your bank account number alone is not enough for most fraud

A scammer with your bank account number and routing number can set up an ACH transfer out of your account or create a fake check using those numbers. They cannot log into your online banking, change your password, or drain your account through a debit card they don't physically hold. The damage depends on what else they have: your name, address, and account number together create more risk than the number alone. Your bank's fraud protections cover most of this, but the process of proving it and getting your money back takes time.

The real danger is not your account number in isolation — it is your account number combined with information that scammers buy in bulk on the dark web after data breaches. A single number floating around is a low-probability threat. A number paired with your name, address, and phone number is a working toolkit for fraud.

Key Takeaways

  • A scammer can use your account and routing number to create unauthorized ACH transfers or counterfeit checks, but cannot access your online account without your login credentials.
  • The real risk comes when your account number is combined with your name, address, and phone number — information often sold together on the dark web or leaked in data breaches.
  • Your bank is required to refund unauthorized ACH transfers if you report them within 60 days, though the process can take two to ten business days.
  • Counterfeit check fraud is slower to appear but harder to reverse, because the check clears through the banking system before the fraud is discovered.
  • Freezing your credit and monitoring your accounts weekly catches most fraud before serious damage occurs.

What a scammer can do with your account number

An ACH transfer is the most common attack. A scammer with your account number, routing number, and name can initiate an ACH debit — a pull of money directly from your account — without your permission. They do this through a third-party ACH processor, a bill payment service, or a fraudulent business account. The transfer appears as a debit on your statement, and the money leaves your account within one to three business days. You will see it, but by then the money is already gone.

Counterfeit checks are slower but harder to catch. A scammer prints a fake check using your account and routing number, writes it to themselves or a co-conspirator, and deposits it into another bank account. The check clears through the Federal Reserve's check clearing system, and the receiving bank releases the funds. Days or weeks later, your bank discovers the check is counterfeit and reverses the deposit — but by then the scammer has already withdrawn the money from the other account. You are left responsible for the negative balance, and your bank may freeze your account while investigating.

A scammer cannot use your account number alone to open a credit card, take out a loan, or make purchases online. Those require additional identity information or a physical card. They also cannot log into your online banking portal, because that requires your username and password. Your account number is not a master key to your finances — it is a single piece of information that enables specific types of fraud.

Why your account number is dangerous in combination with other information

Your account number is most dangerous when paired with your name, address, phone number, and Social Security number. Scammers buy this bundle on the dark web, often from data breaches at retailers, healthcare providers, or financial institutions. With all of it, they can impersonate you to utility companies, open accounts in your name, or convince your bank's customer service to add a new authorized user to your account.

Your account number alone — without your name or address — is less useful but still risky. Scammers sometimes post lists of account and routing numbers on forums and ask others to attempt ACH transfers. If one succeeds, they know the account is active and the owner may not be monitoring closely. This is why you should never share your account number in emails, texts, or over the phone unless you initiated the contact and verified the recipient is legitimate.

Data breaches are the most common source of leaked account numbers. When a company storing your banking information is hacked, your account number may be exposed along with thousands of others. You will not always know this has happened — many breaches go unnoticed for months. This is why monitoring your account weekly for unauthorized transactions is critical. The sooner you spot fraud, the sooner you can report it and trigger your bank's fraud protections.

How your bank protects you from ACH fraud

The Electronic Funds Transfer Act (EFTA) requires your bank to refund unauthorized ACH transfers if you report them within 60 days of the transaction appearing on your statement. Most banks will refund the money within two to ten business days, though some take longer if they need to investigate. The bank contacts the receiving bank and attempts to recover the funds; if the receiving bank cannot retrieve them, your bank covers the loss.

The catch is that you have to notice and report the fraud. If you do not check your account for three months and then discover ten unauthorized ACH transfers, your bank may deny your claim for any transfers older than 60 days. This is why setting up account alerts — notifications when a transaction over a certain amount posts — is one of the fastest ways to catch fraud early. Many banks let you set alerts for free through their mobile app or online portal.

Some banks offer zero-liability fraud protection, meaning they refund unauthorized transactions even if you report them after 60 days. Check your account agreement or call your bank to confirm what protection you have. Credit unions often have stronger fraud protections than large banks, though the process is the same. If your bank denies a claim, you have the right to dispute it with the Consumer Financial Protection Bureau.

Counterfeit check fraud is harder to reverse

When a counterfeit check clears, the receiving bank is responsible for verifying the check's authenticity. In practice, many checks clear without verification, especially if the amount is small or the deposit is made at an ATM. By the time your bank discovers the check is fake — sometimes weeks later — the scammer has already withdrawn the money from the receiving account.

Your bank will reverse the deposit and charge your account for the amount of the counterfeit check. You are then responsible for the negative balance. If the receiving bank can recover any funds from the scammer's account, your bank may credit you back, but this rarely happens. The scammer has usually moved the money to another account or converted it to cryptocurrency. You may see the negative balance on your account for 30 to 90 days while the banks investigate and attempt recovery.

Counterfeit check fraud is prosecuted as forgery and wire fraud, but law enforcement rarely pursues cases involving small amounts. If you are a victim, file a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and your local police department. Provide your bank with the case number; some banks use this to support a claim for recovery or to write off the loss faster.

Steps to take if you think your account number has been compromised

First, check your account for unauthorized transactions. Log into your online banking and review the past 60 days of activity. Look for small test transactions (often $1 to $5) that scammers use to confirm an account is active. If you find any unauthorized activity, contact your bank immediately by phone — do not use email or the bank's website chat, because scammers sometimes intercept those communications.

Tell your bank you want to report unauthorized ACH transfers or counterfeit checks. Provide the transaction dates, amounts, and any details you remember about where the money went. Your bank will file a dispute and begin an investigation. Ask the bank to send you a written confirmation of the dispute within three business days; keep this for your records. This confirmation is important if you later need to file a complaint with the CFPB.

Second, place a fraud alert on your credit file. Call one of the three major credit bureaus — Equifax, Experian, or TransUnion — and request a fraud alert. You only need to call one; that bureau will notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. This prevents a scammer from using your compromised information to open credit cards or loans.

Third, consider a credit freeze if your Social Security number has also been compromised. A freeze prevents anyone, including you, from opening new accounts using your Social Security number. You can place a freeze for free at all three bureaus' websites. You will need to unfreeze temporarily if you want to apply for credit yourself, but the freeze stays in place until you remove it.

Fourth, monitor your account weekly for the next six months. Set up alerts for transactions over $100, or whatever amount makes sense for your spending. Many scammers try multiple times before succeeding, so catching a second attempt early prevents larger losses. If you see another unauthorized transaction, report it immediately — each report restarts the 60-day window for refunds.

What to do if your bank denies your fraud claim

If your bank refuses to refund an unauthorized ACH transfer and you reported it within 60 days, you have the right to dispute the decision. Ask your bank for a written explanation of why they denied your claim. Common reasons include: you authorized the transaction (the bank claims you did), you did not report it within 60 days, or the bank claims you were negligent in protecting your account number.

If you disagree with the bank's decision, file a complaint with the Consumer Financial Protection Bureau (CFPB). The CFPB investigates complaints against banks and can order them to refund your money. You can file online at consumerfinance.gov or by mail. Include copies of your dispute letter, the bank's response, and your account statements showing the unauthorized transactions. The CFPB typically responds within 15 business days.

For counterfeit check fraud, the process is more difficult. Your bank may hold you responsible for the full amount of the counterfeit check, because the check passed through the banking system and cleared. If you believe the check was forged and you did not authorize it, ask your bank to file a claim with the receiving bank. This can take 30 to 90 days. If the receiving bank cannot recover funds, your bank may write off the loss, but you will still see the negative balance on your account until that happens.

Frequently Asked Questions

Can someone open a bank account using just my account number?

No. Opening a bank account requires a government-issued ID, proof of address, and usually a Social Security number. Your account number alone is not enough. However, if a scammer has your name, address, and Social Security number along with your account number, they may be able to convince a bank's customer service to add themselves as an authorized user on your existing account, which gives them access to withdraw money.

How long does it take to get my money back after I report ACH fraud?

Most banks refund unauthorized ACH transfers within two to ten business days. The bank initiates a reversal with the receiving bank and attempts to recover the funds. If the receiving bank can retrieve the money, you get it back quickly. If the scammer has already moved the money, the process takes longer — sometimes up to 30 days — while the banks investigate.

Should I close my account if my account number was leaked?

Not necessarily. Closing your account does not erase the account number from the dark web, and it may hurt your credit if the account is in good standing. Instead, monitor the account closely for fraud and consider switching to a new account if you see repeated unauthorized activity. Ask your bank to issue you a new debit card with a new number, which stops card-based fraud even if your account number is compromised.

What if a scammer uses my account number to pay their own bills?

If a scammer sets up a utility bill, subscription, or loan payment using your account number, you will see the unauthorized debit on your statement. Report it to your bank as ACH fraud within 60 days and you will be refunded. You may also need to contact the company receiving the payment and tell them the account was used fraudulently; they may reverse the payment on their end as well.

Can I be held responsible for counterfeit checks written on my account?

Yes, initially. Your bank will reverse the deposit and charge your account for the amount of the counterfeit check. However, you are not liable for the full amount if you can prove you did not authorize the check and took reasonable steps to protect your account number. File a dispute with your bank and, if necessary, file a complaint with the CFPB. The process can take 30 to 90 days.