Yes, scammers can use your bank account number to pull money out, but only if they also have other information
A bank account number alone is not enough to drain your account. Scammers need your account number and your routing number to set up an unauthorized withdrawal. With both pieces, they can initiate an ACH (Automated Clearing House) transfer or create a fake check using your account details. They can also use your account number to sign you up for recurring charges or subscriptions you never authorized.
The real risk is not that your account number is public — it actually appears on every check you write and on statements you may leave lying around. The risk is when scammers combine your account number with other information: your name, address, phone number, or Social Security number. That combination lets them pose as you to your bank, set up bill pay, or convince a merchant you authorized a payment.
If you have given your account number to someone you do not trust, or if you suspect it has been compromised, contact your bank immediately. Most banks can flag your account for fraud monitoring and issue you a new account number if needed.
Key Takeaways
- Your account number and routing number together allow scammers to pull money via ACH transfer or create unauthorized checks in your name.
- Account number alone is less dangerous than account number plus personal information like your name, address, or Social Security number.
- Scammers often use your account details to set up recurring charges, subscriptions, or bill pay without your knowledge.
- Contact your bank as soon as you suspect your account number has been shared with someone untrustworthy.
- Your bank can issue a new account number and monitor your account for suspicious activity once you report the compromise.
How scammers use your account number to pull money
The most direct attack is an ACH debit. If a scammer has your account number and routing number, they can initiate a one-time ACH transfer or set up recurring debits that pull money from your account. ACH transfers typically clear within one to two business days, and the money is gone before you notice. Your bank may not catch it as fraud immediately because ACH transfers look like legitimate bill payments.
A second method is check fraud. Scammers can print counterfeit checks using your account number and routing number, then cash them or deposit them into their own account. The check clears, money leaves your account, and by the time your bank discovers the fraud, the scammer has already moved the money.
A third method is recurring billing. Scammers use your account number to sign you up for subscriptions, gym memberships, or other services that charge your account monthly. These charges often go unnoticed for weeks because they are small and blend in with legitimate transactions.
What information scammers actually need to cause real damage
Your account number by itself has limited power. Scammers need additional pieces of information to do serious harm. The most dangerous combination is your account number plus your routing number — together, these allow ACH transfers. Your routing number is not secret; it is printed on every check and is tied to your bank's location, not your account.
More dangerous still is your account number plus your name and address. With these, a scammer can call your bank posing as you, claim they lost their debit card, and request a new one sent to a different address. They can also set up bill pay through your bank's online system if they can guess or reset your password.
The most damaging combination is your account number plus your Social Security number. This allows scammers to open new accounts in your name, take out loans, or commit identity theft that goes far beyond your current bank account. If you have shared your account number with someone who also has your SSN, treat it as a full identity theft risk.
Where scammers get your account number
Scammers obtain account numbers through several routes. Data breaches at retailers, healthcare providers, or financial institutions expose millions of account numbers at once. Phishing emails trick you into entering your account number on a fake bank website. Phone scams pose as your bank and ask you to "verify" your account number. Mail theft targets bank statements, checks, or tax documents left in your mailbox.
You may also voluntarily give your account number to someone you believe is legitimate — a landlord collecting rent, a utility company, a contractor, or a person selling something online. If that person turns out to be a scammer or if they misuse the information, your account is at risk.
Public records and social media can also expose your account number indirectly. If you post a photo of a check, share your bank statement, or leave financial documents visible in a video call, scammers can extract the number from the image.
What to do if you think your account number has been compromised
Contact your bank immediately — do not wait. Call the number on the back of your debit card or on your most recent bank statement. Do not use a phone number from an email or text message, as scammers sometimes send fake alerts with fake bank numbers.
Tell your bank that your account number may have been compromised and ask them to:
- Flag your account for fraud monitoring.
- Review recent transactions for unauthorized activity.
- Issue you a new account number and new debit card.
- Place a temporary freeze on your account if you prefer.
Your bank can also set up alerts so you are notified of any transaction over a certain amount. Some banks allow you to temporarily block ACH transfers or bill pay while you investigate.
Check your account statements for the next 30 to 60 days for any charges you do not recognize. If you find unauthorized transactions, report them to your bank in writing (email or secure message through your bank's app) so you have a record. Most banks have a fraud dispute window — typically 60 days from when you receive your statement — to report unauthorized charges. After that window closes, your liability may increase.
How to protect your account number going forward
Treat your account number like you treat your Social Security number: share it only when necessary and only with people or organizations you trust. When you must provide it, verify you are dealing with the real organization. Call the main phone number on their website or your statement, not a number they provided to you.
Never share your account number via email, text, or social media. Your bank will never ask for your full account number by email. If you receive an email or text claiming to be from your bank and asking for account details, it is a scam.
Shred bank statements, checks, and any documents with your account number before throwing them away. Do not leave mail in your mailbox for days. Consider a mailbox lock or a PO box if mail theft is common in your area.
Monitor your account regularly — at least weekly. Most banks offer free online access and mobile apps that show transactions in real time. Set up account alerts for transactions over a certain amount, large transfers, or new bill pay recipients.
Frequently Asked Questions
Can someone open a new bank account using just my account number?
No, not with your account number alone. Opening a new account requires your Social Security number, photo ID, and proof of address. However, if a scammer has your account number plus your SSN and personal information, they can attempt to open accounts in your name, which is identity theft rather than account compromise.
What if I gave my account number to someone and now I am worried?
Call your bank immediately and describe the situation. If the person also has your routing number, name, or other personal information, ask your bank to issue a new account number. If you only gave your account number to a legitimate business (like your employer or utility company), the risk is lower, but your bank can still monitor for suspicious activity.
How long does it take for unauthorized ACH transfers to show up?
ACH transfers typically clear within one to two business days. You may not see the charge until the next day, depending on when the scammer initiated it and your bank's processing schedule. This is why checking your account regularly is important — the sooner you spot fraud, the sooner you can report it.
If my bank refunds fraudulent charges, do I have to pay them back?
No. If your bank determines a charge was unauthorized, they must refund it under federal law (Regulation E for electronic transfers). You are not liable for unauthorized ACH transfers or fraudulent checks if you report them within the required timeframe, typically 60 days from your statement date.
Should I close my account if my account number has been compromised?
Not necessarily. Closing the account does not erase the fraud that may have already occurred, and it can create problems with automatic deposits or bill pay. Instead, ask your bank to issue a new account number and monitor the old account for any remaining fraudulent activity. You can close it once you have confirmed all unauthorized charges have been resolved.