Yes, but only certain things—and your bank account number alone is not enough for most scams
A scammer with only your bank account number and routing number can set up unauthorized ACH transfers (automatic bank-to-bank payments) out of your account, but they cannot withdraw cash, make purchases, or access your account without additional information. They need either your name and address to match your bank's records, or they need to know your online banking password. The real risk is not that they can drain your account with the number alone—it is that they can use it as a starting point for a larger fraud scheme.
Your bank account number is printed on every check you write and is visible to anyone you pay by bank transfer. It is not a secret like a password or PIN. The danger comes when a scammer combines it with other information: your name, your routing number, or social engineering tactics that convince your bank to move money or change your account settings.
Key Takeaways
- A scammer can initiate ACH transfers out of your account using your bank account number, routing number, and name, but your bank can reverse unauthorized transfers within a limited window.
- Your bank account number alone cannot be used to make online purchases, withdraw cash at an ATM, or access your account—those require passwords or cards.
- The real threat is when a scammer combines your account number with social engineering or phishing to trick your bank into authorizing transfers or changing account details.
- If you notice unauthorized ACH transfers, contact your bank immediately and file a dispute; most banks reverse these within 10 business days if reported promptly.
- Giving your account number to a business for a one-time payment (utilities, rent, loan payments) is normal and safe if you initiated the transaction.
What a scammer can do with your account number
The most common scam using a bank account number is setting up an unauthorized ACH debit. A scammer can contact your bank or use an online ACH system to pull money directly from your account. This works because ACH transfers require only the account number, routing number, and the account holder's name—all of which a scammer may already have or can find.
The scammer typically poses as a business collecting a payment: a utility company, a loan servicer, a subscription service, or a government agency. They send you an invoice or a text message with a link, or they call you claiming you owe money. If you give them permission (or they claim you did), they initiate the transfer. Your bank processes it because the routing and account numbers are correct.
This is different from a credit card fraud, where the card issuer usually covers unauthorized charges. With ACH fraud, the burden is on you to dispute it—though your bank must reverse it if you report it within a certain timeframe.
What a scammer cannot do with just your account number
A scammer cannot log into your online banking account with only your account number. They need your username and password, or they need to reset your password—which requires access to your email or phone number.
They cannot withdraw cash at an ATM or make debit card purchases without your debit card and PIN. They cannot transfer money to themselves using your bank's online platform without logging in. They cannot open new accounts in your name or take out loans using only your account number—those require additional identity verification.
They also cannot use your account number to make credit card purchases or access credit. Your bank account number is not linked to credit reporting, and merchants do not accept it as a payment method the way they accept credit cards.
How scammers combine your account number with other tactics
The real danger emerges when a scammer has your account number and uses social engineering or phishing to get more. For example, they might call your bank pretending to be you, claim they lost access to their account, and ask the bank to reset the password or add a new phone number for two-factor authentication. If the bank employee does not verify your identity carefully, the scammer gains access.
Alternatively, a scammer might send you a phishing email that looks like it is from your bank, asking you to "verify your account" by clicking a link and entering your password. Once they have your password, they can log in and change your settings, authorize transfers, or add a new email address to your account.
Another tactic is the account takeover: the scammer uses your account number plus information from a data breach (your name, address, phone number, Social Security number) to convince your bank that they are you. They then request a wire transfer, change your mailing address, or set up bill pay to send money to an account they control.
How to respond if you see unauthorized ACH transfers
Contact your bank immediately—by phone, not by clicking a link in an email or text. Use the phone number on the back of your debit card or on your bank's official website. Tell them you see unauthorized ACH debits and ask them to reverse the transactions and block future transfers from the originating company.
Your bank should reverse the transfer within one to three business days if you report it quickly. Federal law (Regulation E) requires banks to investigate and refund unauthorized ACH transfers within 10 business days, though most do it faster. Do not wait—the longer you delay, the harder it becomes to recover the money.
Ask your bank to place a fraud alert on your account and to flag any unusual activity. Some banks will also issue you a new account number and debit card to prevent further unauthorized transfers from the same scammer.
File a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record and helps law enforcement track patterns of fraud.
When it is safe to give your account number
You should give your bank account number when you initiate the transaction yourself: paying a utility bill, making a loan payment, setting up direct deposit with your employer, or paying rent to a landlord you know. In these cases, you are controlling the transaction and the recipient is a known entity.
The key is that you started the conversation and chose the payment method. If someone calls you or emails you asking for your account number, do not give it—legitimate businesses do not ask for account numbers unsolicited.
If a business asks for your account number over the phone, ask them to send you a secure payment link or a mailing address where you can send a check. If they refuse and insist on the account number, hang up and call the business directly using a phone number from their official website.
Protecting your account number from future scams
Do not post photos of checks on social media or in emails—your account number and routing number are visible on the check. Do not give your account number to anyone who calls you, even if they claim to be from your bank. Your bank already has your account number; they will never ask for it.
Use strong, unique passwords for your online banking account. Enable two-factor authentication if your bank offers it. This means that even if a scammer has your password, they cannot log in without also having access to your phone or email.
Monitor your bank statements weekly, not just monthly. Set up account alerts through your bank's app so you are notified of any transfers over a certain amount. The faster you spot fraud, the faster you can dispute it.
If you receive a call or email asking you to verify your account information, hang up or delete it. Call your bank directly using the number on your card or statement. Do not use a phone number or link provided in the unsolicited message.
Frequently Asked Questions
Can someone open a bank account in my name using my account number?
No. Opening a new account requires a Social Security number, government-issued ID, and a signature. Your account number alone is not enough. However, if a scammer has your Social Security number and other identity information, they can open accounts in your name—so monitor your credit report and check for accounts you do not recognize.
What if the scammer has my account number and my name?
They can initiate ACH transfers, but you can dispute them. Contact your bank as soon as you see the unauthorized transfer, and they will reverse it. To prevent future transfers, ask your bank to block ACH debits from unknown companies or to require your approval before any ACH transfer is processed.
Is my bank responsible if someone steals money using my account number?
Yes, under Regulation E. Your bank must refund unauthorized ACH transfers within 10 business days if you report them. Your liability is usually zero if you report the fraud promptly. However, if you authorized the transfer (even under pressure or false pretenses), the bank may not reverse it—so be careful about what you agree to over the phone.
Should I close my account if my account number was compromised?
Not necessarily. Closing the account does not erase the fraud; it just stops future transfers. Instead, ask your bank for a new account number and debit card, and update any automatic payments (direct deposit, bill pay, subscriptions) with the new number. This gives you a fresh start without losing your banking history.
Can I get my money back if I gave my account number to a scammer?
Yes, if it was an ACH transfer. Report it to your bank within 60 days, and they will investigate and refund you if the transfer was unauthorized. If you voluntarily gave your account number and authorized the transfer (even under false pretenses), recovery is harder—you may need to file a police report and work with law enforcement.