Yes, but only certain things—and your bank account number alone is not enough for most scams
A scammer with your bank account number and routing number can set up unauthorized withdrawals from your account, but they cannot log in, change your password, or drain your account in one transaction without your bank's involvement. The real damage depends on what else they have: your name, address, and phone number turn a bank account number into a tool for ACH fraud. Your account number plus a forged check is a different threat. Your account number plus access to your email is yet another. The risk is real, but it is specific to the method the scammer chooses.
Your bank account number is printed on every check you write and is often visible to merchants and employers. It is not a secret like a password. This means exposure is common, but exposure alone does not mean your money is gone. Understanding what a scammer can actually do with it—and what they cannot—helps you know when to panic and when to simply monitor.
Key Takeaways
- A scammer needs your bank account number plus your routing number to initiate an ACH withdrawal, but your bank can reverse unauthorized transfers within a set window.
- Forged checks drawn on your account are a separate threat that moves slower but can clear before your bank catches them.
- Your account number alone cannot be used to log into online banking, change your password, or access your funds directly.
- Report unauthorized transactions to your bank within 60 days to preserve your right to a refund under federal law.
- Freezing your credit and monitoring your accounts are the fastest ways to stop new fraud after your account number is compromised.
ACH fraud: how a scammer uses your account number to pull money out
If a scammer has your bank account number, routing number, and name, they can attempt to set up an ACH (Automated Clearing House) transfer to pull money from your account. This is the most common scam using account numbers alone. They do not need your password or online banking access—they contact your bank or use a third-party payment processor and request a one-time withdrawal or recurring payment, claiming to be you.
Your bank processes ACH transfers on a delayed schedule, usually one to three business days. This delay is your protection: your bank has time to verify the request before the money leaves. If you catch the transaction before it clears, call your bank immediately and tell them it is unauthorized. If it has already cleared, you have up to 60 days from the date the transaction posted to file a dispute. Your bank must investigate and refund you if they find the transfer was fraudulent.
Some scammers use ACH fraud to test whether an account is active before attempting larger theft. A small unauthorized charge—$1 to $5—may appear on your statement. If you do not notice or report it, they know the account is monitored loosely and may escalate. Check your bank statements weekly, especially if your account number has been exposed.
Check fraud: forged checks drawn on your account
A scammer with your account number can print forged checks using your account details. They deposit these checks into their own account at a different bank. The check clears at the receiving bank within one to two business days, but your bank may not discover the forgery for five to seven business days—sometimes longer. By then, the scammer has withdrawn the money.
You are not liable for forged checks under federal law, but the process of recovering the money is slower than with ACH fraud. Your bank will reverse the transaction once they detect it, but you may see a temporary negative balance in your account while the investigation happens. If the scammer deposited the check at a bank with a fraud department that is responsive, your bank can sometimes recover the funds directly from the receiving bank. If the scammer used a prepaid card or money transfer service, recovery is much harder.
The best defense is to monitor your account daily and report any checks you did not write immediately. If your account number has been compromised, consider ordering new checks with a different account number or switching accounts entirely.
What a scammer cannot do with your account number alone
Your bank account number is not a password. A scammer cannot use it to log into your online banking portal, reset your password, or transfer money through your bank's website or app. They cannot see your balance, transaction history, or any other account details. If someone claims they can access your account with only your account number, they are lying or they have obtained additional information—such as your online banking password or answers to your security questions.
Your account number also cannot be used to make purchases at a store or online. Merchants need a credit card number, not a bank account number. If a scammer tries to use your account number as a payment method, the transaction will fail. This is why scammers who have your account number typically focus on ACH fraud or check fraud rather than point-of-sale theft.
When your account number becomes dangerous: what else the scammer needs
Your account number becomes a serious threat when combined with other information. If a scammer has your account number, routing number, name, and address, they can open a fraudulent account in your name at a different bank or attempt to change the address on your existing account. If they have your account number and your email address, they may be able to set up bill pay or recurring payments through your bank's website if they can reset your password using your email.
The most dangerous scenario is when a scammer has your account number and your Social Security number. With both, they can attempt to open new accounts, take out loans, or commit identity theft beyond your bank account. This is why data breaches that expose both pieces of information are treated as urgent.
If your account number has been exposed in a data breach or scam, check whether other personal information was also compromised. Your bank's fraud department can tell you what was accessed. If only your account number was exposed, the risk is limited to ACH fraud and check fraud. If your Social Security number or other identifying information was also exposed, you should place a credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to prevent new accounts from being opened in your name.
Steps to take if you discover unauthorized transactions
Call your bank immediately if you see a transaction you did not authorize. Do not wait for a statement to arrive. Tell the bank representative the specific transaction, the date it posted, and the amount. Ask them to reverse it and issue a new debit card if the old one was compromised. Write down the representative's name, the time of the call, and any reference number they provide.
Follow up with a written dispute letter within 60 days of the transaction posting. Include your account number, the transaction date, the amount, and a brief statement that the transaction was unauthorized. Send it to the address your bank provides for disputes—not to a general customer service address. Keep a copy for your records. Your bank must respond to your dispute within 30 days and resolve it within 90 days.
If the unauthorized transaction was an ACH withdrawal, file a dispute with your bank. If it was a forged check, also file a report with your local police department and the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. These reports create a paper trail that can help if the scammer targets other people.
Protecting your account after your number is compromised
If your account number has been exposed, ask your bank to issue a new account number and new debit card. This is free and takes one to two business days. Your direct deposits and automatic bill payments will need to be updated with the new number, so contact your employer and any services that withdraw from your account automatically.
Monitor your account for at least three months after the compromise. Set up account alerts through your bank's app or website to notify you of any transaction over a certain amount—$1 is reasonable if you want to catch test charges. Check your statement weekly, not just when the full statement arrives.
If your account number was exposed along with other personal information, place a fraud alert with the three credit bureaus. A fraud alert requires creditors to verify your identity before opening new accounts in your name. It is free and lasts one year. You can renew it if needed. If you believe your identity has been stolen, consider a credit freeze, which is more restrictive and prevents any new accounts from being opened without your explicit permission.
Frequently Asked Questions
Can someone withdraw money from my account if they only have my account number?
They can attempt to set up an ACH withdrawal if they also have your routing number and name, but your bank will process it on a delay and you can dispute it within 60 days. They cannot log in to your account or withdraw money instantly. If you see an unauthorized ACH transaction, call your bank immediately to stop it before it clears.
What should I do if I gave my account number to someone I thought was legitimate?
Call your bank right away and tell them you may have given your account number to a scammer. Ask them to watch for unauthorized ACH withdrawals and forged checks. Request a new account number and debit card. Monitor your account daily for the next three months. If unauthorized transactions appear, dispute them within 60 days.
Is my bank responsible if someone forges a check on my account?
Yes. Your bank is responsible for detecting forged checks and reversing them. You are not liable for forged checks under federal law. However, the process takes time—usually five to seven business days—and you may see a temporary negative balance while the investigation happens.
Can I get my money back if an ACH withdrawal was unauthorized?
Yes, if you report it within 60 days of the transaction posting. Your bank must investigate and refund you if they determine the withdrawal was fraudulent. Report it as soon as you see it on your statement—do not wait for the full statement to arrive.
Do I need to close my account if my account number was compromised?
Not necessarily. Closing your account is disruptive because you have to update direct deposits and automatic payments. Instead, ask your bank for a new account number and debit card, and monitor your old account for 60 days to catch any lingering fraud. You can close the old account after that if you want, but it is not required.