Yes, but only if they also have other information

A bank account number alone—without your name, routing number, or other identifying details—is not enough for someone to drain your account or make unauthorized transfers. Banks use multiple pieces of information to verify your identity before moving money. However, if a hacker has your account number and routing number together, they can set up unauthorized ACH transfers or bill payments in your name. If they also have your online banking password or access to your email, the risk becomes much higher.

The real danger depends on what else they have. A number by itself is like having someone's street address—it tells you where they live, but you still need keys to get inside. What matters is whether the hacker also holds the keys: your password, your phone number for two-factor authentication, answers to security questions, or access to your email account.

Key Takeaways

  • Your account number alone cannot be used to transfer money out of your account, but combined with your routing number it can be used to set up ACH transfers or bill payments.
  • Hackers who have your password or access to your email can change your account settings, add new payees, or reset your password entirely.
  • If you discover unauthorized activity, contact your bank immediately—federal law limits your liability to $50 if you report within two business days, and $500 if you report within 60 days.
  • Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) prevents someone from opening new accounts in your name, even if they have your account number.

What hackers can do with just your account and routing numbers

With both your account number and routing number, someone can initiate an ACH (Automated Clearing House) transfer from your account to theirs. ACH transfers are the same system used for direct deposit and bill payments—they move money between bank accounts electronically. The hacker does not need your password to start this process; they only need those two numbers and your name as it appears on the account.

The same numbers allow someone to set up bill payments or recurring charges in your name. They can register for online services, authorize subscriptions, or create payment arrangements with utilities or creditors. Many companies verify ACH payments using only the account number, routing number, and account holder's name.

However, most banks have fraud detection systems that flag unusual activity. If you have never sent money to a particular account before, or if the transfer amount is unusually large, your bank may block it or call you to verify. This is why many unauthorized ACH transfers are caught before they complete.

How the risk grows when hackers have more information

If a hacker also has your online banking password, they can log into your account directly and move money without waiting for an ACH transfer to process. They can change your contact information, add new payees to your account, set up bill pay to unfamiliar addresses, or transfer funds to accounts you do not recognize. They may also change your password, locking you out of your own account.

Access to your email account multiplies the danger. Most banks send password reset links to your email address. If a hacker controls your email, they can request a password reset, gain access to your bank account, and lock you out. They can also intercept two-factor authentication codes sent to your email, bypassing that security layer entirely.

If the hacker has your phone number and can convince your mobile carrier to transfer your number to a new SIM card they control, they can intercept text messages containing one-time codes. This attack, called SIM swapping, is less common but extremely effective because it bypasses most two-factor authentication methods.

Steps to take immediately if your account number has been compromised

Contact your bank as soon as you discover the breach. Call the number on the back of your debit card or on your bank statement—not a number from a search result or email. Tell them your account number may have been compromised and ask them to monitor for unauthorized activity. Many banks will place a temporary fraud alert on your account or flag it for manual review of large transactions.

Change your online banking password immediately, using a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Do not reuse passwords from other accounts. If you use the same password on multiple websites, change those too.

Check your recent transactions for anything you do not recognize. Look for small test charges (hackers often send $1 or $2 to verify the account works before attempting larger transfers), recurring charges you did not authorize, or transfers to unfamiliar accounts. Report each one to your bank.

Enable or strengthen two-factor authentication on your bank account. Most banks offer this through their app or website settings. Choose authentication methods that do not rely on text messages if possible—app-based authentication or hardware security keys are more secure than SMS.

Understanding your liability for unauthorized transfers

Federal law (Regulation E) limits your liability for unauthorized electronic transfers. If you report the unauthorized activity within two business days of discovering it, your liability is capped at $50. If you report it between two and 60 days, your liability increases to $500. If you wait more than 60 days, you may be liable for the full amount stolen.

This protection applies to transfers initiated through ACH, bill pay, or online banking. It does not cover checks or debit card fraud (which has different rules). Your bank must investigate your claim and return the money if they determine the transfer was unauthorized.

Document everything: the date you discovered the fraud, the date you reported it to your bank, the name of the person you spoke with, and the reference number they provided. Keep copies of emails, call logs, and written correspondence. If your bank disputes your claim, you will need this documentation to prove you reported promptly.

Protecting yourself after a breach

Freeze your credit with all three major credit bureaus: Equifax, Experian, and TransUnion. A credit freeze prevents anyone from opening new accounts in your name, even if they have your account number and other personal information. You can place a freeze online at each bureau's website at no cost. The freeze is free and can be lifted or temporarily thawed whenever you need to open a legitimate account.

Consider placing a fraud alert with the bureaus instead if you prefer not to freeze your credit. A fraud alert requires creditors to verify your identity before opening new accounts, which slows down the process but does not prevent it entirely. Fraud alerts last one year and can be renewed.

Monitor your credit reports for accounts you do not recognize. You can view your credit report free once per year at AnnualCreditReport.com (the official site run by the three bureaus). Look for new credit cards, loans, or inquiries you did not authorize. Report any fraudulent accounts to the bureau that listed them.

If your Social Security number was also compromised, consider registering with the IRS's Identity Protection PIN program. This assigns you a unique PIN that you must provide when filing taxes, preventing someone from filing a fraudulent return in your name.

What to do if unauthorized transfers have already happened

Report the fraud to your bank in writing as well as by phone. Send a certified letter to the address listed on your bank statement, describing each unauthorized transfer, the date it occurred, and the amount. Keep a copy for your records. Written documentation creates an official record that your bank must respond to within specific timeframes.

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and generates a recovery plan specific to your situation. You can also file a police report if the amount stolen is significant, though many local police departments will not investigate bank fraud directly.

If the unauthorized transfers were part of a larger data breach (a retailer, employer, or service you use was hacked), check whether that organization has set up a claims process or settlement fund. Some breaches result in class action lawsuits or settlements that compensate victims.

Keep copies of all correspondence with your bank, the credit bureaus, and law enforcement. Banks must respond to fraud claims within 10 business days with a preliminary investigation and within 45 days with a final information. If they determine the transfer was unauthorized, they must return the money.

Frequently Asked Questions

Can someone use my account number to make a purchase online?

Not directly. Online retailers use credit card numbers or digital payment systems like PayPal, not bank account numbers. However, if someone has your account number and routing number, they can set up a bill payment or ACH transfer to pay for something, or they can use it to register for services that charge your account monthly.

What if I gave my account number to someone and now I'm worried?

Monitor your account closely for the next 30 to 60 days. Look for unauthorized ACH transfers, bill payments, or recurring charges. If nothing appears within that window, the risk is lower. If you see anything suspicious, report it to your bank immediately. You can also contact your bank proactively and ask them to flag your account for manual review of large or unusual transactions.

Will my bank refund me if someone steals money using my account number?

Yes, if you report it within 60 days. Federal law requires banks to return unauthorized electronic transfers. If you report within two business days, your liability is capped at $50. Report between two and 60 days, and your liability is capped at $500. After 60 days, you may lose the full amount.

Is it safe to give my account number to my employer for direct deposit?

Yes. Your employer needs your account number and routing number to set up direct deposit, and this is a standard, secure practice. Your employer's payroll system is designed to handle this information safely. The risk only increases if your employer's systems are breached or if you give your account number to someone claiming to be from your employer but is actually a scammer.

What's the difference between my account number and my routing number?

Your routing number identifies your bank (it is the same for all customers at that bank). Your account number identifies your specific account within that bank. Together, they form the information needed for ACH transfers and bill payments. Neither one alone is enough to move money, but together they are the standard way to authorize electronic transfers.