Your account number alone is not enough to drain your account, but it is part of what a thief needs

A bank account number by itself cannot be used to withdraw money or transfer funds. Banks require additional verification—usually your PIN, online password, or a second form of identification—before processing any transaction. However, your account number is valuable to a thief because it is one piece of a larger puzzle. Combined with your name, address, or routing number, it can be used to set up unauthorized transfers, create fraudulent checks, or establish false payment arrangements.

The real risk is not that someone will drain your account with the number alone. The risk is that they will use it as a starting point to gather more information or to commit specific types of fraud that do not require your password.

Key Takeaways

  • Your account number cannot be used to withdraw cash or transfer money without additional verification like a PIN or password.
  • A thief can use your account number to set up unauthorized ACH transfers, create fake checks, or establish payment arrangements in your name.
  • The most common fraud involving account numbers is ACH fraud, where someone initiates a transfer from your account to theirs using only your account and routing numbers.
  • If you discover unauthorized activity, contact your bank immediately and file a dispute within 60 days to receive fraud protection under federal law.
  • You can reduce risk by not sharing your account number unnecessarily and by monitoring your statements regularly for unfamiliar transactions.

What a thief can do with your account number

The most common fraud involving an account number is ACH fraud—Automated Clearing House transfers initiated without your permission. A thief needs only your account number and routing number (both printed on the bottom of your checks) to set up a transfer from your account to theirs. They do not need your password or PIN. The transfer may take one to three business days to process, which gives you a window to catch it, but the money leaves your account before you notice.

A thief can also use your account number to create fraudulent checks or to set up bill payment arrangements in your name. Some utilities and creditors will accept a verbal authorization or written request with just an account number and name. A thief might call your electric company, for example, and authorize a large payment from your account to settle a fake past-due balance.

Your account number can also be sold to other criminals or used to target you for phishing scams. Once someone has your account number, they may contact you posing as your bank and ask for your password or PIN under the pretense of "verifying" the account.

How to know if your account number has been compromised

Check your bank statements regularly—at least weekly if possible—for transactions you do not recognize. ACH transfers and unauthorized bill payments will appear as debits on your statement. Look for transfers to unfamiliar names or accounts, payments to companies you do not use, or amounts that seem unusual.

Many banks offer free transaction alerts. You can set up notifications for any transfer over a certain amount, any ACH debit, or any payment to a new payee. These alerts arrive by text or email within minutes of the transaction and can help you catch fraud before it spreads. Log into your online banking portal and look for "alerts," "notifications," or "fraud prevention" settings.

If you receive bills or statements from accounts you did not open, or if creditors contact you about debts you do not recognize, your account number may have been used as part of a larger identity theft. Report this to your bank and to the Federal Trade Commission at IdentityTheft.gov.

What to do if unauthorized transactions appear

Contact your bank immediately by phone. Do not use email or online chat for fraud reports—call the number on the back of your card or on your statement. Tell the representative that you have unauthorized transactions and ask them to freeze your account or block further ACH transfers while they investigate.

Your bank will likely reverse the fraudulent transaction, but you must file a formal dispute within 60 days of the statement date on which the transaction appears. Under the Electronic Funds Transfer Act, your bank is required to return the money while they investigate, though the process can take up to 10 business days. If the bank denies your dispute, you have the right to request a written explanation and to escalate the complaint to your state banking regulator.

Ask your bank to reissue your debit card and to generate a new account number if possible. Some banks will do this automatically after fraud; others require you to request it. A new account number prevents the thief from using the old one for future transfers.

Steps to reduce the risk of account number fraud

Do not share your account number unless you initiated the transaction and trust the recipient. Legitimate companies you do business with already have your account number on file. If someone calls you asking for it, hang up and call the company directly using the number on your bill or website.

Shred paper checks and statements before throwing them away. Your account and routing numbers are printed on every check, and dumpster diving is a real source of account information for thieves.

Use your bank's bill pay system instead of mailing checks or giving your account number to new vendors. Most banks' bill pay services do not expose your account number to the payee—the bank processes the payment on your behalf.

Enable multi-factor authentication on your online banking account. This means your bank will require a second verification step (usually a code sent to your phone) before allowing login or large transactions. Even if a thief has your account number and password, they cannot access your account without this second factor.

Monitor your credit report for signs that someone has opened accounts in your name. You can view your credit report for free once per year at AnnualCreditReport.com. If you see accounts you did not open, dispute them with the credit bureau and notify the creditor.

The difference between account number fraud and account takeover

Account number fraud (using your account number to initiate transfers or payments) is different from account takeover (a thief logging into your account with your password). Account takeover is more serious because the thief has full access to your account and can change your password, lock you out, and move all your money. Account number fraud is limited to what can be done without a password—mainly ACH transfers and bill payments.

If you suspect account takeover, change your password immediately from a different device (not the computer or phone that may be compromised). Then contact your bank by phone to report the breach and ask them to review recent login activity. Your bank can see the IP addresses and devices used to access your account and can tell you whether unauthorized logins occurred.

How banks protect accounts from number-based fraud

Most banks now require additional verification for ACH transfers, especially to new accounts. When you set up a transfer to a payee for the first time, your bank may require you to verify the payee's name and account number, or to wait 24 hours before the transfer processes. This delay gives you time to cancel if you did not authorize it.

Some banks use Positive Pay, a service that lets you pre-authorize which checks and ACH transfers are legitimate. Any transaction that does not match your pre-authorized list is flagged and held for your review. This service is more common for business accounts but is available to some personal account holders.

Banks are also required by federal law to investigate fraud reports within 10 business days and to return your money while the investigation is ongoing. If the bank finds that you were negligent (for example, you wrote your PIN on a check), they can limit your liability, but they cannot deny your claim entirely.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

No. Opening a new account requires a government ID, Social Security number, and proof of address. Your account number alone is not enough. However, if a thief has your account number plus other personal information (name, address, date of birth), they may be able to open an account and use it to receive fraudulent transfers from your account.

What if my account number was exposed in a data breach?

Monitor your statements closely for unauthorized ACH transfers and bill payments. Consider enabling transaction alerts for any debit over a small amount. You do not need to close your account unless your bank recommends it. If fraudulent activity appears, report it to your bank within 60 days of the statement date to receive fraud protection.

Is my account number the same as my routing number?

No. Your routing number identifies your bank (it is the same for all customers at that bank), while your account number identifies your specific account. Both numbers appear on the bottom left of your checks. A thief needs both to set up an ACH transfer, but both are printed on every check you write.

Can I get my money back if someone uses my account number to make unauthorized transfers?

Yes. Federal law requires your bank to return the money while they investigate, though the process can take up to 10 business days. You must report the fraud within 60 days of the statement date. If your bank denies your dispute, you can escalate to your state banking regulator or file a complaint with the Consumer Financial Protection Bureau.

Should I close my account if my account number was compromised?

Not necessarily. Closing the account may actually make fraud harder to detect. Instead, ask your bank to issue a new account number and to monitor the old account for activity. If fraudulent transfers continue, then closing the old account and opening a new one makes sense. Your bank can help you decide based on the type and extent of fraud.