Yes, but only under specific conditions

A checking account number alone—without your routing number—is not enough for someone to drain your account. But a checking account number paired with your routing number (the nine-digit code that identifies your bank) is enough for a thief to set up unauthorized ACH transfers or create fraudulent checks. The risk is real, but it is not automatic: the thief needs either your routing number or access to your bank's systems, and they need to know what they are doing.

The most common theft route is not someone using your account number directly. It is someone using your account details to pose as you when they contact your bank, or using your information to set up bill pay through your bank's website after they have already compromised your email or online banking password. A checking account number by itself, sitting in a data breach or written on a check you handed to someone, creates risk—but it is a slower, more detectable risk than you might think.

Key Takeaways

  • Your checking account number alone cannot be used to transfer money out, but combined with your routing number it can be used to create ACH transfers or fraudulent checks.
  • The most dangerous scenario is when a thief has both your account number and routing number, plus access to your email or online banking login.
  • Checks you write or receive contain both your account number and routing number printed on them, making them a common source of theft information.
  • If you discover unauthorized transfers or checks, report them to your bank within 60 days to receive full fraud protection under federal law.
  • Freezing your account or closing it entirely stops new fraud but does not reverse transfers already made—your bank must do that.

What a thief can do with account number and routing number

With both pieces of information, a thief can initiate an ACH transfer (Automated Clearing House transfer) out of your account. ACH is the system banks use for direct deposit, bill pay, and peer transfers. It is designed to be automated and low-friction, which means it is also designed to be hard to stop once it has started. A thief can log into a third-party bill pay service, enter your account and routing number as if they were paying a bill, and move money to an account they control.

They can also create fraudulent checks using your account number and routing number. The routing number and account number are printed on every check you write. If someone has a check you wrote, or if they obtain this information from a data breach, they can print counterfeit checks in your name and cash them. This is slower than ACH but harder to trace quickly because it moves through the physical check system.

A third route is bill pay fraud: if a thief has compromised your email and your bank's website password, they can log into your online banking and set up bill pay transfers to themselves. This requires more access than just your account number, but it is worth knowing because it is the most common form of checking account theft in practice.

Why account number alone is not enough

Your checking account number identifies your account within your bank, but it does not identify your bank to the outside world. The routing number does that. Without the routing number, a thief cannot initiate an ACH transfer because the ACH system will not know which bank to pull the money from. They could theoretically contact your bank directly and try to convince someone to move money, but that requires social engineering—pretending to be you—which is a separate crime and carries more risk of being caught.

This is why data breaches that include only account numbers are less immediately dangerous than breaches that include both account numbers and routing numbers. It is also why your routing number is printed on every check and is not considered secret information—it is public by design. Your account number, by contrast, should be treated as sensitive.

How thieves get both pieces of information

The most common source is a check you wrote or received. Every check contains your routing number and account number printed at the bottom in magnetic ink. If you throw away a check without shredding it, or if you write a check to someone you do not fully trust, that person now has both numbers.

Data breaches are another source. When a retailer, healthcare provider, or other business is hacked, thieves sometimes obtain customer banking information including account and routing numbers. Large breaches are often reported in the news, but smaller ones may not be. If you have given your checking account information to a business for a one-time payment or recurring bill, that business is a potential source of exposure.

A third source is phishing emails or fake websites. If you enter your banking information into a fake bank website or respond to a phishing email asking for account details, a thief now has what they need. This is why your bank will never ask for your full account number via email or phone.

What happens when unauthorized transfers occur

If you notice an unauthorized ACH transfer or fraudulent check, your first step is to contact your bank immediately—do not wait. Tell them the specific transaction, the date, and the amount. Ask them to reverse it and to freeze your account to prevent further transfers.

Under the Electronic Funds Transfer Act, you have up to 60 days from the date the unauthorized transfer appeared on your statement to report it. If you report within two business days, your liability is capped at $50. If you report between two and 60 days, your liability can be up to $500. If you wait longer than 60 days, you may lose all protection and be liable for the full amount.

For fraudulent checks, the timeline is different. You have up to one year from the date the check was presented to your bank to report it as fraudulent. However, the sooner you report, the better your chances of recovery, because the money may still be in the fraudster's account or in transit.

Your bank will investigate, but investigation takes time—usually two to four weeks. During that time, the money is typically frozen in both your account and the receiving account. Once the bank confirms the fraud, they will reverse the transfer and credit your account. If the receiving bank is different from yours, the process may take longer.

Steps to take if your account number is compromised

If you know or suspect that your account number and routing number have been exposed, you do not need to close your account immediately. Instead, take these steps in order:

  1. Contact your bank and tell them your information may have been compromised. Ask them to flag your account for fraud monitoring and to watch for unusual activity.
  2. Review your recent statements carefully for any transfers or checks you did not authorize. Pay special attention to small transfers, which thieves sometimes use to test whether they can move larger amounts.
  3. Consider placing a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) if you are concerned about identity theft beyond just your checking account. A fraud alert makes it harder for someone to open new accounts in your name.
  4. If you discover actual fraud, report it to your bank and file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that can help if the thief opens other accounts in your name.
  5. If fraud continues or if you feel your account is no longer secure, close it and open a new one. Your bank can transfer your direct deposits and automatic bill payments to the new account.

Closing your account is not necessary just because your account number is known. It is necessary if you have experienced actual fraud and you do not trust that your bank has stopped it, or if you are concerned that your online banking password has also been compromised.

Protecting your account number going forward

Treat your account number the way you treat your Social Security number: do not give it out unless you initiated the contact and you know exactly why you are giving it. When you write checks, do not leave them in an unsecured mailbox for long periods. When you receive bills or statements, shred them before throwing them away.

For online payments, use your bank's bill pay feature rather than giving your account number directly to vendors when possible. Your bank's bill pay system is more secure than handing your information to a third party. If a business insists on having your account number for a one-time payment, ask whether they can accept a credit card or debit card instead.

Monitor your statements regularly—at least once a week if possible. Most banks offer free online access to your account, and many allow you to set up alerts for transfers over a certain amount. Use these tools. The faster you catch fraud, the faster you can report it and the more likely you are to recover the money.

Frequently Asked Questions

Can someone use my account number to make a purchase online?

Not directly. Online retailers use credit cards or debit cards, not checking account numbers. If someone has your debit card number, they can make purchases, but that is different from having your account number. However, if they have your account number and routing number, they can use them to set up bill pay or ACH transfers, which is a different kind of theft.

What if I see a small unauthorized transfer—should I report it?

Yes, report it immediately. Thieves often test accounts with small amounts ($1 to $10) to see if the fraud will be detected. If it is not, they move larger amounts. Reporting a small transfer shows your bank that you are monitoring your account and gives them a chance to stop larger fraud before it happens.

How long does it take to get my money back after I report fraud?

Most banks complete fraud investigations within two to four weeks. Once they confirm the transfer was unauthorized, they credit your account immediately. However, if the receiving bank is different from yours, or if the money has already been withdrawn, recovery can take longer or may not be possible. Report fraud as soon as you notice it.

Do I need to close my account if my account number was in a data breach?

Not necessarily. A data breach that includes your account number is concerning, but it is not an automatic reason to close your account. Monitor your statements closely and ask your bank to flag your account for fraud monitoring. Close your account only if you experience actual fraud that your bank cannot stop, or if your online banking password has also been compromised.

What if the thief opened a new bank account using my information?

That is identity theft, not just account fraud. Report it to the Federal Trade Commission at IdentityTheft.gov and place a fraud alert with the credit bureaus. Contact the bank where the fraudulent account was opened and ask them to close it. Keep documentation of everything for your records.