A check alone is not enough to drain your account, but the information printed on it can be

A single check in someone else's hands does not automatically give them access to your checking account. They cannot log in, cannot transfer money out, and cannot change your password. But the routing number, account number, and your name printed on that check are real banking details—and a scammer who has them can attempt to withdraw money by creating fake checks, setting up unauthorized ACH transfers, or opening accounts in your name. The damage depends on what else they know and how quickly you notice.

The most common attack is check fraud: a scammer uses the numbers from your check to print counterfeit checks or alter a real one, then cashes or deposits them at a bank or check-cashing service. This can happen weeks or months after you lose the check. The second risk is ACH fraud, where someone uses your routing and account number to pull money directly from your account without your permission—often by setting up a fake bill payment or payroll deduction. Both are recoverable, but recovery takes time and requires you to act.

Key Takeaways

  • A check contains your routing number, account number, and name—enough for a scammer to attempt check fraud or unauthorized ACH withdrawals.
  • You are not liable for fraudulent checks or ACH transfers if you report them within 60 days of your statement, though banks may dispute this and require proof.
  • Check with your bank immediately if you lose a check or suspect one has been stolen; many banks can flag your account or issue a new account number.
  • Counterfeit checks can clear in one to three business days, so monitor your account regularly and set up low-balance alerts if your bank offers them.
  • If a fraudulent check or ACH transfer posts, file a dispute with your bank in writing and request a chargeback or reversal within the first week.

How a scammer uses check information to commit fraud

The routing number and account number on your check are printed in a standardized format at the bottom left. A scammer with access to a check can use these numbers in several ways. The simplest is to print counterfeit checks using the same numbers and your name, then deposit or cash them at a different bank or check-cashing service. Because the numbers are real, the checks may clear before the fraud is detected—sometimes within one to three business days.

The second method is ACH fraud. ACH (Automated Clearing House) is the system banks use to move money between accounts. A scammer with your routing and account number can attempt to set up an ACH debit—a one-time withdrawal or recurring payment—without your permission. They might pose as a utility company, a subscription service, or a payday lender. If the ACH goes through, the money leaves your account immediately, though you can dispute it later.

A third, less common but serious risk is identity theft. A scammer with your name, address, and banking details can attempt to open new accounts, take out loans, or apply for credit in your name. This is why losing a check is treated as a potential identity theft risk, not just a check fraud risk.

What your bank will and will not cover

Federal law protects you from unauthorized ACH transfers and fraudulent checks, but the protection has conditions and timelines. Under Regulation E (which covers electronic transfers), you are not liable for unauthorized ACH debits if you report them within 60 days of your statement. If you report after 60 days, your liability can be unlimited. For fraudulent checks, the law is less clear—banks are required to exercise "ordinary care" in detecting counterfeits, but what counts as ordinary care varies by bank and by state.

In practice, most banks will reverse a fraudulent check or ACH transfer if you report it quickly and provide documentation. But some banks will push back, especially if the check cleared at another bank or if the ACH transfer went to a third party. The bank that cashed the counterfeit check (the receiving bank) may refuse to reverse it, claiming the depositor was at fault. You may end up in a dispute between two banks, with your bank eventually covering the loss but only after weeks of back-and-forth.

The key is to report the fraud in writing within 60 days. A phone call to your bank starts the process, but follow it with a written dispute letter that includes the check number, the amount, the date it posted, and a clear statement that you did not authorize it. Keep a copy for your records.

Steps to take if you lose a check or suspect fraud

If you lose a check or realize one is missing, contact your bank immediately—do not wait for your statement. Call the fraud department and tell them the check number, the amount you wrote it for (if you remember), and the date. Ask the bank to flag your account and monitor for unauthorized activity. Many banks can issue you a new account number and routing number, which invalidates the old check and makes it harder for a scammer to use the stolen information.

If you discover a fraudulent check or ACH transfer has already posted, act within the first week. Log into your account and take a screenshot of the transaction. Call your bank's fraud line and file a dispute over the phone, then send a written dispute letter within 10 days. Include the transaction details, a statement that you did not authorize it, and any supporting evidence (such as proof you were not in the location where the check was cashed, or proof you never signed up for the service that initiated the ACH).

While the dispute is pending, ask your bank whether the funds will be returned to your account temporarily. Some banks will credit your account within one to three business days while they investigate; others will not. If the funds are not returned and you need the money, you may have to contact the receiving bank directly and ask them to reverse the transaction on their end.

Preventing check fraud before it happens

The most effective prevention is to not let checks out of your control. If you mail a check, use a secure mailbox or hand it directly to the recipient. Do not leave checks in an unsecured mailbox or give a check to someone you do not trust. If you are paying a bill by check, consider using your bank's bill pay service instead—it is faster, more secure, and leaves no physical check for someone to intercept.

If you must use checks, order them from your bank rather than from a third-party printer. Bank-issued checks often have security features (watermarks, microprinting, security threads) that make them harder to counterfeit. Store unused checks in a locked drawer or safe, not on a desk or in a bag.

Monitor your account regularly. Log in at least once a week and look for transactions you do not recognize. Set up low-balance alerts if your bank offers them—if your balance drops below a threshold you set, the bank will send you a text or email. This can alert you to fraud within hours rather than days. If you notice a suspicious transaction, report it immediately; the sooner you report, the better your chances of a full reversal.

What to do if the receiving bank refuses to reverse the fraud

If the bank that cashed the counterfeit check refuses to reverse it, or if your bank refuses to credit your account, you have options. First, escalate the dispute within your bank. Ask to speak to a supervisor in the fraud department and explain that you reported the fraud within 60 days and that federal law requires the bank to cover unauthorized transactions. Provide copies of your written dispute letter and any supporting evidence.

If your bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can pressure a bank to reverse a fraudulent transaction. You can also contact your state's banking regulator or attorney general's office, though these agencies move more slowly than the CFPB.

For small amounts (under $5,000 or $10,000, depending on your state), you may be able to sue the bank in small claims court. Bring your written dispute letter, your bank statements, and any evidence that you reported the fraud on time. The burden is on the bank to prove they exercised ordinary care in detecting the counterfeit check.

Frequently Asked Questions

Can someone open a bank account with just my check?

Unlikely, but possible. Most banks require a government ID and a Social Security number to open an account. A check alone does not provide either. However, a scammer with your check plus other personal information (your address, date of birth, Social Security number) can attempt to open an account in your name. This is why losing a check is treated as an identity theft risk.

How long does it take for a counterfeit check to clear?

One to three business days, sometimes longer. The receiving bank may hold the check for a few days before depositing it into the scammer's account. Your bank may not discover the counterfeit until weeks later, when the receiving bank sends it back for verification. By then, the scammer has usually withdrawn the money.

Will my bank refund me if I report the fraud after 60 days?

Possibly, but you lose legal protection. Under Regulation E, you have 60 days from your statement to report unauthorized ACH transfers. For checks, there is no hard deadline, but banks may refuse to reverse the transaction if you wait too long. Report any suspected fraud as soon as you notice it.

What if the scammer used my check to set up a recurring ACH payment?

Report it to your bank immediately and ask them to block any future ACH debits from that company or account. You can also file a dispute for each unauthorized debit. If the scammer set up the ACH under a fake company name, your bank may be able to trace the receiving account and report it to law enforcement.

Should I close my checking account if a check is stolen?

Not necessarily. Closing the account does not erase the routing and account number—they are already in the scammer's hands. Instead, ask your bank to issue you a new account number and routing number. This invalidates the old check and makes it harder for the scammer to use the stolen information. Keep the old account open long enough to monitor for any remaining fraudulent activity, then close it once you are confident the fraud has stopped.