Yes, both numbers are sensitive, but the risk depends on what someone does with them

Your routing number and account number together identify your bank and your specific account. Someone who has both can set up automatic withdrawals from your account, redirect your direct deposits, or initiate wire transfers out. They cannot log into your account or change your password — that requires separate credentials — but they can move money without your permission if they have these two numbers alone.

The routing number by itself is not secret. It's printed on the bottom left of every check you write, published on your bank's website, and used by employers and government agencies to deposit money into your account. The account number is the sensitive piece. If someone has only your routing number, they cannot do much. If they have both, they can cause real damage.

The actual risk is lower than it sounds in practice, because banks have fraud detection systems and because most legitimate transactions require additional verification. But the potential is there, and you should treat both numbers as information you do not hand out casually.

Key Takeaways

  • Your routing number is public information found on checks and bank websites, but your account number should be treated as sensitive.
  • Someone with both numbers can initiate ACH transfers and automatic payments from your account without your permission.
  • They cannot access your account online, change your password, or see your balance without the account number alone.
  • Banks monitor for fraud and can reverse unauthorized transfers, but the process takes time and you may be temporarily short funds.
  • Sharing both numbers with a known business (employer, utility company, government agency) for direct deposit or bill payment is standard and safe.

What someone can actually do with both numbers

If a person has your routing number and account number, they can submit an ACH (Automated Clearing House) transfer request to pull money from your account. This is the same system your employer uses to deposit your paycheck and the same system utilities use to collect automatic payments. The difference is that they would be initiating the transfer without your permission.

They can also set up recurring automatic payments in your name — for subscriptions, loans, or services you never signed up for. These transactions go through the ACH network, which processes millions of transfers daily and does not require a password or PIN from the account holder.

What they cannot do: log into your online banking, see your balance, change your password, access your credit card information, or make purchases using your debit card. Those actions require separate login credentials or the physical card itself.

Why banks catch most of this before it becomes your problem

Banks use fraud detection software that flags unusual patterns — transfers to new recipients, amounts outside your normal range, timing that does not match your habits. If a transfer looks suspicious, the bank may block it before it goes through or reverse it shortly after.

You also have legal protection under the Electronic Funds Transfer Act. If you report an unauthorized ACH transfer within 60 days of the statement date, the bank must investigate and return the money in most cases. If you report it within two business days, your liability is capped at $50. After 60 days, your protection shrinks significantly.

The catch is that during the investigation — which can take 10 business days — the money is gone from your account. If the transfer was large, you may overdraft or miss payments while waiting for the reversal. This is why prevention matters more than recovery.

When it is safe to share both numbers

Sharing your routing and account numbers with legitimate businesses is standard and necessary. Your employer needs both to set up direct deposit. Your utility company, mortgage lender, and insurance company need both to collect automatic payments. Government agencies (Social Security, tax refunds, unemployment) need both to send you money.

The key is that you are initiating the relationship and you know what the transaction is for. You are telling your employer "deposit my paycheck here" or your electric company "pull my bill payment from this account." You control the amount, the frequency, and when it stops.

The risk comes from sharing the numbers with someone you do not know, someone you met online, or someone who contacts you unsolicited. If a stranger calls claiming to be from your bank or the IRS and asks for these numbers, hang up. Your bank already has them. The IRS does not call people out of the blue.

What to do if you think someone has your numbers

Call your bank immediately — use the number on the back of your card or your statement, not a number someone gives you. Tell them you believe your account information has been compromised. They can flag your account for fraud monitoring and watch for suspicious activity.

Ask your bank to issue you a new account number. This is different from closing the account. You keep the same routing number (it belongs to the bank, not you), but the account number changes, which stops anyone using the old number from pulling money out. Direct deposits and automatic payments tied to the old number will fail, so you will need to update those with your employer and billers.

Check your bank statements for the next 60 days for unauthorized transactions. If you see one, report it to your bank in writing (email or secure message through online banking) so you have a record of when you reported it. Keep copies of everything.

You do not need to close the account or open a new one at a different bank unless the fraud is severe or your bank is unresponsive. A new account number usually solves the problem.

Routing numbers are public by design

Your routing number is not secret because it does not need to be. It identifies your bank's location and branch, not your account. Thousands of people may share the same routing number if they bank at the same branch. It appears on every check you write, on your bank's website, and in public directories that employers and government agencies use.

Someone who has only your routing number cannot access your account or move your money. They would need your account number to do that. This is why banks separate the two — the routing number is the address, the account number is the lock.

If you see your routing number posted somewhere (a bank website, a check image, a public record), that is normal and not a security breach. Treat it the way you would treat your mailing address — useful information, but not sensitive on its own.

How to protect both numbers going forward

Do not write checks to people you do not know. Every check you write displays both your routing and account number. If you must pay someone unfamiliar, use a money order or cashier's check instead, which does not expose your account information.

Do not photograph or screenshot your checks and send them by email or text. If you need to provide banking information to set up direct deposit, use your bank's official form or call the organization and ask for a secure way to submit the information.

Be cautious with online bill pay. Only set up automatic payments with companies you recognize and trust. If you are unsure whether a company is legitimate, call their main customer service line (not a number from an email) and ask them to walk you through the process.

Monitor your statements. Most banks let you set up alerts for transactions over a certain amount or for any ACH transfer. These alerts give you a chance to catch fraud quickly.

Frequently Asked Questions

Can someone open a credit card or loan in my name using just my routing and account numbers?

No. Opening a credit account requires a Social Security number, date of birth, and a hard credit inquiry. Your routing and account numbers alone cannot do this. Identity theft requires more personal information than just your banking details.

Is it safe to put my account number on a check?

Yes, checks are designed to display your account number. The risk comes from checks being lost, stolen, or intercepted in the mail. If you are mailing a check, use a secure mailbox or hand it directly to the recipient. Do not leave checks in an unsecured location.

What if my bank says they cannot issue a new account number?

Most banks can and will issue a new account number if you report a compromise. If your bank refuses, ask to speak to a supervisor or contact your state's banking regulator. You have the right to protect your account this way. If the bank remains uncooperative, consider moving your account to a bank that takes fraud prevention seriously.

Do I need to report a compromised account to the police or credit bureaus?

Report it to your bank first — that is the priority. If the fraud involves identity theft (someone opening accounts in your name), then report it to the Federal Trade Commission at IdentityTheft.gov and consider placing a fraud alert with the credit bureaus. For ACH fraud alone, your bank's fraud department is usually sufficient.

Can I get my money back if someone makes an unauthorized transfer?

Yes, if you report it within 60 days of the statement date. Your liability is $50 if you report within two business days, up to $500 if you report between two and 60 days. After 60 days, you may have no protection. Report suspected fraud immediately.