A checking account number alone is not enough to withdraw money, but it creates real risk

Someone who has only your account number—without your routing number, name, or online login—cannot walk into a bank and pull cash out. Banks require multiple pieces of information to process a withdrawal, and a single number is not one of them. However, a checking account number in the wrong hands does open doors to fraud that can drain your account or damage your credit. The risk depends on what else the person has and what they do with the number.

The most common threat is not a withdrawal at the teller window. It is unauthorized ACH transfers (electronic transfers between bank accounts), fraudulent checks written against your account, or the number being sold to other criminals. Each of these requires different information and creates different damage. Understanding what actually requires your account number—and what requires more—helps you know when to act.

Key Takeaways

  • Your account number alone cannot be used to withdraw cash at a bank or ATM, because banks require additional verification like your ID, PIN, or online login credentials.
  • A criminal with your account number and routing number can attempt ACH transfers out of your account or create fraudulent checks, which are the real risks to watch for.
  • If your account number is compromised, contact your bank immediately to report it and ask them to flag your account for suspicious activity.
  • Monitoring your bank statements weekly and setting up low-balance alerts can catch unauthorized transfers before they drain your account.
  • Your bank is required to refund most unauthorized ACH transfers and fraudulent checks if you report them within the timeframe stated in your account agreement.

What a criminal needs to actually withdraw your money

To withdraw cash from your checking account at a bank branch, a criminal would need a photo ID matching the account holder's name, or they would need your online banking password and a way to bypass two-factor authentication. Your account number alone does neither. Tellers verify identity before processing any withdrawal, and that verification is the main barrier.

At an ATM, the criminal would need your debit card and your PIN. Again, the account number is not enough. The card and PIN are what unlock access to the cash machine.

The real vulnerability is not the teller window or the ATM. It is electronic transfers and check fraud, both of which can happen without the criminal ever walking into a bank or knowing your name.

How your account number is actually used in fraud

The most common fraud involving a checking account number is an ACH transfer—an electronic movement of money from one bank account to another. If a criminal has your account number and routing number, they can attempt to pull money out of your account by setting up an ACH debit. They do not need your password or your permission. The transfer goes through unless your bank catches it or you stop it.

The second common method is check fraud. If someone has your account number, they can print counterfeit checks with that number on them and write checks against your account. The checks do not have to look like your real checks. They just need the correct account and routing numbers. When the check clears, the money leaves your account.

A third risk is that your account number gets sold to other criminals or used to open new accounts in your name. This is less direct but can cause months of damage.

What to do if your account number has been compromised

Call your bank immediately. Tell them your account number has been compromised and ask them to flag your account for suspicious activity. Some banks will close your current account and issue you a new account number on the spot. Others will monitor it for a period and close it if fraud appears. Ask which approach they are taking.

Request that your bank send you a new debit card if you have one. If you use checks, ask whether you should stop ordering new ones or whether your bank can reissue checks with a new account number.

Review your bank statements for the past 30 to 60 days. Look for ACH transfers you did not authorize, checks you did not write, or withdrawals you do not recognize. If you find unauthorized activity, report it to your bank in writing (email or secure message through your online banking portal). Keep a copy of your report.

How banks handle unauthorized transfers and fraudulent checks

Under the Electronic Funds Transfer Act, your bank must refund unauthorized ACH transfers if you report them within 60 days of the statement date on which the transfer appeared. If you report after 60 days, the bank may still refund it, but they are not required to. Some banks have longer windows—check your account agreement or ask.

Fraudulent checks are handled under different rules. Your bank must refund a check written against your account without your authorization, but the timeline and process vary by bank. Generally, you have up to one year to report a forged check, though reporting sooner is always better. The bank will investigate and either refund you or explain why they believe the check was valid.

In both cases, the bank's investigation takes time—usually two to four weeks. During that time, the money may remain out of your account. If you need access to those funds immediately, ask your bank whether they can provide a provisional credit while they investigate.

Protecting your account number going forward

Your account number appears on every check you write and on statements you receive. It is not a secret. Treat it the way you would treat information printed on a piece of paper—it can be seen by anyone who handles that paper. Do not email it, text it, or post it online.

If you need to give your account number to someone (a payroll department, a utility company, a creditor), do it in person, by phone to a number you know is correct, or through a secure online portal. Do not give it to someone who calls you claiming to be from your bank. Banks do not ask for account numbers over the phone.

Set up low-balance alerts on your checking account. Most banks allow you to set a threshold—for example, $500—and receive an alert if your balance drops below it. This catches large unauthorized transfers quickly. Check your statements weekly, not monthly. The sooner you spot fraud, the sooner you can report it and the sooner your bank can refund it.

What happens if you ignore a compromised account number

If you know your account number has been compromised and you do nothing, a criminal can drain your account through ACH transfers or check fraud. Your bank will not refund unauthorized activity unless you report it, and the longer you wait, the harder it becomes to prove the transfer was not yours.

If the criminal uses your account number to open new accounts in your name or to apply for credit, that damage shows up on your credit report and can take months to fix. Reporting the compromise to your bank immediately limits the window in which this can happen.

Frequently Asked Questions

Can someone use my account number to get a loan in my name?

Not directly from your account number alone. However, if a criminal has your account number along with other personal information (your name, address, Social Security number), they can use it as part of a fraud application. Report the compromise to your bank and consider placing a fraud alert with the credit bureaus (Equifax, Experian, TransUnion) by calling 1-888-397-3742.

What if I see an unauthorized ACH transfer but my bank says it was valid?

Ask your bank to show you the authorization they received. If you did not authorize it, dispute it in writing. If your bank refuses to refund it after investigation, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. Keep copies of all correspondence with your bank.

Do I need to close my account if my account number is compromised?

Not necessarily. Many banks will monitor your account and refund any unauthorized activity. However, if fraud has already occurred or if you are uncomfortable, closing the account and opening a new one is a valid option. Ask your bank what they recommend based on your situation.

How long does it take to get my money back after reporting fraud?

Most banks complete their investigation within two to four weeks. Some provide a provisional credit within one to three business days while they investigate. Ask your bank for their specific timeline when you report the fraud.

Should I change my online banking password if my account number is compromised?

Yes. Change your password immediately and make it unique—do not use it anywhere else. If you use the same password on multiple sites, change those too. Your account number being compromised does not mean your password is, but changing it adds a layer of protection while your account is being monitored.