Your account number alone is not enough to drain your account
A person who has only your account number cannot transfer money out of your account or make purchases on your behalf. Banks require additional information — usually your routing number plus your account number together, plus proof of identity, plus authorization from you — before they will move money. Your account number by itself is like having half of a two-part lock.
That said, your account number is not harmless information. Someone with your account number and routing number can set up automatic payments from your account, deposit checks in your name, or attempt to open new accounts using your identity. The risk depends on what else they have and what they do with it.
Key Takeaways
- Your account number alone cannot be used to withdraw money, transfer funds, or make charges without your routing number and your authorization.
- Someone with both your account number and routing number can set up automatic bill payments or direct deposits in your name without your permission.
- If you notice unauthorized payments or accounts opened in your name, contact your bank immediately and file a report with the Federal Trade Commission.
- You should treat your account number like you treat your address — not secret, but not something to hand out to strangers or post online.
- Checks you write contain both your account number and routing number, so be cautious about who you give checks to and monitor your account regularly.
What someone can do with your account number and routing number together
If someone has both pieces of information, they can attempt to set up automatic payments from your account without your permission. This is called ACH fraud — ACH stands for Automated Clearing House, the system that processes electronic transfers between bank accounts. They can try to authorize recurring bill payments, subscription charges, or transfers to their own account.
They can also deposit checks or attempt direct deposits into your account. This is less common as a theft method because it adds money rather than removing it, but it can be used to launder money or hide the origin of funds.
The key word is "attempt." Banks have fraud detection systems that flag unusual activity. Whether the transaction goes through depends on your bank's monitoring, the amount involved, and how similar the transaction is to your normal account behavior. A $50 payment might slip through; a $5,000 transfer to an unfamiliar account might not.
Why checks are a bigger risk than you might think
Every check you write displays both your account number and your routing number in machine-readable form at the bottom. Anyone who handles that check — a store clerk, a mail carrier, a business employee — can see both numbers. If you pay a contractor, a service provider, or anyone you do not know well, you are giving them both pieces of the puzzle.
This is why you should never pay strangers by check if you can avoid it. If you must write a check to someone unfamiliar, monitor your account closely for the next 30 to 60 days. Set up account alerts with your bank so you are notified of any ACH transactions or unusual activity.
What happens if someone uses your account number fraudulently
If you notice an unauthorized payment or transfer, contact your bank immediately — the same day if possible. Under the Electronic Funds Transfer Act, you have a window to report the fraud. If you report it within two business days, your liability is capped at $50. If you wait longer, your liability can go up to $500. If you wait more than 60 days after your statement is sent, you may have no protection at all.
Your bank will investigate and, if fraud is confirmed, will reverse the transaction and return the money to your account. The investigation typically takes 10 business days, though complex cases can take longer. During that time, the money may be unavailable to you.
You should also file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and can help if the fraud is part of a larger identity theft scheme. The FTC does not investigate individual cases, but the report is useful if you need to dispute charges or prove to creditors that fraud occurred.
How to reduce the risk of ACH fraud
Set up account alerts with your bank for any ACH transactions or transfers above a certain amount. Many banks allow you to set the threshold — for example, you might want to be notified of any ACH payment over $100. This gives you a chance to catch fraud quickly.
Review your bank statements weekly rather than monthly. The sooner you spot unauthorized activity, the better your protection under federal law. If your bank offers online banking, log in regularly and check for transactions you do not recognize.
Be selective about who you give checks to. If you have a choice between paying by check, credit card, or debit card, use the credit card or debit card when possible — they offer stronger fraud protection than ACH transactions. If you must pay by check, use a business you trust or one that is well-established.
Do not post pictures of checks on social media or email them to people you do not know. Do not leave blank checks lying around. If you move, contact your bank and ask them to flag your account for potential fraud — moving is a common time for identity theft.
The difference between account number fraud and identity theft
Account number fraud is limited to unauthorized transactions from your existing account. Identity theft is broader — someone uses your personal information to open new accounts, apply for credit, or commit crimes in your name.
If someone has your account number and routing number, they can commit account fraud. If they also have your Social Security number, date of birth, and address, they can commit identity theft. The two often happen together, but they are not the same thing.
If you suspect identity theft rather than just account fraud, the steps are similar but more extensive. You will need to place a fraud alert with the credit bureaus (Equifax, Experian, and TransUnion), review your credit reports for accounts you did not open, and potentially freeze your credit. The FTC's IdentityTheft.gov site walks you through all of these steps.
What your bank is responsible for and what you are responsible for
Your bank is responsible for investigating unauthorized ACH transactions and reversing them if fraud is confirmed. They are also responsible for maintaining reasonable security measures and notifying you of suspicious activity if they detect it.
You are responsible for monitoring your account, reporting fraud promptly, and protecting your account information. If you give your account number to someone and they misuse it, your bank may argue that you were negligent. This does not always protect them from liability, but it can complicate your case.
The law is on your side if you report fraud within the required timeframe, but the burden is on you to notice and report it. This is why regular account monitoring is your best defense.
Frequently Asked Questions
Can someone open a new bank account using just my account number?
No. Opening a new account requires a Social Security number, government-issued ID, and proof of address. Your account number alone is not enough. However, if someone has your account number along with other personal information, they may be able to open an account fraudulently in your name.
Is it safe to give my account number to my employer for direct deposit?
Yes. Your employer needs your account number and routing number to set up direct deposit, and this is a standard, secure practice. Employers have no reason to misuse this information, and direct deposit is safer than receiving paper checks.
What if I accidentally gave my account number to a scammer?
Contact your bank immediately and explain what happened. Ask them to monitor your account for suspicious activity and set up alerts. Watch your account closely for the next 60 days. If unauthorized transactions appear, report them right away. In most cases, nothing will happen — scammers receive thousands of account numbers and cannot act on all of them.
Can someone use my account number to find out my balance or personal information?
No. Your bank will not release account information to anyone without proper authentication, usually a password or security questions. Someone with only your account number cannot log into your account or see your balance.
Do I need to close my account if someone has my account number?
Not necessarily. Closing your account is a last resort. Start by monitoring closely and setting up alerts. If fraud occurs, report it and let your bank investigate. If the fraud is extensive or ongoing, closing the account and opening a new one may be necessary, but most cases do not require this step.