A bank account number alone is not enough to drain your account or make unauthorized transfers

Someone who has only your account number cannot withdraw money, open new accounts, or make transfers without additional information or access. Banks require more than a number to move money — they need authorization, which typically comes through a signature, a PIN, online login credentials, or a routing number paired with the account number.

That said, your account number is not harmless. It can be used to set up automatic bill payments in your name, receive direct deposits to a fraudulent account, or initiate ACH transfers if someone also has your routing number. The risk depends on what else they know and what they do with the information.

Key Takeaways

  • Your account number alone cannot be used to withdraw cash or make online transfers without your login credentials or authorization.
  • Someone with your account number and routing number together can set up automatic payments or ACH transfers in your name.
  • If you share your account number for a legitimate reason — like direct deposit or bill payment — you are not at high risk unless the recipient is untrustworthy.
  • If you believe your account number has been compromised, contact your bank immediately to monitor for unauthorized activity and place a fraud alert if needed.
  • Your bank can reverse most unauthorized ACH transfers and bill payments if you report them within a specific window, usually 60 days.

What requires only your account number

Legitimate uses of your account number alone include direct deposit from your employer or government payments like tax refunds and Social Security. Your employer and the Social Security Administration need only the account number and routing number to deposit money into your account — they do not need your password or PIN.

This is why you provide your account number on tax forms, W-4s, and benefit applications. The system is designed to allow deposits without requiring you to authenticate each one. The same mechanism, however, can be misused. Someone with both your account number and routing number can attempt to set up unauthorized automatic bill payments or ACH transfers.

What requires more than just your account number

Withdrawing money, transferring funds out of your account, or accessing your online banking portal all require authentication beyond the account number. If someone tries to log into your online banking, they need your username and password. If they try to withdraw cash at an ATM, they need your debit card and PIN. If they try to transfer money by phone, the bank will ask security questions or require a verbal authorization code.

Wire transfers, which move money quickly and are hard to reverse, require explicit authorization — usually a phone call, a signed form, or a verified online request. A scammer with only your account number cannot initiate a wire transfer on their own.

The real risk: ACH transfers and automatic payments

The most common way someone misuses an account number is by setting up unauthorized automatic bill payments or ACH transfers. This requires your account number and routing number, but not your password. A scammer might set up a fake utility bill, gym membership, or subscription service in your name and route the payments to their account.

These transactions can take a few days to process, which gives you a window to catch them. Your bank can reverse ACH transfers and bill payments if you report them within 60 days of the transaction — some banks honor claims up to 180 days. Contact your bank as soon as you notice an unauthorized payment, and they will typically refund the money while they investigate.

When you should be concerned about your account number being shared

If you gave your account number to someone you do not trust — a stranger online, someone who called claiming to be from your bank, or a business you have never heard of — monitor your account closely for the next few weeks. Check your bank statements online at least weekly, and set up account alerts if your bank offers them. Many banks let you receive a text or email notification whenever a transaction over a certain amount occurs.

If the person who has your account number also has your name, address, and date of birth, the risk increases. They could attempt to open a new account in your name or set up fraudulent bill payments more convincingly. If you believe your personal information has been compromised, you can place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion — which makes it harder for someone to open accounts in your name.

What to do if you think your account number has been misused

Call your bank immediately using the number on the back of your debit card or on your bank statement — not a number from an email or text message. Tell them which transactions look unauthorized and ask them to reverse the charges. Most banks will refund the money while they investigate, and they can flag your account to watch for similar activity.

Ask your bank whether they can issue you a new account number. Some banks will do this for free if there has been fraud; others charge a small fee. A new account number stops the scammer from making further unauthorized payments, though you will need to update your direct deposit information with your employer and any legitimate bill payments you have set up.

If the unauthorized activity involves multiple accounts or you suspect identity theft, file a report with the Federal Trade Commission at IdentityTheft.gov. The FTC does not investigate individual cases, but the report creates an official record that can help if you need to dispute fraudulent accounts or credit inquiries later.

Sharing your account number for legitimate reasons

You need to share your account number when setting up direct deposit, paying bills by bank transfer, or receiving refunds. This is normal and necessary. The key is to share it only with organizations you recognize and trust — your employer, your bank, the IRS, your insurance company, or a utility you actually use.

If someone calls or emails asking for your account number and you did not initiate contact, hang up or delete the email. Legitimate companies do not ask for account numbers unsolicited. If you are unsure, call the company back using a phone number from their official website or your bill, not the number provided in the message.

Frequently Asked Questions

Can someone open a bank account with just my account number?

No. Opening a new account requires a government ID, Social Security number, and proof of address — information beyond just your account number. However, if someone has your full name, address, and Social Security number along with your account number, they could attempt to open an account in your name. This is identity theft, not account number theft.

What if someone has my account number and routing number?

With both pieces of information, someone can attempt to set up automatic bill payments or ACH transfers in your name. They cannot withdraw cash or access your online account, but they can initiate transfers that take a few days to process. Monitor your account and report any unauthorized transactions to your bank within 60 days for a refund.

Is it safe to give my account number to my employer for direct deposit?

Yes. Your employer needs your account number and routing number to set up direct deposit, and this is a standard, secure practice. Employers do not have access to your password or the ability to withdraw money — they can only deposit funds. The same applies to government agencies sending refunds or benefits.

Should I close my account if my account number was compromised?

Not necessarily. Closing an account is disruptive and may not be needed if you catch unauthorized activity quickly. Instead, monitor your account closely, report any fraudulent transactions, and ask your bank if they can issue a new account number. Close the account only if the fraud continues or if you feel unsafe keeping it open.

How long does it take to reverse an unauthorized ACH transfer?

Most banks refund unauthorized ACH transfers within 5 to 10 business days if you report them within 60 days. Some banks process refunds faster, especially if the transaction is clearly fraudulent. Call your bank immediately when you notice the unauthorized transfer — the sooner you report it, the sooner they can reverse it.