What a bank account number alone lets someone do
A bank account number by itself is not enough to drain your account or make purchases. To move money out, someone needs both your account number and your routing number, and even then they face real barriers. A thief cannot simply walk into a bank with your account number and withdraw cash. They cannot use it to open a credit card in your name. They cannot make a debit card purchase or access your online banking.
What they can do is set up an ACH transfer — an electronic bank-to-bank transfer — if they also have your routing number. They can also set up a bill payment from your account if they have access to your bank's website or app, though most banks require a password or second factor to do this. The real risk is not the account number itself, but what someone can do when they combine it with other information or access.
Key Takeaways
- Your account number alone cannot be used to withdraw cash, make purchases, or open new accounts in your name.
- Combined with your routing number, someone can attempt an ACH transfer, but most banks catch unauthorized transfers within one to two business days.
- If you gave your account and routing number to a business for a legitimate reason — direct deposit, bill payment, check deposit — the risk is low unless that business was fraudulent.
- If you suspect unauthorized activity, contact your bank immediately; federal law limits your liability to $50 if you report within 60 days of your statement.
- Monitoring your account regularly and setting up transaction alerts catches problems faster than waiting for your monthly statement.
When you gave your account number to a legitimate business
If you provided your account and routing number to your employer for direct deposit, to a utility company for bill payment, or to a service you actually use, the risk is very low. These businesses have no reason to steal from you, and they are bound by banking regulations and their own compliance rules. They also keep records, which makes theft traceable and prosecutable.
The real concern is if the business itself is compromised — if a data breach exposes your information — but even then, your bank is watching for unusual activity. Most unauthorized ACH transfers are caught and reversed within one to two business days. Your bank's fraud detection system flags transfers that do not match your normal pattern: a sudden large transfer to an unknown account, or a transfer at an unusual time of day.
When you gave your number to someone you do not know
If you gave your account number to a stranger, a caller claiming to be from your bank, or someone who contacted you unsolicited, treat it as a potential fraud risk. This is different from a data breach because the person now has your information intentionally and may act on it immediately.
Contact your bank right away. Tell them the situation and ask them to watch for unauthorized activity. Many banks will flag your account for heightened monitoring or issue you a new account number. You do not need to wait for fraud to occur — reporting the exposure is enough for most banks to take precautions. Some will also issue a new debit card as a precaution, though this is not always necessary if no actual fraud has happened.
How to spot an unauthorized ACH transfer
An ACH transfer typically appears in your account within one to three business days. It shows up as a debit (money out) with a description that may say "ACH Debit" or the name of a company you do not recognize. Unlike a debit card transaction, you will not receive a notification at the moment it happens — it processes in the background.
This is why monitoring your account regularly matters more than the account number itself. Log into your bank's app or website at least once a week and scan your recent transactions. If you see something you did not authorize, report it to your bank immediately. Do not wait for your monthly statement. The faster you report, the faster your bank can reverse it and investigate.
Your legal protection against unauthorized transfers
Federal law (Regulation E) protects you if someone makes an unauthorized transfer from your account. Your liability depends on how quickly you report it. If you report the unauthorized transfer within two business days of discovering it, your liability is capped at $50. If you report it within 60 days of your statement, your liability is capped at $500. After 60 days, you may lose all protection.
This protection applies to ACH transfers, not to debit card fraud or check fraud, which have different rules. But for the scenario you are worried about — someone using your account number to pull money out — this is the law that protects you. Your bank will investigate, and if they confirm the transfer was unauthorized, they will reverse it and credit your account.
Steps to take if you are concerned
First, contact your bank by phone. Do not use a number from an email or text message — look up the number on your bank statement or the back of your debit card. Tell them you are concerned about unauthorized access and describe what happened. Ask them to review your account for suspicious activity and to flag it for monitoring.
Second, change your online banking password if you have not done so recently. Use a password that is at least 12 characters long and includes numbers, uppercase and lowercase letters, and symbols. Do not reuse passwords across different banks or websites.
Third, consider setting up transaction alerts. Most banks let you set alerts for transfers over a certain amount, or for any ACH transfer at all. This way you will know immediately if someone tries to move money, rather than discovering it days later.
Fourth, monitor your account regularly. Check your transactions at least weekly. If you see something you do not recognize, report it immediately rather than waiting to see if it resolves itself.
What your account number is actually used for
Your account number is designed for legitimate banking purposes: direct deposit, bill payments, wire transfers you initiate, and check deposits. It is not a secret. Your checks have your account number printed on them, and anyone who receives a check from you sees it. Your employer has it. Your utility company has it. This is normal and safe.
The account number becomes a risk only when combined with intent to defraud and access to your bank's systems or the ability to initiate an ACH transfer. A random person with just your account number cannot do much. A person with your account number, routing number, and the ability to log into your bank's bill pay system can do more. A person with your account number, routing number, and access to an ACH origination system (which requires business banking credentials) can attempt a transfer, but your bank will likely catch it.
Frequently Asked Questions
Can someone withdraw cash from an ATM with just my account number?
No. An ATM requires a debit card and a PIN. Your account number alone will not work at an ATM or at a bank teller window. A teller will ask for identification and will verify that you are the account holder before releasing any cash.
Can someone open a credit card or loan in my name using my account number?
No. Opening a credit card or loan requires a full credit application, which includes your Social Security number, date of birth, address, and employment history. Your account number is not part of this process. If you are worried about identity theft, you can place a fraud alert or credit freeze with the three credit bureaus (Equifax, Experian, TransUnion).
What if I gave my account number to a scammer?
Contact your bank immediately and describe what happened. Ask them to monitor your account and flag any unusual activity. If the scammer also has your routing number, they may attempt an ACH transfer, but your bank's fraud detection system will likely catch it. Report any unauthorized transfers within 60 days of your statement to stay within the legal protection window.
Do I need to close my account if someone has my account number?
Not necessarily. Closing your account is a last resort and creates its own problems — you lose access to your money during the closure process, and you have to update direct deposits and bill payments elsewhere. Start by contacting your bank and asking them to monitor your account. If unauthorized activity actually occurs, your bank will reverse it. Close your account only if your bank recommends it or if fraud continues despite monitoring.
How long does it take for an unauthorized ACH transfer to show up?
ACH transfers typically process within one to three business days. You will see it as a debit in your account history. Some banks send notifications for large transfers, but not all. This is why checking your account weekly is more reliable than waiting for a notification.