Your account number alone is not enough to drain your bank account, but it is part of what a criminal needs

A thief with only your account number cannot log into your online banking, transfer money out, or make purchases. Banks use multiple layers of verification — passwords, security questions, two-factor authentication, or in-person ID checks — before they move money. Your account number is printed on your checks and is often visible to anyone who sees a payment you make. It is not a secret.

What matters is what else someone has alongside your account number. A criminal who has your account number and your routing number can set up unauthorized automatic withdrawals from your account, called ACH transfers. A criminal who has your account number, routing number, and personal details (name, address, date of birth) can sometimes open a new account in your name or request a wire transfer by phone. The account number is a piece of the puzzle, not the whole picture.

Key Takeaways

  • Your account number alone cannot be used to log in, transfer money, or make purchases without additional information and verification.
  • A thief with your account number and routing number can set up unauthorized ACH withdrawals, which is the most common risk.
  • Criminals need your account number plus personal details (name, address, date of birth, Social Security number) to open accounts or make wire transfers in your name.
  • If you see unauthorized ACH withdrawals, contact your bank immediately and file a dispute within 60 days to recover the money.
  • Sharing your account number for legitimate payments (direct deposit, bill pay, wire transfers) is safe as long as you verify the recipient is real.

What a criminal can do with your account number and routing number

The most realistic threat is an ACH debit — an automatic withdrawal from your account. ACH stands for Automated Clearing House, and it is the system banks use for direct deposits, bill payments, and transfers between accounts. If someone has both your account number and routing number, they can attempt to set up an ACH withdrawal without your permission.

This happens most often when you give your account number to a business that turns out to be fraudulent, or when a legitimate business's payment system is breached. A scammer might pose as a utility company, a loan servicer, or a contractor and ask for your account number to "process a payment." Once they have it, they submit an ACH debit request to their own bank, which then tries to pull money from your account.

Your bank is supposed to verify that the debit is legitimate before allowing it, but the system is not perfect. Some unauthorized ACH debits go through before your bank catches them. Others are blocked at the receiving bank. If money is withdrawn without your permission, you have the right to dispute it within 60 days and recover the funds.

What a criminal needs to open an account or wire money in your name

To actually impersonate you — to open a credit card, a bank account, or to authorize a wire transfer by phone — a criminal needs more than your account number. They need your full name, address, date of birth, and usually your Social Security number. This is called identity theft, and it is a different crime than account fraud.

If a criminal has all of this information, they can call your bank pretending to be you and request a wire transfer, or they can walk into a branch with a fake ID. They can also open a new account at a different bank in your name. This is much more damaging than an unauthorized ACH withdrawal, because it can take weeks to unwind and can affect your credit score.

Your account number by itself does not give a criminal this information. They would have to obtain your Social Security number, date of birth, and address through a data breach, a phishing email, a public records search, or by stealing your mail or wallet.

When it is safe to share your account number

You need to share your account number in several legitimate situations: setting up direct deposit with an employer, paying bills online, receiving a wire transfer, or authorizing a one-time ACH payment. In all of these cases, you are initiating the transaction and you know who you are sending it to.

Before you share your account number, verify that you are dealing with a real organization. Call the phone number on your bill or statement, not a number from an email or text message. Visit the official website by typing the address into your browser yourself, not by clicking a link in an email. If someone calls you asking for your account number, hang up and call the organization back using a number you know is real.

Legitimate businesses will never ask for your account number in an unsolicited email, text message, or phone call. If you receive a message claiming to be from your bank asking you to "verify" your account number, it is a phishing attempt.

Signs that someone is using your account number fraudulently

Check your bank statements regularly — at least once a week if possible. Look for small withdrawals you do not recognize, especially recurring ones. Scammers sometimes test a stolen account number with a small charge first to see if it goes through before attempting a larger withdrawal.

You may also receive a notice from your bank about an ACH debit attempt that was blocked, or a letter about a new account opened in your name. If you see any of these signs, contact your bank immediately. Do not wait for your monthly statement.

If you spot unauthorized ACH withdrawals, your bank can reverse them, but you have to report the fraud within 60 days of the transaction appearing on your statement. After 60 days, the bank is no longer required to refund you under federal law. If you discover identity theft — accounts opened in your name — contact the Federal Trade Commission at IdentityTheft.gov and place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion).

How to protect your account number

You cannot keep your account number completely private — it appears on checks, invoices, and statements. Instead, focus on controlling who has access to it and what they can do with it.

Shred documents that contain your account number before throwing them away. Do not leave bills or statements in your mailbox where mail theft can occur. Use a locked mailbox or pick up mail promptly. When you pay bills online, use your bank's bill pay feature rather than mailing checks, because checks contain your account number and routing number.

Monitor your credit report for accounts you did not open. You can get a free report from each of the three credit bureaus once per year at AnnualCreditReport.com. Consider placing a credit freeze with each bureau, which prevents anyone from opening new accounts in your name without your permission.

What to do if you think your account number has been compromised

If you gave your account number to a business that you now believe is fraudulent, or if you received a phishing email asking for it, contact your bank right away. Tell them the situation and ask them to monitor your account for suspicious activity. Some banks will issue you a new account number and close the old one, though this is not always necessary.

If unauthorized withdrawals have already occurred, file a dispute with your bank in writing. Include the date of the transaction, the amount, and the name of the company that made the withdrawal if you know it. Keep a copy for your records. Your bank has 10 business days to investigate and must refund you within 45 days if the withdrawal was fraudulent.

If you believe your identity has been stolen — if accounts have been opened in your name or if you received bills for services you did not request — report it to the Federal Trade Commission at IdentityTheft.gov. The FTC will create a recovery plan and send you letters to send to creditors and credit bureaus. This is a longer process than disputing a single ACH withdrawal, but it is the correct step if your full identity information has been compromised.

Frequently Asked Questions

Can someone use my account number to make online purchases?

No. Online retailers require a full credit card number, expiration date, and CVV code. Your bank account number is not the same as a credit card number and cannot be used to shop online. If a retailer asks for your account number for an online purchase, it is a scam.

What if I gave my account number to someone over the phone?

Contact your bank immediately and describe the situation. If the person claimed to be from your bank, your utility company, or a government agency, tell your bank that too. Your bank can flag your account for monitoring and may issue you a new account number. Watch your statements closely for the next 60 days for unauthorized withdrawals.

Do I need to close my account if my account number was compromised?

Not always. If only your account number was exposed and no unauthorized transactions have occurred, your bank may simply monitor the account. If unauthorized ACH withdrawals have happened, your bank can reverse them and may offer you a new account number. Closing the account is usually a last resort because it can affect automatic payments and direct deposits you have set up.

Is my money protected if someone makes an unauthorized ACH withdrawal?

Yes, but only if you report it within 60 days. Federal law requires banks to refund unauthorized ACH debits if you dispute them in writing within 60 days of the transaction appearing on your statement. After 60 days, the bank is no longer required to refund you, though some banks may do so anyway.

What is the difference between account fraud and identity theft?

Account fraud is when someone uses your existing account number to make unauthorized withdrawals. Identity theft is when someone uses your personal information to open new accounts in your name. Account fraud is usually faster to resolve. Identity theft requires more steps and can take months to fully clear up.