Your account number alone is not enough to drain your account, but it is one piece of a larger puzzle
A thief with only your account number cannot log into your online banking, transfer money out, or make purchases. They need additional information — usually your password, a second authentication factor, or access to your physical debit card. That said, your account number is valuable to someone with criminal intent, because it opens specific doors that other pieces of information do not.
The real risk depends on what else they have, what they do with your number, and how quickly you notice and report it. Understanding the actual threat — rather than the worst-case scenario — helps you know what to watch for and when to act.
Key Takeaways
- Your account number by itself cannot be used to log in, transfer money online, or make card purchases, because banks require additional verification.
- A thief with your account number can set up unauthorized ACH transfers, bill payments, or direct deposits if they also have your routing number and bank name.
- The most common misuse is fraudulent ACH transactions, which can take three to five business days to process, giving you time to notice and report.
- Reporting suspected fraud to your bank within 60 days of the statement date protects you from liability under federal law, even if the thief had multiple pieces of information.
What a thief can do with your account number
If someone has your account number and routing number together, they can attempt to set up an ACH transfer — an electronic bank-to-bank transfer. They can also try to enroll your account in bill payment services, set up unauthorized direct deposits, or use your account information to create fraudulent checks. These are not instant; ACH transfers typically take three to five business days to clear, which means you have a window to spot the transaction and report it before the money leaves your account.
The barrier to entry is lower than it is for online banking fraud. ACH transfers do not require a password or login. They require your account number, routing number, and the name of your bank — information that is often visible on checks, statements, or public records. A criminal does not need to hack anything; they just need the numbers.
Fraudulent checks are another route. If someone has your account number, they can print counterfeit checks and attempt to cash or deposit them. Banks have gotten better at catching these, but the risk still exists, especially if the checks are deposited at ATMs or remote locations.
Why your password and login are separate from your account number
Banks separate account numbers from online access credentials specifically to prevent this scenario. Your account number is printed on checks and statements; your password is something only you should know. Even if a thief has your account number, they cannot log into your online banking portal, view your balance, or authorize transfers from your account without your password and whatever second factor your bank uses (a code from an app, a text message, a security question).
This is why banks ask for your password during login but do not ask for your account number. The account number identifies which account to pull up; the password proves you are the owner. A thief with only the account number has the address but not the key.
How to know if your account number has been misused
Check your bank statements and transaction history regularly — at least weekly if you can. Look for ACH transfers you did not authorize, unexpected bill payments, or deposits from sources you do not recognize. Many banks also offer transaction alerts; you can set these up to notify you by text or email whenever a transfer over a certain amount is initiated.
If you see a suspicious transaction, do not wait. Call your bank immediately using the number on the back of your debit card or on your statement. Do not use a number from a text message or email, because those can be fraudulent. Tell the bank the transaction is unauthorized and ask them to reverse it and investigate.
ACH fraud is often caught quickly because the transactions are visible in your account before they fully clear. If you report within one or two days, your bank can usually stop the transfer before the money leaves. If the money has already left, you have up to 60 days from the statement date to report it and dispute the charge.
What your bank is required to do if fraud occurs
Under the Electronic Funds Transfer Act, your liability for unauthorized ACH transfers and other electronic fraud is limited. If you report the fraud within two business days of discovering it, you are not liable for any of the fraudulent transfer. If you report within 60 days of the statement date, your liability is capped at $50. After 60 days, your liability can be higher, which is why prompt reporting matters.
Your bank must investigate your claim and either reverse the transaction or explain in writing why they believe the transfer was authorized. This process typically takes 10 business days, though banks often resolve it faster. During the investigation, the bank may freeze the disputed amount or temporarily credit it back to your account.
Steps to take if you think your account number is compromised
First, contact your bank and tell them your account number may have been compromised. Ask them to flag your account for fraud monitoring and to watch for unusual ACH activity. Some banks will issue you a new account number and routing number as a precaution, though this is not always necessary unless fraud has already occurred.
Second, review your recent statements and transaction history going back at least 30 days. Look for any transfers, bill payments, or deposits you did not authorize. If you find any, report them immediately.
Third, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) if you believe your personal information has been compromised more broadly. This does not protect your bank account directly, but it does make it harder for someone to open new accounts in your name. You can place a fraud alert for free by calling one bureau; they will notify the other two.
Fourth, monitor your account for the next 60 to 90 days. Set up transaction alerts if your bank offers them. If you see anything suspicious, report it immediately.
Where account numbers are commonly exposed
Your account number can be exposed through data breaches at retailers, payment processors, or financial institutions. It can also be visible to anyone who sees your checks, your bank statements, or your online bill payment history. Some people share their account number intentionally — for example, when setting up direct deposit with an employer or when paying a bill by phone.
The risk increases if your account number is combined with other information. A thief with your account number, routing number, and full name can attempt ACH fraud. A thief with your account number, password, and phone number can potentially reset your online banking access. This is why it matters what else they have, not just that they have your account number.
Frequently Asked Questions
Can someone use my account number to make online purchases?
No. Online purchases require a debit card number, expiration date, and CVV code — not a bank account number. If someone has your debit card information, they can make purchases, but that is a different type of fraud. Your account number does not work for online shopping.
What if I gave my account number to someone I thought I could trust?
If you gave your account number to someone and now suspect they may misuse it, contact your bank immediately and explain the situation. Ask them to monitor your account and flag any unusual activity. If unauthorized transactions appear, report them within 60 days of the statement date. Your bank can reverse fraudulent ACH transfers even if you voluntarily shared your account number.
How long does it take for an unauthorized ACH transfer to go through?
ACH transfers typically take three to five business days to clear. This means if you spot a fraudulent transfer on day one, you have several days to call your bank and stop it before the money actually leaves your account. This is different from debit card fraud, which is often instant.
Do I need to close my account if my account number is compromised?
Not necessarily. If no fraud has occurred, monitoring your account closely is usually enough. If fraud does occur and your bank reverses it, you can keep the account open. You only need to close the account if your bank recommends it or if fraud continues despite monitoring and reporting.
What is the difference between reporting fraud to my bank and reporting it to the police?
Your bank handles the financial side — investigating, reversing charges, and protecting your account. Police reports create an official record and can help if the fraud is part of a larger pattern, but police typically do not recover money for individual cases. Report to your bank first, because they can act immediately. File a police report if the amount is large or if you want an official record for insurance or other purposes.