A routing number alone is not enough to drain your account
Your routing number identifies which bank holds your account, but it does not give someone access to your money. A hacker needs both your routing number and your account number to attempt a transfer, and even then, most banks have additional security steps in place before money moves. Routing numbers are printed on checks, published on bank websites, and shared openly—they are not secret.
That said, a routing number combined with your account number creates real risk. Someone with both pieces of information can attempt unauthorized transfers, set up fraudulent bill payments, or create fake checks. The key word is "attempt"—your bank's security systems are designed to catch these moves, but you need to know what to watch for and how to respond if something goes wrong.
Key Takeaways
- A routing number by itself cannot be used to access or drain your account; a thief also needs your account number.
- If someone has both your routing and account numbers, they can attempt unauthorized ACH transfers or bill payments, but your bank's fraud detection usually catches these.
- Check your bank statements weekly for unauthorized transactions, especially small test transfers that precede larger theft attempts.
- If you spot fraud, contact your bank immediately and file a dispute; federal law limits your liability to $50 if you report within 60 days.
- Shredding checks, avoiding unsecured payment methods, and not sharing banking details over email or phone reduce the risk of exposure.
What a thief can actually do with a routing number and account number
With both numbers, someone can attempt an ACH (Automated Clearing House) transfer—a bank-to-bank electronic move that takes one to three business days. They can also set up bill payments to themselves through your bank's bill pay system, or create fraudulent checks if they have access to a check printer. Some scammers use the information to open accounts in your name or apply for credit.
The critical point: these are attempts, not may provide theft. Your bank monitors for unusual activity patterns. A transfer to an account that has never received money from you before, or a payment amount that is wildly different from your normal spending, triggers fraud alerts. Many banks will pause the transaction and contact you before it clears.
The real danger is delay. If you do not notice the unauthorized transaction for weeks or months, the thief has time to move the money out of reach, and your bank may treat it as a settled transaction rather than fraud. This is why monitoring your account matters more than the routing number itself.
How your bank stops unauthorized transfers
Most banks use velocity checks—they flag transfers that happen faster than your normal pattern. If you have never sent money to another bank before, a sudden ACH transfer to a new account will likely be held for review. If you normally spend $200 a week but someone tries to move $5,000, the system catches it.
Larger transfers often require additional verification. Your bank may call you, send a text code, or require you to log in and confirm the transaction. Some banks use multi-factor authentication on transfers over a certain amount. Smaller transfers—under $500—may move through with less friction, which is why scammers often test with a small amount first to see if the account is monitored.
Bill pay systems have their own safeguards. When you set up a new payee through your bank's bill pay, most institutions require a waiting period before the first payment goes through, or they send a verification code to an address on file. This slows down the fraud but does not stop it entirely if the thief has access to your email or mailing address.
Signs that your routing and account numbers have been compromised
Watch for small, unusual transactions—$1 to $5 charges from unfamiliar merchants or services. Scammers use these test transfers to confirm the account is real and monitored before attempting larger theft. You might also see bill payments you did not authorize, or ACH transfers to accounts you do not recognize.
Check your bank statements at least weekly, not monthly. Many people review statements only when the paper arrives or when they remember to log in. By then, a thief has had weeks to move money. Set up transaction alerts through your bank's app or website—most banks offer free alerts for any transaction over a certain amount, or for transfers to new payees.
Another warning sign is a call or email from your bank asking you to confirm a transaction you did not make. This is legitimate fraud prevention, not a scam. Answer the call or log into your bank's website directly (do not click a link in an email) and confirm whether the transaction is yours.
What to do if you spot unauthorized activity
Contact your bank immediately by phone—do not email or use the chat feature for fraud reports. Call the number on the back of your debit card or on your bank statement, not a number from a search result. Tell them which transactions are not yours and ask them to freeze your account temporarily while they investigate.
Your bank will likely cancel your debit card and issue a new one. They will also reverse the fraudulent transactions, though this can take a few days to a few weeks depending on the type of transfer. Federal law (Regulation E) limits your liability to $50 if you report the fraud within 60 days of the statement date when the unauthorized transaction appeared.
File a dispute for each unauthorized transaction through your bank's online portal or by phone. Keep records of every call—note the date, time, and name of the person you spoke with. If your bank drags its feet or refuses to reverse the charges, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator.
How your routing number gets exposed
Routing numbers appear on the bottom left of every check you write. If you throw away checks without shredding them, someone going through your trash can grab the number. They can also find it on your bank's website—most banks publish routing numbers publicly so customers can set up direct deposit or wire transfers.
Account numbers are more closely guarded but still leak through data breaches, phishing emails, or unsecured payment systems. If you pay a bill through an unsecured website (one without "https" in the address), your information can be intercepted. Scammers also call pretending to be from your bank and trick you into reading your account number aloud.
Checks are the biggest risk. If you still use paper checks, shred them before throwing them away. Do not leave blank checks lying around, and do not write checks to unfamiliar businesses. If you have not written a check in years, ask your bank to stop sending them—many banks will do this at no charge.
Protecting your routing and account numbers
Shred all documents with banking information before discarding them. Use a cross-cut shredder if possible—a strip shredder leaves pieces large enough to reassemble. Do not leave bank statements, old checks, or credit card offers in the trash or recycling bin.
Never share your account number or routing number over the phone unless you initiated the call and you are certain you are talking to your bank. If someone calls claiming to be from your bank and asks for account information, hang up and call your bank directly using the number on your card.
Avoid paying bills through unsecured websites or email. Use your bank's bill pay system, which is encrypted, or pay through the biller's official website. Do not send banking information through email, text, or messaging apps. If a business asks for your routing number, ask why they need it—legitimate reasons include direct deposit setup or ACH payments you authorized.
Monitor your credit report for signs that someone opened an account in your name. You can check your credit report for free once a year at annualcreditreport.com. If you spot fraudulent accounts, place a fraud alert with the credit bureaus and consider a credit freeze.
Frequently Asked Questions
Can someone write checks using my routing and account number?
Yes, if they have access to a check printer and both numbers. However, most banks now verify checks electronically before clearing them, and many businesses call to confirm large checks before depositing them. Report forged checks to your bank immediately—you are not liable for them under federal law.
What if I gave my routing number to a business and now I am worried?
A routing number alone is low risk. If you also gave your account number, monitor your statements closely for the next few weeks. Set up transaction alerts and check your account at least weekly. If nothing unusual appears after a month, the risk has passed.
Do I need to close my account if my routing number was exposed?
No. Closing your account is unnecessary unless your account number was also compromised and you spot unauthorized activity. If fraud does occur, your bank will issue a new debit card and reverse the charges. You can keep the same account and routing number.
How long does it take for my bank to refund fraudulent transfers?
ACH transfers typically reverse within one to three business days once your bank confirms the fraud. Wire transfers are harder to recover and may take longer. Bill pay reversals usually happen within a few days. Ask your bank for a specific timeline when you report the fraud.
Will my bank hold me responsible for fraud if I did not notice it right away?
Federal law limits your liability to $50 if you report within 60 days of the statement date. If you wait longer, your liability increases, and you may lose protection entirely if you wait more than 120 days. This is why checking your statements weekly matters.