Your account number alone is not enough to drain your bank account
A person who has only your account number cannot log into your bank account or transfer money out of it. Banks require multiple pieces of information to authorize a transaction: your account number, your routing number, your password, and often a second form of verification like a code sent to your phone or email. A hacker with just the account number has one of those pieces.
That said, your account number is not harmless information. It can be used to set up unauthorized automatic payments, create fraudulent checks in your name, or initiate ACH transfers if the hacker also has your routing number. The risk depends on what else they have and what they do with it.
Key Takeaways
- Your account number by itself cannot be used to log in, transfer money, or drain your account without additional information.
- A hacker with your account number and routing number can attempt to set up automatic payments or ACH transfers, which may succeed before your bank catches them.
- Checks written against your account require only the account and routing number printed on them, so fraudulent checks are a real risk if both numbers are compromised.
- If you believe your account number has been stolen, contact your bank immediately to watch for suspicious activity and discuss whether to close the account.
- Your bank is liable for most unauthorized transfers, but you must report them quickly to protect yourself.
What a hacker can do with your account number and routing number
If someone has both your account number and routing number, they can attempt to initiate an ACH transfer (an electronic bank-to-bank transfer) or set up a recurring automatic payment. These transactions do not require a password or login. The originating bank checks that the account number and routing number match a real account, and if they do, the transfer may go through.
However, most banks have fraud detection systems that flag unusual outgoing transfers. A large transfer to a new recipient may be held for review or rejected. Smaller transfers or payments to common billers (utilities, credit card companies) are more likely to slip through initially. Once the transaction posts, your bank can reverse it if you report it as unauthorized, but the reversal takes time—usually three to five business days.
The real danger is that the hacker may move quickly and transfer money before you notice. This is why monitoring your account regularly matters.
Fraudulent checks are the oldest risk
Your account number and routing number are printed on every check you write. If someone obtains a check or has both numbers, they can write checks in your name against your account. Unlike online transfers, check fraud does not require your password or any digital access to your bank.
A fraudulent check may take days to clear, giving you time to catch it if you monitor your account. Once you report it, your bank will reverse the charge. However, if the check is cashed at a store or ATM before the bank processes it, the recipient may have already spent the money, and recovery becomes harder.
This is one reason banks recommend not writing your account number on checks or sharing it casually. It is also why shredding old checks and bank statements is a good habit.
What they cannot do without a password
A hacker cannot log into your online banking account with only your account number. Banks require a username and password, and most now require a second verification step—a code texted to your phone, a fingerprint, or an app-based authenticator. Your account number is not a password and does not bypass these security layers.
They also cannot change your password, update your contact information, or add a new payee to your account without logging in first. If someone tries to log in repeatedly with a wrong password, your bank will lock the account temporarily.
The exception is if the hacker has already compromised your email account. If they can access your email, they can use the "forgot password" feature on your bank's website and reset your banking password. This is why protecting your email password is as important as protecting your bank password.
Steps to take if your account number has been compromised
Contact your bank by phone as soon as you realize your account number may have been stolen. Do not use a phone number from an email or text message; look up the number on your bank statement or the back of your debit card. Tell them what happened and ask them to monitor your account for suspicious activity.
Ask whether your bank recommends closing the account and opening a new one. Some banks will do this at no cost if fraud is suspected. A new account number means any fraudulent transfers or checks written against the old number will fail.
Review your bank statements for the past 30 to 60 days and look for any transactions you do not recognize. Report unauthorized transactions to your bank in writing (email or secure message through your online banking portal) as well as by phone. Keep records of all communications.
If you have automatic payments set up from this account (payroll deposits, utility bills, insurance premiums), update those with your new account number once the new account is open. Notify your employer's payroll department if your direct deposit account number changes.
Your bank's liability for unauthorized transfers
Federal law (Regulation E) requires banks to refund unauthorized electronic transfers if you report them within 60 days of the transaction appearing on your statement. If you report within two business days, your liability is capped at $50. If you wait longer, your liability can be up to $500. If you wait more than 60 days, the bank has no obligation to refund you.
This protection applies to ACH transfers and debit card fraud, but not always to check fraud. Check fraud is handled under different rules, and your bank may take longer to investigate. However, banks are still required to make a reasonable effort to recover the money and reverse the charge.
The key is to report quickly. Set up account alerts through your bank's app or website so you are notified of large transactions or transfers. Many banks let you set a threshold—for example, alert me if any transaction over $100 occurs.
How to protect your account number going forward
Do not share your account number with anyone unless you initiated the contact and you are certain you are dealing with a legitimate business. Scammers often call claiming to be from your bank and ask for your account number to "verify" your identity. Your bank already knows your account number; they will not ask for it over the phone.
Do not write your account number on checks unless absolutely necessary. Many businesses only need your routing number to set up automatic payments. Ask before you provide it.
Shred bank statements, old checks, and any mail containing your account number before throwing it away. Dumpster diving is a real tactic used by identity thieves.
Use strong, unique passwords for your online banking account. Enable two-factor authentication if your bank offers it. This usually means a code is sent to your phone or generated by an app every time you log in from a new device.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, government-issued ID, and proof of address. Your account number alone is not enough. However, if a hacker has your Social Security number and other personal information, they could attempt to open an account in your name, which is a form of identity theft separate from account number theft.
What if I see a charge I do not recognize but the bank says it was authorized?
Ask the bank to provide the authorization details—the IP address, device, or location where the transaction originated. If it does not match your usual activity, push back and ask them to investigate further. You have the right to dispute the charge even if the bank initially says it was authorized.
Do I need to close my account if my number was exposed in a data breach?
Not necessarily. If the breach was at a retailer or service provider and only your account number was exposed (not your password or personal information), monitor your account closely for 30 to 60 days. If no fraudulent activity appears, you can leave the account open. If you see suspicious activity, contact your bank about closing and opening a new account.
Can a hacker use my account number to get a loan in my name?
No. A lender needs your Social Security number, credit history, employment information, and a full application to issue a loan. Your account number is not part of that process. However, if a hacker has your Social Security number and other personal details, they could attempt to commit identity theft and open accounts or loans in your name.
How long does it take to get my money back after I report fraud?
For ACH transfers and electronic transactions, your bank must investigate and issue a refund within 10 business days if the transaction is confirmed as unauthorized. For check fraud, the timeline is longer—sometimes 30 days or more. Ask your bank for a specific timeline when you report the fraud.