A hacker with only your account number cannot drain your account on their own
Your bank account number alone is not enough for someone to withdraw money or transfer funds. Banks require additional verification before processing transactions — usually a PIN, password, or signature. A thief who has only the number and routing number can see your account on paper statements or a check, but cannot log into your online banking or authorize a payment without more.
That said, your account number is not harmless information. It can be used as one piece of a larger fraud scheme, and it does open doors that a complete stranger should not have. The risk depends on what else someone knows about you and what they do with the number.
Key Takeaways
- Your account number alone cannot be used to withdraw money or transfer funds without additional authentication like a password or signature.
- Someone with your account number can set up unauthorized automatic payments (ACH transfers) if they also have your name and address, which are often public.
- The biggest risk is that your account number can be used to initiate a payment that looks legitimate enough that you might approve it by mistake.
- If you believe your account number has been compromised, contact your bank immediately to monitor for unauthorized activity and place a fraud alert.
- You should never give your account number to someone who contacts you unsolicited, even if they claim to be from your bank.
What a scammer can do with your account number
The most common attack is an ACH transfer — an automated clearing house payment that moves money between bank accounts. If someone has your account number, routing number, and name, they can attempt to set up an ACH debit that pulls money out of your account. Your bank may or may not catch this before it goes through, depending on how well their fraud detection works.
Another route is a phishing payment request. A scammer might send you an email or text that looks like it came from your bank or a company you do business with, asking you to "confirm" or "verify" a payment using your account number. If you click and enter information, they now have more than just the number — they have your password or security answers too.
A third scenario is check fraud. If someone has your account number and routing number, they can print counterfeit checks or order checks in your name and write them from your account. This is slower than a digital transfer but harder to trace immediately.
Why your name and address matter as much as your account number
Your account number is most dangerous when paired with information that is often public: your name, address, and phone number. A scammer with all four pieces can attempt an ACH debit or convince a customer service representative that they are you. Many data breaches expose account numbers alongside names and addresses, which is why a single breach can trigger fraud across multiple accounts.
If your information has been exposed in a breach, the risk is higher than if only your account number was seen by someone in passing. You can check whether your information appeared in a known breach by visiting haveibeenpwned.com, a free database maintained by security researcher Troy Hunt.
What banks do to protect your account
Most banks have fraud detection systems that flag unusual activity — a large withdrawal, a transfer to a new account, or a payment to a vendor you have never used before. These systems are not perfect, but they catch many unauthorized ACH debits before the money leaves your account.
Banks also require additional verification for certain transactions. If you try to add a new payee to your online banking, many banks will delay the first payment by one or two business days. If someone tries to change your password or recovery email, the bank may send a confirmation code to your phone or require you to answer security questions.
However, these protections work only if the bank catches the fraud. If a scammer successfully impersonates you on the phone or uses social engineering to convince a bank employee to process a transfer, the money can be gone before you notice.
What to do if your account number has been exposed
Contact your bank as soon as you know or suspect your account number is in the wrong hands. Tell them you want to monitor the account for fraud. Many banks will flag your account and watch for suspicious activity, or they may issue you a new account number and debit card.
Check your bank statements and transaction history weekly for the next few months. Look for small charges you do not recognize — scammers sometimes test a stolen account with a small purchase before attempting a larger one. Set up account alerts if your bank offers them; most will notify you by email or text when a transaction over a certain amount is processed.
If you see unauthorized activity, report it to your bank immediately. Under the Electronic Funds Transfer Act, you are not liable for unauthorized ACH transfers if you report them within 60 days of the statement date. The sooner you report, the better your chances of recovering the money.
How to protect your account number going forward
Never give your account number to someone who calls or texts you unsolicited, even if they claim to be from your bank. Real banks do not ask for account numbers over the phone. If you are unsure, hang up and call the number on the back of your debit card or on your bank's official website.
Be cautious with checks. If you still use paper checks, do not leave them in an unsecured mailbox or throw them in the trash unshredded. A thief can pull a check from your trash and use the account number printed on it.
Use strong, unique passwords for your online banking. If your password is weak and someone guesses it, they can log in and change your recovery email or phone number, locking you out of your own account. A password manager like Bitwarden or 1Password can generate and store complex passwords for you.
Enable two-factor authentication on your bank account if it is available. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app.
What happens if money is stolen from your account
If an unauthorized ACH transfer or check withdrawal drains your account, your bank is required to investigate and return the money if the transaction was fraudulent. The timeline varies — some banks credit your account within one to three business days, while others may take up to 10 business days to complete an investigation.
During the investigation, the money is typically returned to your account provisionally, meaning you can use it while the bank confirms the fraud. If the bank determines the transaction was authorized (for example, if you signed up for a service and forgot about it), they may reverse the credit.
If your bank refuses to refund you, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can order them to refund money or pay damages.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, government ID, and proof of address — things that are much harder to forge than an account number. However, if someone has your Social Security number along with your account number, they may be able to open accounts in your name at other banks.
Is my account number visible to other people when I pay them?
It depends on the payment method. If you pay by check, your account number is printed on the check and visible to anyone who handles it. If you pay by ACH transfer or online bill pay through your bank, the recipient does not see your full account number — they see only a reference number or confirmation. Credit card payments do not expose your bank account number at all.
What if I gave my account number to a website I thought was legitimate?
Contact your bank immediately and describe what happened. If the website was a phishing scam, your bank can watch your account for fraud and may issue you a new account number. If the website was legitimate but you are worried, ask the company what security measures they use to protect account numbers.
Do I need to close my account if my account number was exposed?
Not necessarily. Closing the account is one option, but it can hurt your credit history and make it harder to open a new account later. Most banks recommend monitoring the account first and closing it only if fraud actually occurs or if you feel unsafe. Talk to your bank about your options.
Can someone use my account number to get a loan in my name?
Not with just the account number. A lender needs your Social Security number, credit history, and government ID to open a loan. However, if someone has your account number along with other personal information, they may be able to commit identity theft and open accounts in your name.