Your account number alone is not enough to drain your account, but it is part of what a criminal needs
A thief with only your account number cannot log into your bank or move money out on their own. Banks require multiple pieces of information to authorize a transfer: your account number, your routing number, your password, and often a second verification step like a code sent to your phone or email. A criminal who has just the account number has one piece of a larger puzzle.
That said, your account number is not harmless information. It can be used in combination with other details to commit fraud, and it can be sold to other criminals who specialize in different types of theft. The risk depends on what else the person has and what they are trying to do.
Key Takeaways
- Your account number by itself cannot be used to log in or transfer money, because banks require passwords and verification codes.
- A criminal can use your account number plus your routing number to set up unauthorized automatic payments or direct deposits from your account.
- Your account number can be used to impersonate you when applying for credit or loans if the criminal also has your name, address, and Social Security number.
- If you discover unauthorized activity, contact your bank immediately and file a dispute; federal law limits your liability if you report within 60 days.
- Sharing your account number for legitimate purposes like direct deposit or bill payments is normal and safe if you trust the recipient.
What a criminal can do with your account number and routing number together
When a thief has both your account number and routing number, they can attempt to set up unauthorized automatic payments or recurring charges against your account. This is sometimes called ACH fraud (Automated Clearing House fraud). They do not need your password to initiate an ACH transaction — they only need the two numbers that appear on the bottom of your check.
A criminal might use this to set up a fake subscription, redirect a utility payment to an account they control, or create a series of small charges that go unnoticed. Many people do not review their bank statements closely, so small recurring charges can persist for weeks or months before being caught.
Your bank's fraud detection systems are designed to catch this, but they do not catch everything. If you spot unauthorized ACH charges, you can dispute them with your bank, and federal law requires the bank to investigate and usually refund you within 10 business days if the charge is found to be fraudulent.
How your account number is used in identity theft
If a criminal has your account number along with your name, address, and Social Security number, they can attempt to open new accounts or take out loans in your name. Your account number serves as proof that you have a banking relationship, which makes the fraud appear more credible to lenders.
This type of fraud is harder to catch immediately because it does not touch your actual account. Instead, the criminal opens new credit lines or takes out loans that you are responsible for. You may not discover it until you check your credit report or receive a bill for an account you did not open.
Protecting yourself against this type of fraud means monitoring your credit report regularly. You can request a free credit report once per year from each of the three major credit bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com. You can also place a fraud alert or credit freeze on your file, which makes it harder for someone to open new accounts using your information.
When it is safe to share your account number
You will need to provide your account number and routing number for legitimate purposes regularly. Direct deposit from your employer, automatic bill payments, wire transfers, and ACH transfers between your own accounts all require these numbers. Sharing them with your bank, your employer's payroll department, or a utility company you trust is normal and necessary.
The key is knowing who you are giving the information to. Before you share your account number, confirm that you initiated the request and that you are communicating with the real organization. Do not provide your account number in response to an unsolicited email, text, or phone call, even if the message appears to come from your bank.
If you are unsure whether a request is legitimate, hang up or close the message and call your bank directly using the number on your bank card or statement. This protects you from phishing — a scam where criminals impersonate a trusted organization to trick you into revealing sensitive information.
Signs that your account number has been compromised
Watch your bank statements for charges you do not recognize, especially small recurring charges that might be easy to miss. Check for unauthorized ACH debits, unexpected wire transfers, or deposits that appear to be from unfamiliar sources. Many banks also offer real-time alerts that notify you when a transaction occurs, which can help you catch fraud quickly.
You should also monitor your credit report for accounts you did not open. If you see inquiries from lenders you did not contact, or accounts listed that are not yours, this is a sign that someone may be using your information to commit fraud.
If you notice any of these signs, contact your bank immediately. Report the unauthorized activity and ask your bank to review your account for fraud. Your bank can freeze your account, cancel your debit card, and issue a new one. You can also file a report with the Federal Trade Commission at reportfraud.ftc.gov, which creates an official record of the fraud.
What to do if you think your account has been compromised
Call your bank's fraud department right away. Most banks have a dedicated phone number for fraud reports, which is usually on the back of your debit card. Tell them what unauthorized activity you have seen and ask them to freeze your account or cancel your card. Your bank can issue a new card with a new number, which stops the criminal from making further charges.
File a dispute for each unauthorized transaction. Under federal law, you have up to 60 days from the date the unauthorized transaction appeared on your statement to report it. Your bank must investigate and typically refunds the money within 10 business days if the charge is found to be fraudulent. If the investigation takes longer, your bank must credit the money back to your account while they investigate.
If the fraud involved identity theft or new accounts opened in your name, place a fraud alert on your credit file. You can do this by contacting one of the three credit bureaus, and they will notify the others. A fraud alert requires lenders to take extra steps to verify your identity before opening new accounts, which makes it harder for a criminal to use your information.
How to reduce the risk of account number theft
Do not write your account number on checks or leave them where others can see them. Shred documents that contain your account number before throwing them away. Be cautious about what information you share online, especially on social media or public websites.
Use strong, unique passwords for your online banking account and change them regularly. Enable two-factor authentication if your bank offers it — this adds an extra verification step that makes it much harder for a criminal to log in even if they have your password. Set up account alerts so you are notified of large transactions or changes to your account settings.
Review your bank statements and credit report regularly. The sooner you catch fraud, the easier it is to resolve. Many banks offer free credit monitoring as part of their account services, which can alert you to new accounts opened in your name.
Frequently Asked Questions
Can someone transfer money out of my account with just my account number?
No, not directly. They would need your password and login credentials to access your online banking. However, they can set up unauthorized automatic payments or ACH debits using your account number and routing number, which is why you should monitor your statements closely.
Is it safe to give my account number to my employer for direct deposit?
Yes. Direct deposit is a standard, secure way to receive your paycheck. Your employer needs your account number and routing number to set this up, and this is a legitimate use of that information. Only provide it directly to your employer's payroll department, not through an unsolicited email or message.
What is the difference between my account number and my routing number?
Your routing number identifies your bank (the same routing number is used by all customers of that bank), while your account number identifies your specific account. Together, they form the information needed to send money to or from your account, but neither one alone is enough to access your account or move money.
If someone has my account number, should I close my account?
Not necessarily. Closing your account may cause problems with direct deposit, automatic bill payments, and other legitimate transactions. Instead, monitor your account closely and contact your bank if you see unauthorized activity. Your bank can issue a new debit card and help you set up fraud alerts without closing the account.
How long does it take to get my money back if there is fraud on my account?
Federal law requires your bank to refund unauthorized transactions within 10 business days if they determine the charge was fraudulent. If the investigation takes longer, your bank must credit the money back to your account while they complete their review, which can take up to 45 days total.