A hacker cannot drain your account with only your account number
Your bank account number alone is not enough for someone to withdraw money or transfer funds out of your account. Banks use multiple verification steps before moving money — they need your password, a second form of identification, or authorization through your online banking system. A criminal with only your account number cannot log into your account, approve transfers, or tell your bank to send money anywhere.
That said, your account number is not completely harmless information. It can be used in specific ways that create real problems, and you should know what those are and how to protect yourself.
Key Takeaways
- Someone with only your account number cannot withdraw money or transfer funds without also having your password and access to your online banking.
- A criminal can use your account number to set up unauthorized ACH transfers or bill payments if they also have other personal details like your name and address.
- The fastest way to stop unauthorized activity is to call your bank directly using the number on your debit card or statement, not a number from an email or text.
- Your bank is required to refund fraudulent ACH transfers and unauthorized bill payments within specific timeframes, usually 10 business days.
- Monitoring your account regularly and setting up transaction alerts catches problems before they become large losses.
What a criminal can do with your account number and other details
If someone has your account number and knows your name, address, and possibly your phone number, they can attempt to set up an ACH transfer — an electronic transfer between bank accounts. They can also try to create bill payments through your bank's bill pay system. These are not instant; they take one to three business days to process, which gives you time to catch and stop them if you monitor your account.
The criminal does not need your password to start an ACH transfer or bill payment in many cases. They are betting that the transfer will go through before you notice it, or that you will not dispute it. If you do notice and report it to your bank within the timeframe required by law, your bank must refund the money.
A second risk is that someone could use your account number to set up a direct deposit in your name — for example, redirecting a paycheck or government payment to an account they control. This requires your account number and usually your routing number, but not your password. Again, you would catch this when your expected deposit does not arrive.
Why your password and login access matter much more
If a criminal has your account number and your online banking password, the risk jumps dramatically. They can log into your account, see your balance, set up transfers, and authorize payments without your knowledge. This is why your password is the most valuable piece of information a criminal can steal.
Passwords are usually stolen through phishing emails, fake login pages, or malware on your computer. If you receive an email claiming to be from your bank and asking you to "verify your account" or "confirm your password," do not click any links. Call your bank using the number on your debit card instead.
How to monitor your account and catch problems early
The best defense is regular monitoring. Log into your online banking at least once a week and review recent transactions. Look for transfers or bill payments you did not authorize, even small ones — criminals sometimes test with small amounts first to see if you are paying attention.
Set up transaction alerts through your bank's app or website. Most banks let you choose alerts for transfers over a certain amount, bill payments, or any login from a new device. These alerts arrive by text or email within minutes of the activity, so you can call your bank immediately if something is wrong.
If you see an unauthorized ACH transfer or bill payment, call your bank right away using the number on your debit card or statement. Do not use a phone number from an email or text message, because that could be a fake number set up by the criminal. Tell your bank the transaction is unauthorized and ask them to reverse it.
Your bank's responsibility to refund unauthorized transfers
Federal law requires banks to refund unauthorized ACH transfers and bill payments. The exact timeline depends on when you report the fraud. If you report it within two business days, your bank must refund the money within 10 business days. If you report it after two business days but within 60 days, your bank still must refund it, but they have up to 10 business days to investigate first.
Wire transfers and transfers made through your bank's app or website have different rules and shorter windows for disputing them — sometimes as little as one day. This is why it is important to report any suspicious activity as soon as you see it.
Keep records of your report: the date you called, the name of the person you spoke to, and what they told you. Ask your bank to send you written confirmation of the dispute and the refund timeline. If your bank does not refund the money within the required timeframe, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator.
Steps to take if you think your account number has been compromised
If you believe your account number has been stolen — for example, from a data breach at a store or website — you do not need to close your account immediately. Instead, contact your bank and ask them to monitor your account for suspicious activity. Many banks offer free fraud monitoring services.
You can also request a new debit card and account number, though this is not required. A new account number will stop any ACH transfers or bill payments set up with the old number, but it will not undo transfers that have already been processed.
Check your credit report through AnnualCreditReport.com (the only free, official source) to see if anyone has opened accounts in your name. If you see fraudulent accounts, place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name.
Protecting your account number going forward
Treat your account number like you treat your address — it is not secret, but you should not hand it out casually. Only provide it to people and organizations you trust: your employer for direct deposit, your landlord for rent payments, or your utility company for bill payments.
When you write a check, your account number is printed on it, so anyone who handles that check can see it. This is normal and expected. Be more cautious about giving your account number over the phone or through email unless you initiated the contact and you are certain you are talking to a legitimate business.
If you receive a call or email asking for your account number, do not provide it. Legitimate banks and businesses will not ask for sensitive information this way. If you are unsure, hang up and call the organization back using a number you know is real — from their official website or your statement.
Frequently Asked Questions
Can someone use my account number to open a new bank account in my name?
Not with just your account number. Opening a new account requires a government ID, Social Security number, and proof of address. Your account number alone is not enough. However, if a criminal has your full name, address, and Social Security number, they could attempt to open accounts in your name, which is why monitoring your credit report matters.
What if I gave my account number to someone and now I am worried?
Call your bank and tell them you are concerned about your account number. Ask them to watch for unauthorized activity and to alert you if any transfers or bill payments are set up. You can also request a new account number if it makes you feel safer, though this is optional. Monitor your account closely for the next 30 days.
Is it safe to write checks if my account number is on them?
Yes. Your account number is printed on every check you write, and this is expected and normal. Anyone who handles a check can see it. The risk is low because a criminal would still need to forge your signature or set up an ACH transfer, both of which take time and can be caught if you monitor your account.
How long does it take for an unauthorized ACH transfer to go through?
ACH transfers typically take one to three business days to process. This means you have time to notice the transfer and call your bank to stop it before the money leaves your account. Check your account at least once a week to catch problems early.
What should I do if my bank refuses to refund an unauthorized transfer?
Document everything: the date of the transfer, the amount, the date you reported it, and the name of the bank employee you spoke to. Send a written dispute letter to your bank's fraud department, certified mail with return receipt. If your bank still refuses, file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov or with your state's banking regulator.