Your account number alone is not enough to drain your bank account, but it is enough to cause real problems
A thief who has only your account number and routing number cannot log into your online banking or transfer money out on their own. Banks require additional verification—usually a password, PIN, or one-time code sent to your phone—before they move money. That said, your account number is sensitive information. Someone with it can set up unauthorized automatic payments from your account, file a false claim against you, or use it as part of a larger fraud scheme. The risk is real, but it is different from the risk of someone simply guessing your password.
The key difference is between pull transactions and push transactions. A pull transaction (like logging in and transferring money) requires your password. A push transaction (like someone else initiating a payment from your account) sometimes requires only your account number, routing number, and your name—information that is often already public or easy to find.
Key Takeaways
- Someone with your account number cannot log into your bank account or transfer money without your password, but they can set up recurring payments that pull money out.
- Unauthorized ACH transfers and automatic bill payments are the most common fraud using account numbers alone, and they can take days to reverse.
- Your bank is required to refund fraudulent ACH transfers if you report them within a specific window, but the process is not automatic.
- Protecting your account number means treating it like sensitive information—do not share it with people you do not know, and do not write it on checks unless necessary.
How someone can use your account number to pull money out
The most common attack is setting up an ACH transfer (Automated Clearing House transfer) or recurring bill payment using your account number. ACH transfers move money between bank accounts and are used for payroll, bill payments, and peer-to-peer transfers. To start an ACH transfer, a fraudster typically needs your name, account number, and routing number—all of which can be gathered from a check, a bank statement left in the trash, or public records.
Once they have that information, they can contact a biller (a utility company, loan servicer, or online payment processor) and set up a payment from your account. Many billers do not verify the account holder's identity beyond checking that the name matches the account. The payment then pulls money directly from your account. You might not notice for days or weeks, depending on how often you check your balance.
A second method is check fraud. If someone has your account number, they can print counterfeit checks or alter legitimate ones and cash them at a store or deposit them into their own account. This is why account numbers appear on the bottom of checks—they are designed to be readable by machines, not kept secret.
What happens if someone sets up unauthorized payments
If you discover an unauthorized ACH transfer or bill payment, contact your bank immediately. Under the Electronic Funds Transfer Act (EFTA), your bank must investigate and refund the money if you report it within 60 days of the transaction appearing on your statement. If you report it within two business days, your liability is capped at $50. If you wait longer, you may be liable for up to $500 of the fraudulent transfer.
The refund process usually takes 10 business days, though it can stretch to 45 days if the bank needs to investigate further. During that time, the money is gone from your account. If the fraudulent payment causes overdraft fees or bounced checks, you may be able to have those fees reversed as well, but you have to ask.
For check fraud, the timeline is longer. If someone cashes a counterfeit check drawn on your account, your bank will eventually discover it when the check clears and the other bank realizes the signature or account number does not match their records. This can take weeks. Once discovered, the bank will reverse the transaction, but you may see temporary overdrafts in the meantime.
Why your bank account number is on your checks
Your account number and routing number are printed on every check you write because they are necessary for the check to work. When you hand someone a check, you are giving them your account number. This is why checks are considered less secure than other payment methods—anyone who receives a check from you has your account number.
This does not mean you should never write checks. It means you should be thoughtful about who you give them to. Paying a utility company or a known business with a check is low-risk because those organizations have fraud prevention systems and are unlikely to misuse your account number. Giving a check to a stranger or a business you do not trust is riskier.
Online, your account number is sometimes required to set up direct deposit, authorize a payment, or verify your identity. The difference between a legitimate request and a fraudulent one is often subtle. Legitimate businesses usually ask for your account number only when you initiate the transaction. Scammers often call or email you asking for it unprompted.
Steps to take if you think your account number has been compromised
If you believe your account number has been stolen or misused, start by reviewing your bank statements for the past 60 days. Look for ACH transfers, bill payments, or checks you did not authorize. Many banks offer free monitoring tools that alert you to large or unusual transactions.
If you find fraud, contact your bank by phone—not by email or through the website. Use the phone number on the back of your debit card or on your bank statement, not a number from a search result. Tell the bank representative what happened and ask them to freeze your account or flag it for fraud. They will open an investigation and send you a form to sign confirming that the transaction was unauthorized.
Consider changing your online banking password and any PINs associated with your account. If the same password is used on other accounts, change those too. If your physical checks were stolen or compromised, ask your bank to stop payment on the old check stock and order new checks with a different account number or routing number (some banks can issue a new account number without closing your account).
You do not need to close your account unless the fraud is ongoing or your bank recommends it. Closing the account stops the bleeding, but it does not undo the fraud or speed up the refund process.
How to protect your account number from being stolen
Treat your account number the way you treat your Social Security number—as sensitive information that you share only when necessary and only with people or organizations you trust. Do not write it on envelopes, post it online, or leave bank statements lying around. Shred statements and old checks before throwing them away.
When you pay bills online, use your bank's bill pay service or the biller's official website rather than sending checks through the mail. Mail theft is a real problem, and checks are vulnerable. If you must mail a check, mail it from a post office mailbox rather than leaving it in your home mailbox for pickup.
Be cautious when someone asks for your account number over the phone or email. Legitimate businesses rarely ask for it unprompted. If you are unsure, hang up and call the business directly using a phone number you find yourself (not one they provide). Scammers often pose as banks, utilities, or government agencies.
Monitor your credit report for signs of identity theft. You can get a free credit report once per year from each of the three major credit bureaus (Equifax, Experian, and TransUnion) at annualcreditreport.com. Look for accounts you did not open or inquiries you did not authorize.
The difference between account number fraud and identity theft
Account number fraud is when someone uses your account number to pull money out of your existing account. Identity theft is when someone uses your personal information (name, Social Security number, date of birth) to open new accounts in your name. The two often happen together, but they are different crimes with different consequences.
If your account number is compromised but your identity is not, the damage is usually limited to unauthorized transactions on that one account. Your bank is required to refund ACH fraud, and the process, while annoying, is straightforward. If your identity is stolen, the damage can be much broader—new credit cards, loans, or accounts opened in your name, damage to your credit score, and a longer recovery process.
Protecting your account number is one part of protecting yourself. The other parts are protecting your Social Security number, monitoring your credit, and being cautious about what personal information you share online and offline.
Frequently Asked Questions
Can someone transfer money out of my account with just my account number?
Not directly. They cannot log into your online banking or use an ATM with just your account number. However, they can set up an ACH transfer or bill payment that pulls money from your account, which is why you should treat your account number as sensitive information and monitor your statements regularly.
How long does it take to get my money back if someone fraudulently transferred it?
Your bank must investigate and refund the money within 10 business days if you report it quickly, though the investigation can extend to 45 days in some cases. The sooner you report it, the sooner the process starts. Report fraud by phone, not email or online chat.
What should I do if I gave my account number to someone I do not trust?
Monitor your bank statements closely for the next 60 days and set up transaction alerts if your bank offers them. You do not need to close your account unless fraud actually occurs. If you see unauthorized transactions, contact your bank immediately and report them as fraud.
Is it safe to write checks if my account number is on them?
Checks are reasonably safe if you give them to people you trust or established businesses. The risk comes from lost or stolen checks, or from giving checks to strangers. If you are concerned, use your bank's bill pay service or online payment instead.
Can my bank hold me responsible for ACH fraud?
No, not if you report it within 60 days. Your liability is capped at $50 if you report within two business days, and up to $500 if you report later. Your bank is required to refund the full amount of the fraudulent transfer under federal law.