Yes, but not in the way most people fear
A bank account number alone—without your routing number—is not enough to drain your account or make purchases. Banks need both pieces of information to move money out, and even then, the transaction usually leaves a paper trail that makes it recoverable. That said, someone with your account number can still cause real problems: set up automatic bill payments in your name, sign you up for subscriptions, or deposit bad checks that you'll be held responsible for later.
The actual risk depends on what else they have. Your account number by itself is like having your mailing address—it identifies where you are, but not who you are. Your routing number, on the other hand, is public information printed on every check. Together, they're enough to initiate an ACH transfer (an electronic bank-to-bank payment), but most banks now require additional verification before allowing outgoing transfers from an account that hasn't been used before.
Key Takeaways
- Someone with only your account number cannot withdraw money or make purchases without also having your routing number and passing additional bank verification.
- The real risk is unauthorized bill payments, subscription charges, or fraudulent deposits that you become liable for.
- ACH transfers initiated with your account and routing number can often be reversed within a few days if you report them immediately.
- Monitoring your bank statements weekly and setting up account alerts catches fraud faster than waiting for a monthly statement.
- Your bank is required to investigate unauthorized transactions and may reverse them, but you must report them within a specific window—usually 30 to 60 days.
What fraudsters can actually do with your account number
The most common misuse is setting up recurring charges without your permission. Someone with your account number can attempt to enroll you in gym memberships, streaming services, or subscription boxes using ACH payments. These charges often go unnoticed for weeks because they're small and blend into a normal statement. By the time you see them, the fraudster has already collected several months of payments.
Another risk is fraudulent deposits. A scammer might deposit a bad check or stolen funds into your account, then contact you claiming you've received a refund or prize money. They ask you to wire back a portion or pay a "processing fee." When the deposit bounces days later, your bank holds you responsible for the full amount, even though you never initiated the deposit.
ACH transfers out of your account are possible if someone has both your account and routing number, but most banks now flag transfers to new recipients or amounts above a certain threshold. You'll often receive a notification or be asked to verify the transfer through your phone or email before it goes through. If you don't recognize it, you can stop it before it clears.
How banks verify transfers before they happen
Modern banks use several layers of verification to prevent unauthorized outgoing transfers. When someone tries to move money out of your account to a new recipient for the first time, the bank may require you to confirm it through your phone, email, or a code sent to your registered device. This is called multi-factor authentication, and it's now standard at most major banks.
Some banks also use velocity checks—they flag transfers that are unusually large, happen at odd times, or go to destinations you've never sent money to before. A $50 transfer to a new account might go through automatically, but a $5,000 transfer will likely trigger a hold and a call to you asking if you authorized it.
The key point: if someone has only your account number and not your password, phone, or email access, they cannot complete an outgoing transfer without you noticing. The bank will contact you to verify, and you can refuse.
What to do if you think your account number has been compromised
Start by reviewing your last three months of bank statements line by line. Look for small recurring charges you don't recognize, not just large withdrawals. Many fraudsters test with small amounts first—$1.99 or $4.99—to see if you're paying attention before escalating.
Contact your bank immediately if you find unauthorized transactions. You have a legal window to report fraud: typically 30 to 60 days from the date the statement was issued. Report it sooner rather than later, because banks investigate faster when you call within the first week. Have your statement in front of you and be ready to describe each fraudulent transaction by date and amount.
Ask your bank to reverse the fraudulent charges. Under federal law (Regulation E), your bank must investigate and usually reverse unauthorized ACH transfers within 10 business days if you reported them on time. For credit card fraud, the window is longer and the protections are stronger, but for bank account fraud, speed matters.
After the reversal, ask your bank whether you should close the account and open a new one. If the fraud was minor and isolated, you may not need to. If it was extensive or ongoing, a new account number gives you a fresh start. Your bank can transfer your direct deposits and automatic bill payments to the new account.
How to prevent misuse of your account number
Never share your account number with anyone you don't trust completely—not over the phone unless you initiated the call, not in an email, and not on social media or public forums. Legitimate businesses that need your account number will ask for it through a secure channel, usually their website or a phone number you find yourself.
Be cautious about where you write checks. Checks display both your account and routing number, so don't leave them in an unsecured mailbox or hand them to someone you don't know. If you're paying a bill by check, mail it from a postal service mailbox or hand it directly to the business.
Set up account alerts through your bank's app or website. Most banks let you receive a text or email notification whenever a transaction over a certain amount occurs, or whenever any ACH transfer is initiated. These alerts often arrive within minutes, giving you time to stop a fraudulent transfer before it clears.
Monitor your statements weekly instead of waiting for the monthly statement. Log into your bank account online or through the app and scan for charges you don't recognize. The sooner you spot fraud, the sooner you can report it and the easier it is for your bank to reverse it.
The difference between account number fraud and identity theft
Account number fraud is limited to your bank account. Someone uses your account number to make unauthorized charges or transfers, but they're not opening new accounts in your name or applying for credit cards. The damage is contained to one account, and reversals are usually straightforward.
Identity theft is broader. A fraudster uses your personal information—name, Social Security number, date of birth—to open new credit accounts, take out loans, or file false tax returns in your name. This can take months or years to unravel and requires credit monitoring, fraud alerts, and sometimes a police report.
If you discover account number fraud, you don't automatically have identity theft. But if you also notice credit inquiries you didn't authorize, new accounts you didn't open, or collection calls for debts you don't recognize, you may have both. In that case, place a fraud alert with the credit bureaus and consider a credit freeze.
What your bank is legally required to do
Under Regulation E (part of the Electronic Funds Transfer Act), your bank must investigate any unauthorized transaction you report within a specific timeframe. For most ACH transfers, the bank has 10 business days to investigate and either reverse the charge or explain why they won't.
Your liability is limited. If you report the fraud within two business days of discovering it, you're liable for no more than $50 of unauthorized transfers. If you wait longer but report within 60 days, your liability can be up to $500. If you wait more than 60 days, you may lose all protection, depending on your bank's policy.
The bank must provide you with a written explanation of their investigation, including the date they completed it and whether they reversed the charge. If they refuse to reverse it, they must explain their reasoning in writing. You have the right to dispute their decision and ask for a second review.
Frequently Asked Questions
Can someone use my account number to open a new bank account in my name?
No. Opening a new account requires a government ID, Social Security number, and usually a phone call or in-person visit. Your account number alone is not enough. However, if someone has your full personal information, they could open an account and use it fraudulently, which is identity theft rather than account number fraud.
What if I gave my account number to a business and they charged me without permission?
Contact the business first and ask them to reverse the charge. If they refuse, contact your bank and report it as an unauthorized ACH transfer. Your bank will investigate and can reverse it if you reported it within 60 days. You may also be able to dispute the charge through your bank's dispute process.
Is my account number visible to other people when I write a check?
Yes. Your account number and routing number are printed on every check. Anyone who handles the check can see both numbers. This is why you should never leave blank checks in an unsecured location and should mail checks from a secure mailbox rather than leaving them in your home mailbox.
Do I need to close my account if someone has my account number?
Not necessarily. If the fraud was minor and you've reported it, your bank can reverse the charges and monitor the account for further activity. Close the account only if the fraud was extensive, ongoing, or if you feel unsafe keeping it open. Your bank can help you transfer direct deposits and automatic payments to a new account if you decide to close it.
How long does it take for my bank to reverse a fraudulent charge?
Most banks complete their investigation within 10 business days and reverse the charge if they find it was unauthorized. However, the money may take an additional 1 to 3 business days to appear back in your account after the reversal is approved. Some banks credit your account provisionally while they investigate, so you may see the money sooner.