Yes, someone can steal money using your account and routing number alone
Your bank account number and routing number are enough for someone to set up an unauthorized ACH transfer (Automated Clearing House) out of your account. They do not need your PIN, password, or debit card. They do not need to know your Social Security number. With just those two pieces of information, a person can attempt to pull money directly from your checking or savings account.
The risk is real but not unlimited. Banks have fraud detection systems that catch many unauthorized transfers before they clear. You also have legal protections under federal law that limit your liability if you report the theft quickly. But the window for stopping the transfer is narrow — sometimes only hours — so knowing what to watch for matters.
Key Takeaways
- An ACH transfer requires only your account number and routing number; a thief does not need your password or PIN to attempt one.
- Your liability for unauthorized ACH transfers is capped at $50 if you report the fraud within two business days of discovering it.
- Banks can sometimes reverse a transfer that has already cleared, but the window to stop it is often just a few hours.
- Sharing your account and routing number for legitimate purposes (direct deposit, bill pay) carries minimal risk if you share only with trusted organizations.
- Monitor your account daily and set up transaction alerts so you catch unauthorized transfers before they clear.
How an ACH transfer works without your permission
An ACH transfer is a bank-to-bank electronic payment. When you set up direct deposit at work, you give your employer your account and routing number. When you pay a bill online, you give the biller those same numbers. The system assumes that if someone has those numbers and initiates a transfer, they have your permission.
A thief who obtains your account and routing number can pose as you and initiate an ACH transfer to their own account at a different bank. They do not log into your account. They do not use your online banking credentials. They simply submit a transfer request to the ACH network, claiming to be the account holder. The ACH system processes it like any other transfer.
The transfer typically clears within one to two business days. During that window, your bank may catch it as fraudulent and block it. If it clears, your bank can still attempt to reverse it, but the thief's bank may have already moved the money or closed the account.
Where thieves get your account and routing number
Sharing your account and routing number is necessary for legitimate purposes. Your employer needs it for direct deposit. Your landlord or mortgage lender needs it for automatic payments. Utilities, insurance companies, and subscription services all ask for it. These are safe transactions when you initiate them with organizations you trust.
Thieves obtain the numbers through data breaches at companies that store them, by intercepting mail containing checks (which display both numbers), by posing as a business and asking you to provide them, or by accessing your bank statements if they have physical access to your home or email. Some people post photos of checks on social media without realizing the numbers are visible.
The risk is higher if you share the numbers with someone you do not know, with a business that contacted you unsolicited, or if you write a check to a stranger and they photograph it.
Your liability if money is stolen from your account
Federal law (Regulation E) caps your liability for unauthorized ACH transfers. If you report the fraud within two business days of discovering it, you are liable for no more than $50. If you report it after two business days but within 60 calendar days, you may be liable for up to $500. If you wait longer than 60 days, you may lose all protection.
In practice, many banks waive the $50 fee and cover the full amount if you report it promptly. But the law does not require them to. The key is speed: the moment you notice a transfer you did not authorize, contact your bank.
Your bank will open a dispute, freeze your account if necessary, and attempt to recover the money from the receiving bank. If the receiving bank can retrieve it before the thief withdraws it, you get the money back. If the thief has already moved it, recovery is harder but still possible, especially if law enforcement becomes involved.
How to catch unauthorized transfers before they clear
The best defense is daily monitoring. Log into your bank account every morning and check for transactions you do not recognize. Many unauthorized ACH transfers happen overnight and clear the next business day, so catching them within hours gives your bank the best chance to stop them.
Set up transaction alerts through your bank's app or website. Most banks let you receive a text or email notification whenever a transfer over a certain amount leaves your account. Choose a threshold low enough to catch most fraudulent transfers but high enough that you do not get alerts for every legitimate transaction. For many people, $100 or $200 is a reasonable starting point.
If you see a transfer you did not authorize, call your bank immediately — not the number on the back of your card, but the number on your statement or the bank's official website. Tell them the transfer is unauthorized and ask them to reverse it. If it has not cleared yet, they can stop it. If it has cleared, they can initiate a recall.
Steps to take if your account and routing number are compromised
If you believe your account and routing number have been stolen — because you see an unauthorized transfer, because you received a data breach notice from a company, or because you shared them with someone you no longer trust — contact your bank immediately. Do this even if you have not yet seen fraudulent activity. Your bank can flag your account for monitoring and may issue you a new account number.
Ask your bank whether they recommend closing the account and opening a new one. Some banks do this automatically for compromised accounts; others only if you request it. A new account number means any thief with the old number cannot use it anymore.
File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help if the thief opens other accounts in your name. If the theft involves a large amount or multiple transfers, also file a police report in your jurisdiction.
Check your credit report at AnnualCreditReport.com (the only free, official source) to see whether anyone has opened accounts in your name. You can place a fraud alert on your credit file, which requires creditors to verify your identity before opening new accounts.
When sharing your account and routing number is safe
Sharing your account and routing number is safe when you initiate the transaction with an organization you know and trust. Giving your employer your account number for direct deposit is safe. Providing it to your bank for bill pay is safe. Sharing it with your mortgage lender, insurance company, or utility is safe if you called them or went to their official website.
The risk is low because these organizations have security measures, regulatory oversight, and no incentive to steal from you. They also keep the numbers in secure systems and do not share them with third parties without your permission.
Do not share your account and routing number with someone who contacted you unsolicited, even if they claim to be from your bank or a government agency. Do not share it in response to an email or text message. Do not post photos of checks on social media. Do not write checks to people you do not know well. These are the scenarios where theft is most likely.
Frequently Asked Questions
Can someone open a new bank account using my account and routing number?
No. Opening a bank account requires identity verification — a government ID, Social Security number, and often a credit check. Your account and routing number alone are not enough. A thief would need additional personal information to impersonate you for account opening.
What if I gave my account number to someone and now I'm worried?
Contact your bank and describe the situation. If you gave it to a legitimate business (your employer, a utility company), the risk is minimal. If you gave it to someone you met online or do not fully trust, ask your bank to monitor your account closely or issue you a new account number. Watch your account daily for unauthorized transfers.
How long does it take for an ACH transfer to clear?
Most ACH transfers take one to two business days to clear. Some banks process them faster. During this window, your bank can stop the transfer if they identify it as fraudulent. After it clears, reversal is still possible but takes longer and depends on whether the receiving bank cooperates.
Will my bank refund me if I report fraud after three days?
Possibly, but you lose the legal may provide. Federal law requires banks to cover unauthorized transfers reported within two business days. After that, your bank may still refund you, but they are not required to. Some banks have their own policies that are more generous. Contact your bank to ask about their specific fraud policy.
Is it safer to use a different account for online bill pay?
Not significantly. The risk of ACH fraud is low if you use your account only with trusted organizations. Keeping a separate account does not reduce your liability — it just means a thief would need to compromise both accounts to steal more money. Focus instead on monitoring your account daily and setting up alerts.