The short answer: not much without more information

A thief with only your account number and routing number cannot walk into a bank and withdraw money or open a new account in your name. Banks require additional verification — usually a photo ID, a signature card on file, or answers to security questions — before they hand over cash or make changes to an account.

What they can do is set up unauthorized transfers out of your account or create fraudulent checks. Both require action on your part to catch and reverse, but neither happens instantly, and both leave a paper trail.

The real risk is not the account number itself. The real risk is what someone does with it once they have it, and how quickly you notice.

Key Takeaways

  • Your account number alone cannot be used to withdraw cash at a bank or ATM, because banks require photo ID or other verification before releasing money.
  • A thief can use your account number to set up ACH transfers (electronic transfers between accounts) or create fraudulent checks, both of which take days to process and show up in your statement.
  • The window to stop unauthorized transfers is usually 24 to 48 hours after they are initiated, so catching them early matters.
  • Fraudulent checks written against your account take one to three business days to clear, giving you time to contact your bank and place a stop payment.
  • Monitoring your account weekly or setting up transaction alerts closes most of the gap between when fraud happens and when you notice it.

How someone uses your account number to move money out

The most common method is an ACH transfer — an electronic transfer between bank accounts. ACH stands for Automated Clearing House, and it is the system banks use to move money for direct deposit, bill pay, and transfers between accounts. If a thief has your account number and routing number, they can initiate an ACH transfer from your account to one they control.

The transfer does not happen instantly. ACH transfers take one to three business days to process. During that window — usually 24 to 48 hours after you notice it — you can call your bank and request a reversal. Your bank can pull the transfer back if it has not yet settled on the receiving end. After it settles, reversal becomes harder but not impossible; your bank can still file a dispute, though the receiving bank has to cooperate.

The second method is fraudulent checks. If someone has your account number, they can print checks against your account and cash them. Checks take one to three business days to clear. If you catch the fraudulent check before it clears, you can call your bank and place a stop payment on that check number. Your bank will refuse to pay it when it arrives. If the check has already cleared, your bank can still reverse it, but the process is slower and depends on the receiving bank's cooperation.

Why your account number alone is not enough for most theft

Banks have multiple layers of verification for a reason. If you walk into a branch and ask to withdraw money, the teller asks for ID. If you call the bank and ask to transfer money, they verify your identity through security questions or a callback to a number on file. If you try to change your address or add an authorized user, the bank requires written confirmation.

These steps exist because account numbers are not secret in the way passwords are. Your account number appears on every check you write, on your bank statements, and on any wire transfer confirmation you receive. It is not meant to be kept hidden the way a PIN or password is.

What is secret is your identity — your Social Security number, your date of birth, your mother's maiden name, the answers to questions only you should know. A thief with only your account number cannot prove they are you, so they cannot walk into a bank and claim your money.

What to do if you see an unauthorized transfer

Call your bank immediately. Do not wait until the next business day if you see the transfer during business hours. Most banks have a fraud line that operates during extended hours, and some operate 24/7.

Tell the bank the transfer is unauthorized and ask them to reverse it. If the transfer has not yet settled (usually within 24 to 48 hours), your bank can stop it on their end. If it has already settled, your bank can file a dispute with the receiving bank and attempt to recover the funds.

Ask your bank to place a temporary hold on your account to prevent further transfers while they investigate. Some banks do this automatically; others require you to request it. Also ask whether they will issue you a new debit card and account number, which closes off the compromised account and prevents future transfers using the old number.

Document everything: the date and time you called, the name of the person you spoke with, the confirmation number they gave you, and what they told you would happen next. Write this down immediately after the call, while you remember it.

How to catch fraud before it becomes a big problem

The faster you notice unauthorized activity, the faster you can stop it. Most banks offer transaction alerts — notifications sent to your phone or email whenever a transfer, withdrawal, or large purchase occurs on your account. Set these up for any transfer over a certain amount, or for all transfers if you do not use ACH often.

Check your account at least once a week, even if you have alerts turned on. Alerts sometimes fail to send, and you may miss a notification if it goes to spam. A weekly review takes five minutes and catches most fraud before it becomes a large loss.

If you have not used your debit card in a while, or if you are not sure whether you authorized a recent transfer, call your bank and ask. It is better to ask about a legitimate transaction and feel silly than to ignore a fraudulent one and lose money.

When your account number gets into the wrong hands

Account numbers leak in several ways: data breaches at retailers or banks, phishing emails that trick you into entering your information, checks stolen from your mailbox, or conversations overheard in public. You cannot prevent all of these, but you can limit the damage.

If you know your account number has been compromised — for example, because you received a notice of a data breach — contact your bank and ask whether they recommend closing the account and opening a new one. Some banks will do this for free; others charge a small fee. A new account number means anyone with the old number cannot use it anymore.

You can also place a fraud alert on your credit report through any of the three credit bureaus (Equifax, Experian, or TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts in your name. This does not protect your bank account directly, but it does prevent someone from using your personal information to open credit cards or take out loans.

The difference between account number theft and identity theft

Account number theft is when someone uses your bank account number to move money out of your existing account. Identity theft is when someone uses your personal information — your name, Social Security number, date of birth — to open new accounts or take out loans in your name.

Account number theft is usually faster to catch and reverse, because the fraud shows up in your own account statement within days. Identity theft can go unnoticed for months or years, because the fraudulent accounts are in your name but you do not receive the statements.

If you suspect identity theft, place a credit freeze with all three credit bureaus. A credit freeze prevents anyone — including you — from opening new accounts using your Social Security number without first unfreezing your credit. This is free and takes about 15 minutes per bureau.

Frequently Asked Questions

Can someone use my account number to make online purchases?

Not directly. Online retailers require a full card number, expiration date, and CVV code — not a bank account number. However, if someone has your account number and routing number, they can set up ACH transfers to pay for things, or they can create fraudulent checks. Both take days to process, giving you time to stop them.

What if I gave my account number to someone and now I'm worried?

Call your bank and describe the situation. If you gave your account number to a legitimate business (a payroll processor, an insurance company, a utility), there is usually no risk. If you gave it to someone you do not know or in response to an unsolicited email or call, ask your bank whether they recommend closing the account. Many banks will do this at no cost if you suspect compromise.

Do I need to close my account if my account number was in a data breach?

Not necessarily. Most data breaches of bank account numbers do not result in fraud, because the thief still needs additional information to move money. Monitor your account closely for 30 to 60 days after the breach. If you see no unauthorized activity, the risk has likely passed. If your bank offers a free account closure and new account opening, you can do it for peace of mind.

How long does it take to get money back after unauthorized transfer?

If you catch it within 24 to 48 hours and the transfer has not yet settled, your bank can reverse it immediately — usually within one business day. If the transfer has already settled, your bank files a dispute with the receiving bank, which can take 10 to 30 days. If the receiving bank cooperates, you get your money back. If they do not, the process can take longer or fail entirely.

Should I get a new account number even if there's been no fraud?

Only if your bank recommends it or if you know your account number was compromised in a breach. Changing your account number is inconvenient — you have to update direct deposits, automatic bill payments, and any other recurring transfers. Do it only if there is a real reason to believe your account is at risk.