The short answer: they can attempt a withdrawal, but your bank has fraud protections that make it harder than you might think
A checking account number alone—without your routing number, name, or other identifying details—is not enough for someone to drain your account. However, a checking account number combined with your routing number (which is often public information) does create real risk. Someone with both pieces can attempt an ACH debit, which is an electronic withdrawal from your account. Whether it succeeds depends on your bank's fraud filters, how quickly you notice, and what you report.
The risk is real but not automatic. Banks are required by federal law to reverse unauthorized ACH debits under certain conditions, and most have additional fraud detection systems in place. The key is knowing what to watch for and what to do if you spot something wrong.
Key Takeaways
- Someone with your account number and routing number can attempt an ACH debit, but most banks catch these before they clear or reverse them quickly if reported.
- Your account number alone, without a routing number, is much less useful to a thief and typically cannot be used to pull money out.
- Federal law (Regulation E) requires banks to reverse unauthorized ACH debits if you report them within 60 days, and many banks reverse them within one to three business days.
- Monitoring your account regularly and setting up low-balance alerts can catch unauthorized activity before significant money leaves.
- If someone obtains both your account and routing number, contact your bank immediately to place a fraud alert or request a new account number.
What an ACH debit is and how it works
An ACH debit is an electronic transfer that pulls money directly from your checking account. It is different from a wire transfer or a credit card charge. ACH stands for Automated Clearing House, and it is the system banks use for direct deposit, bill payments, and transfers between accounts.
To initiate an ACH debit, someone needs your account number and routing number. They do not need your PIN, your password, or your permission. They submit the debit request to their bank, which then contacts your bank and asks for the money. Your bank's fraud detection system reviews the request. If it looks suspicious, the bank may block it. If it passes, the money moves out of your account within one to three business days.
This is why ACH fraud is a real concern—the barrier to entry is low, and the money can move before you notice. However, it is also why federal law requires banks to reverse these transfers if you report them in time.
What thieves can and cannot do with just your account number
Your checking account number alone is not enough to pull money out. A thief needs both your account number and your routing number. Your routing number is the nine-digit code that identifies your specific bank branch. Many routing numbers are public—they appear on checks, on your bank's website, and in online directories. If someone has your account number but not your routing number, they would have to guess or search for it, which is possible but adds friction.
If someone has both numbers, they can attempt an ACH debit. They cannot walk into a branch and withdraw cash, because they do not have your ID. They cannot use a debit card, because they do not have the card itself. They cannot access your online banking, because they do not have your login credentials. An ACH debit is the main risk.
There is also a small risk of check fraud. If someone has your account number, they could theoretically print counterfeit checks and try to cash them. However, this requires more effort and leaves a paper trail. Most banks catch counterfeit checks quickly, especially if the signature does not match.
How banks detect and stop unauthorized ACH debits
Banks use fraud detection software to flag suspicious ACH requests before they clear. The software looks for patterns: Is the debit amount unusual? Is it going to an account the customer has never used before? Is the timing odd? If the software flags the request, the bank may block it or call you to confirm.
Not all banks have the same level of fraud detection, and not all suspicious requests are caught. Some unauthorized debits do go through. This is why monitoring your account is important. Most banks let you set up low-balance alerts or transaction alerts through their app or website. These send you a text or email whenever money leaves your account, so you can spot fraud quickly.
If an unauthorized debit does clear, federal law protects you. Under Regulation E, your bank must reverse the transaction if you report it within 60 days. Most banks reverse unauthorized ACH debits within one to three business days. Some do it faster. The money goes back into your account, and the bank investigates the source of the fraud.
What to do if you think someone has your account number
If you believe your account number has been compromised—because you shared it with someone you no longer trust, or because you saw it on a phishing email, or for any other reason—contact your bank immediately. Do not wait to see if fraud happens. Call the number on the back of your debit card or log into your online banking and use the fraud reporting tool.
Your bank can take several steps. They can place a fraud alert on your account, which flags any unusual activity for manual review. They can issue you a new account number and debit card. They can also block ACH debits from unknown sources, though this may prevent legitimate payments like bill pay or direct deposit, so ask your bank what options are available.
If you have already seen unauthorized transactions, report them to your bank and provide as much detail as you can: the date, the amount, and where the money went if you know. Your bank will start an investigation and reverse the charge under Regulation E. Keep records of all communication with your bank, including the date you called, the name of the person you spoke to, and what they told you.
Protecting your account number from exposure
Your account number appears on checks, so be careful who you give checks to. Do not leave blank checks lying around. If you pay bills by check, use a locked mailbox or mail them from the post office rather than leaving them in your home mailbox.
Be cautious about sharing your account number online. Legitimate businesses—your employer, your utility company, your bank—may ask for it to set up direct deposit or automatic payments. Verify that you are on their official website or speaking to a real representative before you share. Do not give your account number to someone who contacts you unsolicited, even if they claim to be from your bank.
Phishing emails and texts often ask for account numbers. If you receive an email or text claiming to be from your bank and asking you to "verify" your account number, do not respond. Go directly to your bank's website or call the number on your debit card. Real banks do not ask for account numbers via email or text.
What happens if fraud goes through and you report it late
If you report an unauthorized ACH debit more than 60 days after it cleared, your bank is no longer required by federal law to reverse it. However, many banks have their own fraud policies that extend beyond 60 days. Call your bank and ask. Some will reverse the charge as a courtesy, especially if it is your first fraud claim.
If your bank refuses to reverse it and you believe the charge was truly unauthorized, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. These agencies investigate complaints and can pressure banks to reverse charges or refund customers. Filing a complaint does not may provide a reversal, but it creates a record and may help if this happens again.
Frequently Asked Questions
Can someone use my account number to make an online purchase?
Not directly. Online purchases typically require a credit card number, not a checking account number. However, some online payment services (like PayPal or Venmo) can be linked to a checking account. If someone gains access to one of these accounts, they could potentially use your linked checking account to send money. This is different from using the account number itself.
What if I gave my account number to someone and now I'm worried?
Call your bank right away and tell them you shared your account number with someone you no longer trust. Ask them to place a fraud alert or issue you a new account number. Do not wait for fraud to happen. Your bank can take preventive steps, and acting quickly shows you were diligent if fraud does occur later.
How long does it take for an unauthorized ACH debit to show up in my account?
ACH debits typically take one to three business days to clear. This means the money may not leave your account immediately. If you catch the fraud before it clears, your bank may be able to stop it entirely. Check your account regularly, especially if you know your account number has been compromised.
Will my bank refund me if I report fraud after 60 days?
Your bank is not required to by federal law, but many banks will reverse the charge anyway, especially if it is your first fraud claim. Call your bank and explain the situation. If they refuse, you can file a complaint with the CFPB or your state's banking regulator, though this does not may provide a refund.
Is it safer to give out my routing number instead of my account number?
No. Your routing number is often public information, and it is less useful to a thief on its own. However, do not share either number with someone you do not trust. If someone has both, they can attempt an ACH debit. Share both only with businesses you know and trust.