A bank account number alone is not enough to steal your identity or drain your account
Your bank account number and routing number are not secret in the way your password or PIN is. Checks you write have both numbers printed on them. Employers and government agencies see them when you set up direct deposit. Your bank may print them on statements you receive in the mail. Someone who has only these two numbers cannot log into your account, transfer money out, or open new accounts in your name.
That said, having your account number does create real risks—just not the ones most people worry about. The actual danger is that someone can set up unauthorized automatic payments from your account, or use the number as part of a larger fraud scheme. Understanding what is actually possible helps you know what to watch for and when to act.
Key Takeaways
- Your bank account and routing numbers alone cannot be used to log in, withdraw cash, or open new accounts in your name.
- Someone with your account number can attempt to set up automatic payments or ACH transfers from your account without your permission.
- Identity theft requires additional information—your Social Security number, name, date of birth, and often a credit inquiry—not just your account number.
- If unauthorized payments appear on your account, contact your bank immediately; federal law limits your liability if you report within 60 days.
- Monitoring your bank statements weekly is more effective than worrying about who has your account number.
What someone can do with your account number
The main risk is unauthorized ACH transfers—electronic payments pulled directly from your account. If someone has your account and routing number, they can attempt to set up a one-time payment or recurring automatic payment to themselves or a third party. This might happen if you give your account number to a business that turns out to be fraudulent, or if a legitimate business's payment system is compromised.
The second risk is that your account number becomes part of a larger identity theft scheme. By itself it proves nothing about who you are, but combined with your name, address, and Social Security number obtained from a data breach or social engineering, it can be used to open new accounts, apply for loans, or convince a bank representative that they are speaking to you.
A third, less common scenario: someone uses your account number in a check fraud scheme, writing bad checks against your account or depositing counterfeit checks and then withdrawing the funds before the fraud is discovered. This is rarer now because of digital check processing, but it still happens.
Why your account number is not enough for identity theft
True identity theft—opening credit cards, taking out loans, or filing a fraudulent tax return in your name—requires more than your account number. It requires your Social Security number, which is the key identifier that links all your financial and legal records together. It also typically requires your full name, date of birth, and sometimes your mother's maiden name or other personal details.
When someone applies for credit using your identity, the lender pulls a credit report. That report is tied to your Social Security number, not your bank account number. If a fraudster tries to use only your account number to open a credit card, the bank will reject the application because the information does not match their records.
This is why data breaches that expose Social Security numbers are treated as far more serious than breaches that expose account numbers alone. Your account number is useful information to a thief, but it is not the master key to your identity.
How to know if someone is using your account number fraudulently
Check your bank statements weekly, not monthly. Look for charges you do not recognize, especially recurring payments or ACH transfers to unfamiliar names or businesses. Many fraudulent ACH transfers are small—$5 to $50—because the fraudster is testing whether the account is active before attempting larger transfers.
Set up account alerts with your bank if the option is available. Most banks allow you to receive a notification when a transfer over a certain amount is initiated, or when any ACH payment is set up. These alerts can catch fraud before money leaves your account.
If you see an unauthorized payment, contact your bank immediately. Do not wait for the next statement. Call the number on the back of your card or on your bank's official website—not a number from an email or text, which could be fraudulent itself. Report the transaction as unauthorized and ask the bank to reverse it and investigate.
Your legal protection if unauthorized payments occur
Federal law, specifically Regulation E, limits your liability for unauthorized electronic transfers. If you report the fraud within 60 days of the statement date on which the unauthorized transfer appeared, your liability is zero—the bank must reverse the charge and return your money.
If you report after 60 days but within 120 days, your liability can be up to $500. If you report after 120 days, you may lose all protection and be liable for the full amount, depending on your bank's policies and whether the bank can prove you were negligent in protecting your account.
This is why monitoring your statements matters more than obsessing over who has your account number. The law protects you as long as you catch and report fraud promptly.
Steps to take if you think your account number has been compromised
First, contact your bank and ask them to monitor your account for suspicious activity. They can flag it internally and may increase scrutiny on transfers for a period of time.
Second, consider changing your account number. Your bank can close your current account and open a new one with a different number. This is not required, but it eliminates the risk that the old number will be used for future fraud. You will need to update direct deposit information with your employer and any automatic payments you have set up.
Third, if your account number was exposed as part of a data breach that also included your name, address, or other personal information, take steps to protect against identity theft. Place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) by contacting one of them; the alert will be shared with the others. A fraud alert requires creditors to verify your identity before opening new accounts in your name.
Fourth, monitor your credit report. You can obtain a free report from each of the three bureaus once per year at annualcreditreport.com. Look for accounts you did not open or inquiries from lenders you did not contact.
When to worry less about your account number being public
If your account number appears on a check you wrote to a business, or if you provided it to a legitimate company for direct deposit or bill payment, the risk is low. Established businesses have no incentive to commit fraud and face serious legal consequences if they do.
If your account number was exposed in a data breach but your Social Security number was not, your risk of identity theft is much lower. Monitor your statements and credit report, but you do not need to take emergency action.
If you gave your account number to someone over the phone or email because they claimed to be from your bank, that is a higher-risk situation. Legitimate banks never ask for account numbers via unsolicited contact. In that case, contact your bank directly using the number on your card or statement, report the incident, and ask them to monitor your account.
Frequently Asked Questions
Can someone drain my bank account with just my account number?
Not directly. They cannot log in or withdraw cash. They can attempt to set up automatic payments or ACH transfers, which you would see on your statement. If you report it within 60 days, the bank must reverse it and you owe nothing.
Is my account number the same as my Social Security number?
No. Your account number is specific to one bank account. Your Social Security number is a national identifier used across all financial, tax, and legal records. Social Security numbers are far more valuable to identity thieves.
What should I do if my account number was in a data breach?
Monitor your bank statements weekly for unauthorized charges. If the breach also exposed your Social Security number or name, place a fraud alert with the credit bureaus and check your credit report regularly. If you see fraud, report it to your bank within 60 days.
Do I need to close my account if someone has my account number?
Not necessarily. Closing and reopening eliminates the risk that the number will be used again, but it is inconvenient and not required by law. Monitor your account instead. Close it only if you see actual fraud or if the number was exposed in a breach that also included your Social Security number.
Can someone file taxes or get a refund using my account number?
Not with just your account number. Tax fraud requires your Social Security number, name, and date of birth. Your account number alone cannot be used to file a return or claim a refund in your name.