A bank account number alone is not enough to steal your identity or drain your account
Your bank account number and routing number are not secret in the way your password or PIN is. Businesses you pay by check have both numbers printed on the bottom of every check you write. Your employer has them to set up direct deposit. Utility companies and subscription services have them to pull payments. None of these organizations can access your account or move money without additional information or authorization from your bank.
Someone who has only your account and routing numbers cannot log into your account, transfer money out, or open new accounts in your name. They cannot make purchases or take out loans using that information alone. What they can do is limited, and what your bank can do to stop them is specific.
Key Takeaways
- Your account number and routing number are routinely shared with employers, billers, and anyone you pay by check, and they do not grant access to your account.
- Someone with these numbers can attempt unauthorized ACH transfers or set up fraudulent bill payments, but your bank can reverse these and is required to investigate.
- Identity theft requires additional personal information—your name, address, Social Security number, or date of birth—not just your bank details.
- If you notice unauthorized transactions, contact your bank immediately; federal law limits your liability if you report within 60 days.
- Monitoring your account regularly and setting up transaction alerts are the most effective ways to catch fraud early.
What an unauthorized person can attempt with your account number
The main risk with a bank account number is unauthorized ACH transfers—electronic transfers pulled directly from your account. Someone could try to set up a one-time transfer or recurring payments to move money out. They could also attempt to create fraudulent bill payments through your bank's bill pay system, or set up fake automatic payments to themselves.
These attempts usually fail because your bank requires additional verification. Most banks will not process an ACH transfer or bill payment from an unfamiliar source without confirming the request through your registered phone number, email, or security questions. If the transfer does go through, your bank is required by federal law to investigate and reverse it if you report it within 60 days.
The risk increases if the person also has your name and address, which they can use to call your bank and attempt to change your contact information or password. This is why account number alone is less dangerous than account number plus personal details.
Identity theft requires more than just your bank account number
True identity theft—opening credit cards, taking out loans, or filing a fraudulent tax return in your name—requires your Social Security number, date of birth, and often a copy of your ID. A bank account number does not provide these. Someone who has your account number but not your SSN cannot open a credit card or mortgage in your name.
However, if someone has your account number and has obtained your other personal information through a data breach, phishing email, or public records, they can use the account number as one piece of a larger fraud scheme. The account number itself is not the vulnerability; it is the combination of multiple pieces of information that creates risk.
This is why monitoring your credit report and setting up fraud alerts with the credit bureaus is important if you suspect your personal information has been compromised—not just your bank account number.
How to protect yourself if your account number is exposed
If your account number has been shared in a data breach or with someone you do not trust, you do not need to close the account immediately. Instead, take these steps: set up transaction alerts so you are notified of any transfer or withdrawal over a certain amount, review your account statements weekly for unauthorized activity, and consider placing a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) if you believe your full personal information may be at risk.
Contact your bank directly if you see any transaction you did not authorize. Do not call a number from an email or text; use the number on the back of your debit card or your bank statement. Your bank can freeze your account temporarily, cancel your debit card, and issue a new account number if necessary.
If you are concerned about ongoing risk, you can request a new account number from your bank. This will require updating your direct deposit, automatic payments, and any recurring subscriptions, but it eliminates the exposed number from circulation.
Your bank's responsibility when unauthorized transfers occur
Under the Electronic Funds Transfer Act, your bank must investigate any unauthorized transfer you report within 60 days. The bank has 10 business days to complete an initial investigation and either reverse the transfer or explain why it believes the transfer was authorized.
Your liability for unauthorized transfers depends on how quickly you report them. If you report within two business days of discovering the fraud, your liability is capped at $50. If you report between two and 60 days, your liability can be up to $500. If you wait longer than 60 days, you may lose all protection.
This is why checking your account regularly and setting up alerts is critical. Many people discover unauthorized transfers weeks or months later, after the window for protection has closed.
The difference between account number exposure and full identity theft
Account number exposure is a specific, containable problem. Your bank can reverse fraudulent transfers, issue a new account number, and monitor for suspicious activity. Full identity theft—where someone has your SSN, name, address, and date of birth—is far more serious because it can affect your credit, your taxes, and your ability to borrow money for years.
If your account number is exposed but your personal information is not, the risk is limited to attempts to move money from that specific account. If your full personal information is exposed, you need to take broader steps: place a credit freeze, monitor your credit report, and consider identity theft protection services.
The key is knowing which situation you are in. If you know only your account number was compromised, focus on monitoring that account. If you suspect your SSN or other personal details were also exposed, take action across all three credit bureaus.
Frequently Asked Questions
Can someone open a bank account in my name with just my account number?
No. Opening a new account requires your Social Security number, date of birth, address, and usually a government-issued ID. Your account number alone cannot be used to open another account. However, if someone has your account number and your other personal information, they could attempt to open accounts in your name.
What should I do if I gave my account number to someone I do not trust?
Contact your bank and describe the situation. Ask them to flag your account for suspicious activity and consider setting up transaction alerts. You do not need to close the account unless your bank recommends it. Monitor your statements closely for the next 30 to 60 days.
Is my account number visible on checks I write?
Yes. Your account number and routing number are printed on every check. This is normal and expected—businesses need this information to process check payments. The risk is low because checks require your signature and can be traced to you.
What is the difference between a routing number and an account number?
Your routing number identifies your bank or credit union; your account number identifies your specific account within that bank. Both are needed to process transfers, but neither alone grants access to your account or allows someone to withdraw money without your bank's authorization.
How long do I have to report unauthorized transfers before I lose protection?
You have 60 days from the date the unauthorized transfer appears on your statement. Report it to your bank immediately—do not wait. If you report within two business days, your liability is capped at $50. After 60 days, you may lose all protection under federal law.