Someone with only your account number and routing number cannot withdraw money or make purchases without additional information
Your bank account number and routing number alone are not enough for someone to drain your account or make unauthorized transfers. Banks use these numbers to identify where money should go—they are meant to be shared. What matters is what else a person has: your PIN, online password, or access to your physical debit card. Without one of those, a thief cannot move your money out.
That said, having your account and routing numbers does create real risks, just not the ones people usually fear. Someone could use them to set up unauthorized automatic payments from your account, or to receive money you send them and then dispute the transaction. The damage is real, but it works differently than a simple theft.
Key Takeaways
- Account and routing numbers alone cannot be used to withdraw cash, make debit card purchases, or transfer money to another account.
- A thief with these numbers can set up recurring automatic payments (like utility bills or subscriptions) that pull money from your account each month.
- Someone can also receive a wire transfer or ACH payment using your account number, then dispute it with their bank to get the money back while keeping what you sent.
- Check your bank statements monthly and report any unauthorized transactions within 60 days to limit your liability.
- You do not need to keep your account number secret the way you keep your password secret, but you should still be cautious about who receives it.
What a thief can actually do with your account number
The most common risk is unauthorized automatic payments. If someone has your account and routing number, they can attempt to set up a recurring charge—a gym membership, subscription service, or utility bill—that drafts from your account each month. Your bank does not verify the person's identity before processing the first payment; they verify after, when you dispute it. By then, one or more unauthorized charges may have already gone through.
The second risk is receiving money and then disputing it. Someone could give you their account number (or give your account number to you as if it were theirs), receive a wire transfer or ACH payment from you, and then call their bank to say the transfer was unauthorized. Their bank reverses the payment and returns the money to you—but the person keeps what they received from you in cash or goods. This is a form of fraud, but it relies on the victim sending money first.
A third, less common risk is that your account number could be used as part of a larger identity theft scheme—combined with your name, address, and Social Security number to open a new account or take out a loan in your name. The account number alone does not do this, but it is one piece of the puzzle.
Why your account number is different from your password
Banks publish routing numbers in directories and on their websites. Checks display both your account number and routing number in plain text. You are supposed to give these numbers to employers (for direct deposit), to people paying you (for wire transfers), and to businesses you pay regularly. They are not secret in the way your password or PIN is secret.
This does not mean you should hand your account number to strangers. It means the risk is not the same as someone obtaining your password. A password is meant to stay private; an account number is meant to be shared with trusted parties. The problem arises when you share it with someone who is not trustworthy, or when it is obtained without your knowledge through a data breach or a phishing email.
How to spot unauthorized charges before they become a problem
Check your bank statement at least once a month, ideally more often. Look for charges you do not recognize, especially recurring ones. Many banks let you view transactions online within a day or two of when they post, so you can catch unauthorized payments quickly.
If you see a charge you did not authorize, contact your bank immediately. Do not wait for the next statement. Most banks allow you to dispute a transaction within 60 days of when it appears on your statement. After 60 days, your liability protection may be limited or gone. Write down the date you called, the name of the person you spoke to, and what they told you to do next.
For recurring unauthorized charges, ask your bank to reverse the transaction and to block the merchant from charging your account again. Some banks can do this in one call; others may ask you to submit a dispute form online or by mail.
Steps to take if someone is using your account number without permission
First, call your bank's fraud line immediately. The number is usually on the back of your debit card or on your bank's website. Tell them which transactions are unauthorized and ask them to reverse the charges. Your bank may issue you a new account number and debit card while the dispute is being investigated.
Second, monitor your account closely for the next 30 to 60 days. Fraudsters sometimes make multiple attempts or set up multiple unauthorized payments. Catching them early limits the damage.
Third, if the unauthorized charges are part of a larger identity theft (for example, if someone opened accounts in your name or took out loans), place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. You can do this by calling one bureau and asking them to notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name.
Fourth, consider placing a credit freeze if the theft is serious. A freeze prevents anyone, including you, from opening new accounts in your name without unfreezing it first. This is stronger protection than a fraud alert but requires extra steps when you want to open accounts yourself.
When to worry less and when to worry more
You do not need to worry if your account number appears on a check you wrote to someone, or if you gave it to your employer for direct deposit, or if you shared it with a business you pay regularly. These are normal uses.
You should be more cautious if your account number was exposed in a data breach (your bank or a business you use will notify you), if you received a phishing email asking for it, or if someone you do not trust has it. In these cases, monitor your account more closely for the next few months.
You should be very concerned if someone has your account number and your password, PIN, or physical debit card. That combination gives them direct access to your money. Contact your bank immediately and ask them to freeze your account while you sort it out.
How banks protect you if fraud happens
Federal law limits your liability for unauthorized transactions. If you report an unauthorized debit card charge within two business days of when it appears on your statement, you are liable for no more than $50. If you report it between two and 60 days, you are liable for no more than $500. After 60 days, you may be liable for the full amount, though many banks offer protection beyond what the law requires.
For unauthorized ACH transfers (like automatic payments), the rules are similar but the timeline is different. You have 60 days from when the transaction appears on your statement to report it. Report it in writing to your bank, and keep a copy of your report.
Wire transfers are harder to recover because they move money directly to another bank account. If you discover an unauthorized wire within one business day, your bank may be able to recall it. After that, recovery is much harder. This is why you should never wire money to someone you do not know or trust.
Frequently Asked Questions
Can someone use my account number to make online purchases?
No. Online purchases require a debit card number, expiration date, and CVV code—not a bank account number. Someone with only your account and routing number cannot charge your debit card or make purchases online. They would need your actual card details.
What if I gave my account number to someone and now I'm worried?
Monitor your account for unauthorized charges over the next 30 to 60 days. If nothing appears, you are likely fine. If you see suspicious activity, contact your bank immediately. You can also ask your bank to issue you a new account number and debit card as a precaution, though this is not always necessary.
Is it safe to put my account number on a check?
Yes. Checks are designed to display your account and routing number. Anyone who receives a check from you will see these numbers. The risk is only if you write a check to someone untrustworthy who then uses the information to set up unauthorized payments.
Do I need to report my account number if it was in a data breach?
Contact your bank and let them know. They may monitor your account more closely or issue you a new account number. You should also monitor your statements for unauthorized charges. A data breach is not an emergency by itself, but it means you should be more vigilant.
What's the difference between a wire transfer and an ACH transfer?
Wire transfers move money directly and are usually final within hours—they are hard to reverse. ACH transfers (like automatic payments) take one to three business days and are easier to dispute. Both use your account and routing number, but wire transfers carry more risk because recovery is difficult.