Yes, someone can use your checking account number to take money, but not in the way most people fear
If someone has your checking account number and routing number, they can set up an Automated Clearing House (ACH) transfer to pull money directly from your account. They do not need your debit card, PIN, or online banking password. This is the real risk — not that they can spend money as you, but that they can initiate a withdrawal that looks like it came from you.
The good news: your bank can reverse fraudulent ACH transfers, and federal law limits your liability. The faster you report it, the better your protection. But prevention is simpler than recovery, so understanding what account numbers actually expose is worth your time.
Key Takeaways
- Someone with your account and routing number can initiate an ACH transfer to pull money from your account without your permission.
- They cannot use your account number to make purchases, pay bills online, or access your account through online banking.
- Report unauthorized transfers to your bank within 60 days to receive full protection under federal law.
- You can stop future transfers by contacting your bank and placing a stop payment order or requesting a new account number.
- Sharing your account number for legitimate purposes like direct deposit or bill payment is generally safe if you trust the recipient.
What an ACH transfer actually is and how it works
An ACH transfer moves money between bank accounts through the Federal Reserve's clearing system. Your employer uses ACH to deposit your paycheck. Your utility company uses ACH to pull your monthly bill. Your landlord might use ACH to receive rent. These are all legitimate uses of your account number.
The problem: anyone with your account number and routing number can initiate an ACH transfer in your name, even without your permission. They do not need to log into your account or prove they are you. The ACH system assumes that if someone submits a transfer with the correct account and routing number, they have authority to do so.
This is why account numbers are treated differently than debit card numbers. A debit card is tied to you personally. An account number is tied to the account itself — and the system trusts that whoever submits the transfer has a legitimate reason.
What someone cannot do with just your account number
Your account number alone does not let someone log into your online banking, see your balance, or change your password. They cannot order a debit card in your name or set up bill pay through your bank's website. They cannot make purchases at stores or online.
To do any of those things, they would need additional information: your username and password, your Social Security number, or your debit card itself. An account number is a piece of the puzzle, not the whole picture.
This is an important distinction because it changes how you should think about sharing your account number. Giving it to your employer for direct deposit is not the same risk as giving someone your online banking credentials.
When sharing your account number is safe
You should share your account number when you are setting up direct deposit with an employer, receiving government payments, or authorizing a company to pull a recurring bill payment. In these cases, you are initiating the relationship and controlling which company gets access.
The key is that you are the one who started it. You contacted the employer, the government agency, or the utility company. You told them your account number. If something goes wrong, you have a record of who you gave it to and why.
Legitimate businesses that pull recurring payments — insurance companies, subscription services, loan servicers — have fraud prevention systems in place. They are liable if they pull unauthorized amounts, which gives them incentive to protect your account.
Red flags that someone may have misused your account number
Check your bank statements regularly for ACH transfers you do not recognize. Look for small test transfers (sometimes $0.01 or a few dollars) that fraudsters use to confirm an account is active before pulling larger amounts. Look for transfers to unfamiliar company names or individuals.
Your bank may also alert you to unusual activity through email or text, depending on your account settings. If you see something suspicious, contact your bank immediately — do not wait for a statement cycle to close.
If you notice unauthorized transfers, your bank can reverse them and investigate. Document the date, amount, and recipient of each fraudulent transfer before you call.
How to stop unauthorized ACH transfers
Call your bank as soon as you discover the fraud. Tell them which transfers were not authorized. Your bank can reverse the transfers and investigate the source. They can also place a stop payment order on future transfers from the same company or individual.
Ask your bank whether they recommend closing your current account and opening a new one. If the fraud is ongoing or you are not sure how the person got your information, a new account number removes their ability to pull more transfers. Your bank can usually set this up the same day you call.
You can also request that your bank flag your account for fraud monitoring, which adds extra verification steps before large or unusual transfers are processed.
Your legal protection under federal law
The Electronic Funds Transfer Act limits your liability for unauthorized ACH transfers. If you report the fraud within 60 days of the transfer appearing on your statement, your bank must reverse it and return your money. You are not responsible for the loss.
If you report it after 60 days but within one year, your bank may still reverse it, but they are not required to by law. After one year, reversal is unlikely. This is why checking your statements regularly and reporting quickly matters.
Keep records of when you reported the fraud — the date, time, and name of the bank employee you spoke with. This protects you if the bank disputes your claim later.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a bank account requires a Social Security number, government ID, and proof of address. Your account number alone is not enough. However, if someone has your Social Security number and other personal information, they could open an account in your name — but that is identity theft, not account number misuse.
Should I give my account number to someone I do not know?
Only if you initiated the contact and trust the organization. If someone calls or emails asking for your account number, do not give it to them. Legitimate companies already have your account number if you are their customer, or they will ask you to log into your account to provide it securely.
What if my employer or landlord misuses my account number?
Report the unauthorized transfer to your bank immediately. Your bank can reverse it regardless of who initiated it. You can also file a complaint with the Consumer Financial Protection Bureau if the company refuses to stop pulling unauthorized amounts after you ask them to.
Does my bank need my account number to send me money?
No. If someone wants to send you money through ACH, they need your account number and routing number. But you do not need to give them anything beyond that. Do not share your online banking password, PIN, or Social Security number just to receive a transfer.
Can I change my account number if I am worried about fraud?
Yes. Contact your bank and ask to close your current account and open a new one. Your bank will issue a new account number and routing number. This stops anyone who has your old number from pulling future transfers. Existing legitimate payments (like direct deposit) will need to be updated with your new number.