Yes, someone can cause real problems with only your account and routing numbers
Your bank account number and routing number are enough for someone to set up automatic withdrawals from your account, create fraudulent checks in your name, or initiate ACH transfers without your permission. They do not need your PIN, password, or signature. The account number alone identifies where the money is; the routing number tells them which bank to contact. Together, they are a direct path into your account.
This is different from a debit card number or credit card number, which have built-in fraud protections and require a CVV code. Your bank account number has almost no built-in protection because it was designed for legitimate uses like direct deposit and bill pay, where the account holder is supposed to authorize the transaction. A criminal does not need authorization—they just need the numbers.
Key Takeaways
- Someone with your account and routing numbers can set up automatic withdrawals, create fake checks, or move money out via ACH transfer without your permission or knowledge.
- Banks are required to investigate unauthorized ACH transfers and checks, but the process takes time and you may not get your money back immediately.
- The best protection is to monitor your account regularly, set up transaction alerts, and limit who has access to these numbers.
- If fraud happens, contact your bank immediately and file a dispute; waiting makes recovery harder and may cost you more.
How someone uses your account number to steal money
The most common method is an ACH debit—an electronic transfer that pulls money directly from your account. Someone with your routing and account numbers can contact their own bank or use an online payment service and request a transfer from your account to theirs. Your bank receives the request and, if it looks routine, processes it. You may not notice for days or weeks.
A second method is check fraud. Someone prints checks using your account number and routing number at the bottom, then cashes or deposits them. The checks look legitimate because they have the real numbers. The bank processes them against your account, and the money is gone before you realize it.
A third method is setting up automatic bill payments in your name. Someone can contact a utility company, subscription service, or other business and authorize recurring charges to your account. These charges keep hitting your account until you notice and stop them.
Why banks do not stop these transactions automatically
Banks treat ACH transfers and checks as authorized by default because most of the time they are. When your employer sends your paycheck via ACH, or when you pay a bill by check, you have authorized those transactions. The bank has no way to know whether you authorized a particular transfer just by looking at the account and routing numbers.
Banks do have fraud detection systems, but they look for patterns—multiple large transfers in a short time, transfers to new accounts, activity at odd hours. A single transfer that looks normal in size and timing may slip through. Once the money is gone, it is your job to report it, not the bank's job to prevent it.
What to do if someone uses your account number without permission
Contact your bank immediately by phone. Do not email or use online chat for this—call the number on the back of your card or on your statement. Tell them you did not authorize the transaction and ask them to reverse it. The bank will place a temporary hold on the disputed amount while they investigate.
For ACH transfers, federal law gives you up to 60 days from the date you see the unauthorized transfer on your statement to report it. For checks, the window is longer, but reporting quickly is always better. The bank must investigate and either return your money or explain why the transaction was authorized.
File a written dispute with your bank if they do not act on your phone call. Ask for a case number and keep it. Send the dispute by certified mail so you have proof the bank received it. Include the date of the unauthorized transaction, the amount, and a clear statement that you did not authorize it.
If your bank refuses to refund you, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. This does not get your money back immediately, but it creates a record and may pressure the bank to reconsider.
How to protect your account number from misuse
Do not share your account and routing numbers with anyone you do not trust completely. These numbers appear on every check you write, so be careful where you leave blank checks. Do not post them on social media or in public forums, even if you think you are asking an innocent question.
Be cautious when giving these numbers over the phone or online. Legitimate businesses—your employer, your utility company, your bank—already have these numbers or can look them up. If someone calls you asking for them, hang up and call the business directly using a number you know is real.
Set up transaction alerts with your bank so you get notified of any transfer over a certain amount, or any transfer at all. Many banks let you set these up for free through their app or website. The alert may come too late to stop the transaction, but it will help you catch fraud quickly.
Consider using a separate account for online bill payments and subscriptions, and keep a lower balance in it. If that account is compromised, your main account is still protected. Some people also use services that generate temporary account numbers for one-time transactions, though this is less common for personal banking.
The difference between account number fraud and identity theft
Account number fraud is when someone uses your existing account numbers to steal from that account. Identity theft is when someone uses your personal information—name, Social Security number, date of birth—to open new accounts in your name. They are different crimes with different recovery paths.
If you suspect identity theft in addition to account fraud, place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) and consider freezing your credit. This prevents someone from opening new accounts using your identity. Account fraud alone does not require these steps, but it is worth checking your credit report to make sure nothing else has been opened.
How long it takes to get your money back
Banks must investigate unauthorized ACH transfers within 10 business days and return your money within 20 business days if they find the transfer was not authorized. In practice, many banks move faster, but 20 days is the legal maximum.
For checks, the timeline is less clear because check processing is slower. If you report a fraudulent check quickly, the bank may be able to stop payment before it clears. If it has already cleared, the investigation takes longer—sometimes several weeks—because the bank has to contact the other bank and trace the funds.
During the investigation, the bank may credit your account temporarily while they work. This is not the same as a final resolution, but it means you have access to the money while they investigate. If they later determine the transaction was authorized, they will take the credit back.
Frequently Asked Questions
Can someone open a new bank account using just my account number?
No. Opening a new account requires personal information like your name, address, Social Security number, and government ID. Your account number alone is not enough. However, someone with your full personal information could open an account and then use your account number to make it look legitimate, which is why monitoring your credit report matters if you suspect broader identity theft.
Is my account number visible to other people when I pay someone by check?
Yes. Your routing number and account number are printed on every check you write. Anyone who handles the check can see these numbers. This is why you should not leave blank checks lying around and should shred old statements and canceled checks.
What if the bank says the transaction was authorized and refuses to refund me?
You can dispute this decision. Ask the bank for a written explanation of why they believe it was authorized. If you disagree, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov or with your state's banking regulator. You can also consult a lawyer, though the amount stolen may not make this practical.
Do I need to close my account if someone has my account number?
Not necessarily. Closing the account does not undo fraud that already happened, and it may make it harder to dispute transactions. Instead, monitor the account closely, set up alerts, and consider moving to a new account only if fraud continues after you have reported it and the bank has investigated.
Can I prevent ACH transfers to my account by changing my account number?
Yes, but it is disruptive. Changing your account number means updating it with your employer, any automatic bill payments you have set up, and any other legitimate services that use it. Most people only do this if fraud continues despite reporting it. Your bank can walk you through the process if you decide to do it.