Yes, someone can take money from your account with just the account number — but not in the way you might think

A checking account number alone is not enough to drain your account or make purchases. But it is enough for someone to set up automatic payments or transfers out of your account if they also have your routing number (which is public information). The real risk is not a stranger guessing your number — it is someone you gave it to, or someone who got it from a bill, a check, or a data breach, using it to pull money without permission.

The damage depends on how they use it. If they set up a recurring debit through your bank, you might not notice for weeks. If they use it to pay a bill in your name, the creditor might report it to the credit bureaus. If they use it for a wire transfer or ACH payment, the money can be gone before your bank catches it. The good news: your bank has rules about what you owe, and you have a window to report it and get your money back.

Key Takeaways

  • Someone with your account number and routing number can set up automatic payments or transfers out of your account without your permission.
  • The most common risk is unauthorized ACH transfers or bill payments, not card fraud or ATM withdrawals.
  • You are not liable for unauthorized transfers if you report them within 60 days of the statement date, though your bank may investigate for up to 10 business days.
  • Protect your account number the same way you protect your routing number — do not share it with people you do not trust, and watch your statements every month.

How someone uses your account number to take money

The most common method is an ACH transfer — an electronic money movement between bank accounts that does not require a card or signature. If someone has your account number and routing number, they can initiate an ACH pull directly from your account to theirs or to a business they control. Your bank does not verify that you authorized it before the money leaves; verification happens after, if you report it.

A second method is setting up a recurring bill payment in your name. Utilities, phone companies, and subscription services accept account numbers to set up autopay. If someone has your account number and knows which company to target, they can create an account in your name and authorize payments. You might not see the charge until the next statement.

A third method is using your account number to pay down a debt or loan they opened in your name — a form of identity theft that combines your account number with other stolen information. This is less common than the first two but more damaging because it affects your credit.

What your bank will and will not cover

Federal law (Regulation E) protects you from unauthorized electronic transfers, but only if you report them in time. If you report an unauthorized transfer within two business days of discovering it, your liability is capped at $50. If you report it between two business days and 60 calendar days after your statement is mailed, your liability can be up to $500. If you wait longer than 60 days, you may lose all protection and owe the full amount.

Your bank has 10 business days to investigate after you report it. During that time, they will contact the receiving bank, check for evidence of authorization, and review the transaction details. If they find the transfer was unauthorized, they must return the money to your account. If they need more time, they can extend the investigation to 45 calendar days, but they must return a provisional credit to your account within 10 days so you have access to the money while they investigate.

This protection applies to ACH transfers and electronic bill payments. It does not apply to checks or wire transfers, which have different rules and often offer less protection. If someone forged a check using your account number, you would report it to your bank as a forged item, not as an unauthorized electronic transfer.

Why your account number is easier to find than you think

Your checking account number appears on every check you write, in plain text at the bottom. If you pay a bill by check, the recipient has your account number. If you throw away a check stub or a cancelled check, someone who finds it in your trash has your account number. If you give your account number to a utility company, a landlord, or an online retailer to set up a payment, that company has it.

Data breaches also expose account numbers. Banks, payment processors, and retailers have been hacked; when they are, account numbers are often part of what is stolen. You do not control whether a company you do business with will be breached, but you can control how widely you share your number and how carefully you watch for unauthorized activity.

Your routing number is public — it is printed on every check and published online by the Federal Reserve. Combined with your account number, it is all someone needs to initiate an ACH transfer. This is why the account number itself is treated as sensitive information by banks, even though it is not as secret as a PIN or password.

Steps to take if you spot an unauthorized transfer

First, call your bank immediately — do not wait for a statement or a second charge. Have your account number and the date of the unauthorized transfer ready. Tell the bank representative that you did not authorize the transfer and ask them to start an investigation. Ask for a confirmation number for the report and the name of the person handling it.

Second, follow up in writing. Send a letter to your bank's fraud department (the address is usually on your statement or website) stating the date of the unauthorized transfer, the amount, and the receiving account or business. Keep a copy for your records. Written notice creates a paper trail and resets the clock on your 60-day window if your verbal report was not documented correctly.

Third, monitor your account daily for the next 30 days. Check your online banking or app every morning to catch any new unauthorized transfers before they clear. If you spot another one, report it immediately using the same process.

Fourth, change your online banking password and any other passwords that use the same combination. If someone has access to your account number, they may also have access to your login credentials.

How to reduce the risk going forward

Do not write your account number on checks unless absolutely necessary. If you are paying a bill by check, you can often leave the account number blank and the bank will fill it in when they process the check. If a business insists on the account number on the check itself, consider using a different payment method.

Shred or burn old checks, statements, and bills before throwing them away. A shredder is cheap and takes seconds; dumpster diving for account numbers takes longer but is still possible.

Use a credit card or debit card for online purchases instead of giving your account number directly. Credit cards and debit cards have fraud protections that ACH transfers do not. If you must give your account number online, use a business or website you trust and have verified is legitimate.

Set up account alerts with your bank. Most banks allow you to receive a text or email notification when a transfer over a certain amount leaves your account. A $100 or $200 threshold can catch most fraudulent transfers before they clear.

Review your bank statements every month, even if you use online banking. Fraudsters sometimes make small test transfers first to see if you are paying attention. Catching a $5 unauthorized transfer and reporting it can prevent a $500 transfer the next month.

What to do if your bank denies your claim

If your bank investigates and concludes the transfer was authorized, you have the right to dispute that decision. Ask the bank for a written explanation of why they believe you authorized it. If they cite a signature, PIN entry, or other proof, ask to see it. Many unauthorized transfers happen because the receiving bank did not verify the authorization properly, and your bank may have missed that in their initial investigation.

If you disagree with the bank's conclusion, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can review the bank's investigation and push back if the bank did not follow the rules. You can also contact your state's banking regulator or attorney general's office.

If the amount is small enough, you might consider disputing it through your credit card company instead (if you paid the bank's investigation fee with a credit card) or taking the bank to small claims court. These are slower routes, but they can work if the bank refuses to budge and you have documentation that the transfer was unauthorized.

Frequently Asked Questions

Can someone use my account number to open a new account in my name?

Not directly. They would need your account number plus your Social Security number, date of birth, and address to open a new account. However, if they have your account number, they may also have access to other personal information. Monitor your credit report for accounts you did not open.

What if the unauthorized transfer went to another bank?

Your bank will contact the receiving bank as part of the investigation. The receiving bank can freeze the account and return the money if they find it is still there. If the money has already been withdrawn, recovery is harder but still possible if the receiving bank cooperates.

Do I need to close my account after an unauthorized transfer?

Not necessarily. Closing the account does not undo the fraud and may create new problems if you have automatic deposits or payments set up. Instead, change your online password, set up alerts, and monitor the account closely. Close it only if the fraud continues after you report it.

Is my account number the same as my routing number?

No. Your routing number identifies your bank; your account number identifies your specific account at that bank. Both are printed on your checks, but they are different numbers. Someone needs both to initiate an ACH transfer.

Can I get my money back if I wait more than 60 days to report it?

You lose the automatic protection under Regulation E, but you can still try. Contact your bank and explain the delay. Some banks will investigate and return the money as a courtesy, especially if you can show you were not negligent. There is no may provide, but asking costs nothing.