Someone cannot withdraw money using only your account number
A checking account number alone is not enough to pull money out of your account. Banks require additional verification before processing any withdrawal or transfer. Your account number is part of your routing information — it tells the bank which account to send money to, but it does not give anyone permission to take money from it.
What matters is what else someone has alongside that number. With your account number and routing number, a person can set up an automatic payment or direct deposit into your account. To actually withdraw or transfer money out, they need either your PIN, your online banking password, or authorization from you in writing.
Key Takeaways
- Your account number alone cannot be used to withdraw money — the bank requires additional proof of identity or authorization.
- Someone with your account and routing number can send money to your account, but cannot take money from it without your password or PIN.
- If someone has your account number and makes unauthorized transfers, contact your bank immediately and file a dispute within 60 days.
- Sharing your full account and routing number for legitimate payments (like direct deposit or bill pay) is safe as long as you monitor your account regularly.
What a scammer can actually do with your account number
If someone has your account number and routing number, they can attempt an ACH transfer — an electronic transfer between bank accounts. They cannot complete it without your authorization, but they can try to initiate one. Your bank will either reject it if the account does not match their records, or it may go through if the information lines up.
A scammer might also use your account number to set up a fraudulent automatic payment or bill pay arrangement in your name. This requires logging into your online banking account, which means they would need your username and password — not just your account number. If they have those credentials, they have full access to your account.
The real risk is not the account number itself. The real risk is if that number is combined with other information: your name, address, date of birth, Social Security number, or online banking password. With those pieces together, someone can impersonate you to your bank or set up unauthorized transactions.
When it is safe to share your account number
You share your account number every time you set up direct deposit at a job or receive a government payment like Social Security or a tax refund. Employers, the IRS, and state agencies all need your account and routing number to deposit money into your account. This is safe because they are only sending money in, not taking it out.
You also provide your account number when you set up bill pay through your bank's website or when you authorize a company to charge your account for a recurring payment — like insurance, utilities, or a subscription. In these cases, you are giving explicit permission for that specific company to withdraw a set amount on a set schedule. The company cannot take more than you authorized, and your bank can reverse unauthorized charges.
The key difference: you are initiating the transaction and controlling the terms. You chose the amount, the frequency, and the company. Sharing your number for these purposes is standard banking practice.
What to do if you think someone used your account number fraudulently
Contact your bank immediately if you see a transaction you did not authorize. Call the number on the back of your debit card or your monthly statement — not a number you find online, which might be a scam line. Tell them the transaction date, the amount, and that you did not authorize it.
Your bank will freeze the transaction or reverse it while they investigate. Under federal law, you have up to 60 days from the date your statement was sent to report an unauthorized transfer. If you report it within that window, your liability is limited — you may owe nothing, or as little as $50 depending on how quickly you reported it.
After you report it, ask your bank to issue you a new debit card and a new account number if the fraud was serious. You can also place a fraud alert on your credit report by contacting one of the three credit bureaus (Equifax, Experian, or TransUnion). This makes it harder for someone to open new accounts in your name.
How to protect your account number
Do not share your account number with anyone who contacts you unsolicited — by phone, email, or text. Legitimate companies already have your account number if you are a customer, and they will never ask you to confirm it over the phone or email. If someone claims to be from your bank and asks for your account number, hang up and call your bank directly using the number on your card.
Be cautious about where you write down or store your account number. Do not leave statements or checks lying around where roommates, family members, or visitors can see them. If you use online banking, use a strong password that includes numbers, letters, and symbols — at least 12 characters long. Do not use the same password for your bank account that you use for other websites.
Monitor your account regularly — at least weekly if possible. Most banks offer free online access and mobile apps that show transactions in real time. The faster you spot fraud, the faster you can report it and the more protection you have under federal law.
The difference between account number and routing number
Your routing number identifies your specific bank or credit union — it is the same for all customers at that institution. Your account number identifies your individual account within that bank. Together, they form your banking address: the routing number says which bank, and the account number says which account at that bank.
Both numbers appear on the bottom left of your checks, and both are needed to set up direct deposit or automatic payments. Neither one is secret in the way your PIN or password is secret. Your routing number is public information — you can find it on your bank's website. Your account number is semi-public — it appears on your checks, which you hand to people regularly.
What is actually secret is your online banking password, your PIN, and your debit card number (the 16 digits on the front). These are what give someone the ability to move money out of your account. Your account and routing number alone do not.
Frequently Asked Questions
Can someone set up a direct deposit to my account with just my account number?
Yes. Your employer or a government agency can set up direct deposit using your account and routing number. This is safe because they can only send money in, not take it out. You control whether to accept the deposit.
What if someone has my account number and my name?
That combination is not enough to withdraw money, but it is enough to attempt an ACH transfer or set up a bill pay arrangement. If the transfer fails, no harm is done. If it succeeds, contact your bank within 60 days to dispute it and have the money returned.
Do I need to change my account number if someone saw it?
No, not unless there is actual fraud. Your account number is not like a password — it is meant to be shared for legitimate payments. Change it only if someone has used it fraudulently or if you believe they have your password or PIN as well.
Can a scammer use my account number to open a new bank account?
Not with just your account number. They would need your name, address, date of birth, Social Security number, and a government ID. If you suspect identity theft, place a fraud alert on your credit report immediately.
Is it safe to give my account number over the phone?
Only if you initiated the call and you know the company is legitimate. Never give your account number to someone who called you, even if they claim to be from your bank. Hang up and call your bank directly using the number on your card.