Yes, thieves can use your routing and account number to withdraw money, but not in the way most people fear

A thief with your routing number and checking account number can set up unauthorized ACH transfers — electronic pulls of money from your account to theirs. They cannot walk into a bank and withdraw cash using only these two numbers. They cannot use them like a debit card at a store. But they can drain your account remotely by posing as a business collecting a payment, or by setting up a fake bill-pay arrangement.

The risk is real but not unlimited. Your bank is required by federal law to reverse most unauthorized ACH transfers if you report them within a specific window. The catch is that you have to notice the theft, report it quickly, and follow the bank's process. If you wait months, you lose the protection.

Key Takeaways

  • A thief can use your routing and account number to pull money via ACH transfer, but cannot use them to withdraw cash in person or make purchases at stores.
  • You are protected by federal law if you report unauthorized transfers within 60 days of your statement showing the theft.
  • The thief typically poses as a business or creditor to make the transfer look legitimate to your bank's system.
  • Checking your bank statements weekly and setting up low-balance alerts reduces the window of time a thief can steal before you notice.

How a thief actually uses routing and account numbers

The most common method is ACH fraud, where the thief initiates an electronic transfer as if they were a legitimate business collecting a payment from you. They might pose as your utility company, your mortgage lender, or an online retailer you use. The transfer appears in your bank's system as an outgoing payment, not a suspicious deposit attempt, so it passes through more easily than a transfer to an unknown account would.

The thief gets your routing and account number in several ways: from a check you wrote and they intercepted, from a data breach at a company you do business with, from a phishing email that tricks you into providing it, or from a paper trail you left behind. Once they have both numbers, they can use free or cheap ACH software to initiate transfers without needing your password, your debit card, or your online banking login.

A second method is check fraud. The thief uses your routing and account number to print counterfeit checks or to order checks in your name. They then write checks to themselves or to someone else. This takes longer to discover because checks clear slowly, but it can drain your account over weeks.

What thieves cannot do with these numbers alone

Your routing and account number are not enough to make a debit card purchase, withdraw cash from an ATM, or walk into a branch and take money out. Those actions require your PIN, your card itself, or your identity to be verified in person. A thief cannot log into your online banking without your username and password. They cannot change your address or contact information on your account.

This is why your bank asks for more than just these two numbers when you call to make changes. It is also why thieves often combine account number theft with identity theft — they need additional information to do real damage.

Your legal protection against unauthorized transfers

The Electronic Funds Transfer Act (EFTA) limits your liability for unauthorized ACH transfers. If you report the theft within 60 days of your bank statement showing the unauthorized transfer, your bank must reverse it and return your money. You are not responsible for the loss.

If you report it between 60 and 120 days, your liability may be limited to $550, depending on your bank and the circumstances. After 120 days, you may lose all protection. This is why timing matters: the moment you see a transfer you did not authorize, contact your bank in writing and by phone.

Some banks offer stronger protections than the law requires, especially for business accounts. Check your account agreement or call your bank to learn what protection you have beyond the federal minimum.

Steps to take if you discover unauthorized transfers

First, contact your bank immediately by phone. Tell them which transfers are unauthorized and provide the dates and amounts. Ask them to freeze your account and issue you a new account number. Do not wait for a letter or an email response.

Second, send a written dispute letter to your bank within 10 days of the phone call. Include the date of your call, the name of the person you spoke to, the unauthorized transfer dates and amounts, and a statement that you did not authorize these transfers. Send it certified mail with return receipt so you have proof of delivery.

Third, monitor your account closely for the next 90 days. Check your statements weekly. Set up balance alerts so your bank texts or emails you if your balance drops below a certain amount. If new unauthorized transfers appear, report those immediately as well.

Fourth, consider filing a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and may help if the thief targets you again or if your information was part of a larger breach.

How to reduce the risk of ACH fraud

Do not write checks unless you have to. Each check you write exposes your routing and account number to anyone who handles it — mail carriers, store employees, the recipient. If you must use checks, mail them from a post office box rather than a home mailbox, and use a pen that cannot be altered.

Do not provide your routing and account number to unfamiliar businesses, even if they claim to be collecting a payment. If a company says they need these numbers, hang up and call the company directly using a phone number from their official website or bill. Scammers often pose as utilities or creditors.

Check your bank statements every week, not once a month. Most banks offer free online access and mobile apps that show transactions in real time. The faster you spot fraud, the faster you can report it and the more protection you have.

Set up two-factor authentication on your online banking account. This prevents a thief from logging in even if they somehow obtain your password. Enable low-balance alerts and transaction alerts so you are notified of unusual activity.

What to do if your information was in a data breach

If you learn that a company you do business with has been breached and your account information was exposed, contact your bank proactively. Tell them about the breach and ask them to monitor your account for suspicious activity. Some banks will issue you a new account number and routing number as a precaution, though this is not always necessary.

You do not need to close your account unless your bank recommends it. Closing an account can hurt your banking history and may not stop a thief who already has your old numbers. Instead, stay vigilant and report any unauthorized transfers immediately.

If the breach involved your Social Security number, name, and address in addition to your account number, monitor your credit report for signs of identity theft. You can request a free credit report from each of the three major bureaus at AnnualCreditReport.com.

Frequently Asked Questions

Can someone open a new bank account using my routing and account number?

No. Opening a new account requires a Social Security number, a government-issued ID, and an in-person or video verification process at most banks. Your routing and account number alone are not enough. However, a thief with your full identity information could open an account in your name, which is a separate crime called identity theft.

If I report fraud, how long does it take to get my money back?

Your bank must investigate within 10 business days and resolve the dispute within 45 days in most cases. If the bank needs more time, they can extend to 90 days, but they must credit your account provisionally while they investigate. You should see your money back within two to three weeks if the transfer was clearly unauthorized.

Should I change my routing number if someone has it?

No. Your routing number is tied to your bank branch and cannot be changed. It is public information — it appears on every check you write and on your bank statements. What you should do is get a new account number and close the old account if fraud has occurred. Your bank can do this for you in one call.

Can a thief use my routing and account number to set up automatic bill payments?

Yes, this is a common form of ACH fraud. The thief sets up a recurring payment to themselves or an accomplice using your account number. This is why monitoring your account weekly is critical — you may not notice a single small charge, but you will catch a pattern. Report any recurring charges you did not authorize immediately.

What if my bank refuses to reverse the unauthorized transfer?

File a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints against banks and can force them to reverse fraudulent transfers if they violated federal law. You can also contact your state's banking regulator or attorney general's office.