Stop further damage before it spreads
If someone has your bank account number, contact your bank immediately — the same day if possible. Call the number on the back of your debit card or your most recent statement, not a number you find online. Tell them you believe your account information has been compromised and ask them to flag your account for fraud monitoring.
Your bank can place a temporary hold on your account, watch for suspicious activity, and reverse unauthorized transfers if they catch them quickly. The faster you report, the better your protection. Most banks have a fraud department that works outside normal business hours, so you can reach someone even on evenings and weekends.
Do not wait to see if anything happens. A bank account number alone is less dangerous than a full card number, but it can still be used for unauthorized ACH transfers (electronic money movements) or to set up fraudulent bill payments in your name. Acting now prevents that from happening in the first place.
Key Takeaways
- Call your bank the same day you discover the compromise, using the number on your card or statement, not one you search for online.
- Your bank can flag your account for fraud monitoring and reverse unauthorized transfers if they catch them within a few days.
- A bank account number can be used for ACH transfers and bill payments, so monitor your account for the next 30 to 60 days even after reporting.
- File a report with the Federal Trade Commission at IdentityTheft.gov if unauthorized charges appear, which creates an official record for disputing them.
- Consider placing a fraud alert or credit freeze with the three credit bureaus if you believe your identity information is also at risk.
Monitor your account for the next 30 to 60 days
After you call your bank, log into your account online or through the app at least once a day for the next month. Look for any transfers you did not authorize, unexpected bill payments, or charges from merchants you do not recognize. Most unauthorized ACH transfers show up within a few days, but some fraudsters wait weeks to see if the account is being watched.
Set up account alerts if your bank offers them. Many banks let you receive a text or email notification whenever money leaves your account, when a bill payment is scheduled, or when the balance drops below a certain amount. These alerts give you real-time warning if someone tries to move your money.
If you see an unauthorized transfer, call your bank immediately and report it as fraud. Under federal law, your liability for unauthorized electronic transfers is limited to $50 if you report within two business days, and $500 if you report within 60 days. After 60 days, you may be liable for the full amount, so do not delay.
File a fraud report with the Federal Trade Commission
Go to IdentityTheft.gov and file a report describing what happened. You do not need to wait for unauthorized charges to appear — reporting the compromise itself creates an official record. The FTC uses these reports to track fraud patterns and can share information with law enforcement.
When you file, the FTC will give you an Identity Theft Report, which is a document you can use to dispute charges with your bank and credit card companies. Some banks require this report before they will reverse certain types of fraud. Keep a copy for your records and share it with your bank if they ask for proof of the fraud report.
Filing with the FTC does not cost anything and does not require a lawyer. The report is yours to keep and use whenever you need to prove to a creditor or bank that you reported the fraud.
Decide whether to place a fraud alert or credit freeze
A fraud alert tells credit bureaus to contact you before opening new accounts in your name. It lasts one year and is free. A credit freeze locks your credit file so no one can open new accounts without your permission — it is also free and lasts until you remove it.
You need a fraud alert or freeze only if you believe someone has more of your personal information than just your account number — for example, if they also have your Social Security number, date of birth, or address. A bank account number alone is not usually enough to open new credit accounts, so many people skip this step.
If you decide to place a fraud alert, contact one of the three credit bureaus (Equifax, Experian, or TransUnion) and they will notify the other two. If you decide on a credit freeze, you must contact each bureau separately. Both take about 15 minutes to set up online.
Understand what a bank account number can and cannot do
A bank account number is useful to a fraudster only if they also have your routing number or bank name. Together, these allow someone to set up an ACH transfer or automatic bill payment. They cannot use it to make purchases at stores or online, and they cannot withdraw cash from an ATM.
ACH transfers are slower than card transactions — they usually take one to three business days to complete. This delay works in your favor because your bank has time to catch the transfer and stop it if you have reported the account as compromised. Bill payments set up through your account number are also reversible if you catch them quickly.
The real risk is that a fraudster could use your account number to pull money out repeatedly over weeks or months before you notice. This is why daily monitoring matters more than panic. Most fraudsters move on to easier targets if they see the account is being watched.
Change your passwords and review your security settings
Log into your bank's website or app and change your online banking password to something you have never used before. Use a combination of uppercase letters, lowercase letters, numbers, and symbols. Do not use information someone could guess, like your birthday or address.
Check your bank's security settings. Many banks let you set up two-factor authentication, which requires a code from your phone before anyone can log in. Turn this on if it is available. Some banks also let you set a daily transfer limit or require approval before large transfers go through — these are worth enabling if your bank offers them.
If you use the same password for other accounts, change those too. A fraudster who has your bank account number might also try to access your email, social media, or other financial accounts using the same password.
Report the fraud to your employer if direct deposit is involved
If your paycheck is deposited directly into the compromised account, tell your employer's payroll department what happened. They can help you set up direct deposit to a new account or issue a paper check instead while you sort things out. This prevents a fraudster from intercepting your paycheck.
Your employer may also need to know if someone tries to change your direct deposit information without your permission — this is a sign that a fraudster has accessed your employee account. Most payroll systems have security features to prevent this, but alerting your employer gives them a heads-up to watch for suspicious activity.
If you have automatic bill payments set up through your bank account, contact those companies (utilities, insurance, subscriptions) and ask them to update your payment method or pause payments while you transition to a new account.
Consider opening a new bank account if transfers keep appearing
If unauthorized transfers continue even after you have reported the fraud and your bank has flagged the account, ask your bank about closing the compromised account and opening a new one. This is a last resort, but it stops the bleeding immediately because the fraudster no longer has a valid account number to use.
Before you close the old account, make sure all your legitimate automatic payments and direct deposits have been moved to the new account. Your bank can help you with this transition. Keep the old account open for 30 to 60 days after the last fraudulent activity to make sure no more charges appear, then close it.
Opening a new account takes about 15 minutes online or in person at a branch. You will get a new account number and routing number, which you will need to give to your employer and any companies that pull money from your account automatically.
Frequently Asked Questions
Can someone withdraw money from my account with just my account number?
Not directly. They would need your routing number as well to set up an ACH transfer or bill payment. They cannot use it to withdraw cash at an ATM or make purchases. However, if they have both numbers, they can pull money out electronically over several days.
How long does it take for unauthorized transfers to show up?
Most ACH transfers take one to three business days to complete. Some fraudsters wait a week or more before attempting a transfer to see if the account is being monitored. Check your account daily for at least 30 days after reporting the compromise.
What if my bank says they cannot reverse the unauthorized transfer?
Ask them to explain why in writing. Under federal law, your liability is limited to $50 if you reported within two business days. If your bank refuses to reverse it, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov.
Do I need to close my account if someone has my account number?
Not necessarily. Most people can prevent fraud by monitoring the account closely and setting up fraud alerts with their bank. Close the account only if unauthorized transfers keep appearing despite your bank's fraud monitoring.
Should I place a credit freeze if only my account number was compromised?
A credit freeze is most useful if a fraudster also has your Social Security number or other personal information. If they only have your account number, a fraud alert or daily account monitoring is usually enough. A freeze is free to set up, so you can do it for peace of mind if you want to.