A scammer can use your bank account number to pull money out, but only if they also have other information
Your bank account number alone is not enough for someone to drain your account. They need your account number and your routing number to set up an unauthorized withdrawal. Even with both, most banks will reverse the transaction if you report it quickly. The real risk is not that they empty your account in one pull—it is that they use your number to set up recurring unauthorized debits, or they sell it to someone else who does.
The damage depends on what else they have. If they only have your account number, they cannot do much. If they have your account number, routing number, and your name, they can attempt an ACH (Automated Clearing House) transfer or set up a bill payment in your name. If they also have your Social Security number or other identity details, the risk expands to opening new accounts or taking out loans in your name.
Key Takeaways
- A scammer needs both your account number and routing number to pull money via ACH; your account number alone is not sufficient.
- Unauthorized ACH transfers can be reversed if you report them within a specific window, usually 60 days from when you first see the transaction.
- If a scammer has your account number and routing number, watch your account daily for unauthorized debits and contact your bank immediately if you spot one.
- Your bank account number is less sensitive than your Social Security number or full name, but treat it as private information anyway.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) protects you if a scammer tries to open new accounts in your name.
What information a scammer actually needs to steal from your account
An ACH transfer requires your account number, routing number, and the name on the account. Your routing number is not secret—it is printed on every check and is tied to your bank and branch. Your account number is the one piece that is not public, but it is not enough by itself. A scammer who has only your account number cannot move money without the routing number.
If a scammer has both numbers and your name, they can attempt to pull money from your account by posing as a creditor or utility company. They submit an ACH debit request to your bank. Your bank processes it if the request looks legitimate on the surface. You do not have to authorize it in advance—that is the vulnerability of ACH.
A scammer might also use your account number to sign you up for recurring payments: gym memberships, subscription services, or fake invoices. Each charge is small enough to avoid immediate notice, but they add up. Some people do not catch these until they review their statement weeks later.
How to stop an unauthorized withdrawal and get your money back
If you see a transaction you did not make, contact your bank immediately. Do not wait for the next statement. Call the number on the back of your debit card or log into your online banking and look for a fraud reporting option. Tell them the transaction is unauthorized.
Your bank will likely reverse the transaction while they investigate. Under the Electronic Funds Transfer Act, you have up to 60 days from the date the unauthorized transaction appears on your statement to report it. If you report within two business days, your liability is capped at $50. If you wait longer, your liability can go up to $500. If you wait more than 60 days, you may lose the right to a reversal entirely.
Write down the date you called, the name of the person you spoke to, and what they said they would do. Ask them to send you a written confirmation of the dispute. Keep this record. If the bank does not reverse the charge within 10 business days, follow up in writing and reference your earlier call.
Why your account number is less risky than other personal information
Your account number is printed on checks you write to people. It is visible to anyone who handles your mail or sees a check you have written. It is less sensitive than your Social Security number, which is the key to opening new accounts, taking out loans, or filing a false tax return in your name.
That said, do not hand out your account number casually. If someone calls you claiming to be from your bank or a government agency and asks for it, hang up and call your bank directly using the number on your card. Legitimate companies already have your account number if they need it; they do not call and ask for it.
If you gave your account number to a business—a landlord, an employer, a utility company—and you later suspect fraud, contact that business first. Ask whether they have had a data breach. If they have, your account number may be in a larger pool of stolen information, which increases the risk that someone will try to use it.
Steps to take if you think your account number has been compromised
First, monitor your account daily for the next 30 to 60 days. Log in to your online banking or mobile app and check for transactions you do not recognize. Set up account alerts if your bank offers them—many banks let you get a text or email when a transaction over a certain amount goes through.
Second, consider placing a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert for free by contacting one bureau; they are required to notify the other two. The alert lasts one year and can be renewed.
Third, if you have given your account number to multiple places and you are concerned about ongoing fraud, ask your bank about closing the account and opening a new one. This is not always necessary—many unauthorized transactions can be reversed—but if you are seeing repeated unauthorized debits, a new account number stops the pattern. Your bank can usually do this in one call.
Fourth, check your credit report for accounts you did not open. You can get a free report from each bureau once per year at annualcreditreport.com. If you see accounts you did not open, dispute them immediately with the bureau and the creditor.
The difference between ACH fraud and debit card fraud
If someone uses your debit card number (not your account number) to make a purchase, you have strong protection. Report it to your bank, and they will reverse the charge and send you a new card. Your liability is usually zero if you report it quickly.
ACH fraud is different because it does not require your debit card. It only requires your account number, routing number, and name. This is why ACH fraud is harder to prevent and why you need to monitor your account actively. A debit card can be replaced; your account number is tied to your bank account itself.
If you see an ACH debit you did not authorize, report it the same way: call your bank and dispute it. Your bank will reverse it while they investigate. The difference is that ACH reversals sometimes take longer because the money has to be pulled back from another bank.
What to do if a scammer is using your account number for recurring charges
If you notice the same small charge appearing multiple times—$9.99 every month, for example—contact your bank and ask them to block that merchant. Your bank can place a block on future transactions from that company. At the same time, dispute each unauthorized charge and ask for a reversal.
Contact the merchant directly and tell them to stop charging you. Explain that the charges are unauthorized. Ask them for a refund. Many merchants will refund immediately if you dispute the charge with your bank; others will fight it. Either way, your bank's dispute process protects you.
If the merchant refuses to stop and your bank cannot block them, you may need to close the account. This is a last resort, but it works. A new account number means the merchant cannot charge you anymore.
Frequently Asked Questions
Can someone open a new bank account using just my account number?
No. Opening a new account requires a Social Security number, government ID, and proof of address. Your account number alone cannot be used to open an account. However, if a scammer has your account number along with your Social Security number and other identity information, they could attempt to open accounts in your name.
What if I gave my account number to someone and now I am worried?
Monitor your account for unauthorized transactions over the next 30 to 60 days. If you see anything suspicious, report it to your bank immediately. If nothing appears after two months, the risk has likely passed. You do not need to close your account unless unauthorized charges actually appear.
Is my account number visible to other people when I pay a bill online?
No. When you pay through your bank's website or a legitimate bill payment service, your account number is encrypted and not visible to the merchant. The merchant receives a payment confirmation, not your account details. Only give your account number directly to your bank or to a company you trust completely.
Can a scammer use my account number to get a loan in my name?
Not with just your account number. A lender needs your Social Security number, date of birth, and government ID to open a loan. Your account number alone is not enough. However, if a scammer has your full identity information, they could attempt to take out a loan in your name, which is why monitoring your credit report matters.
How long does it take to get my money back after I report an unauthorized ACH transfer?
Your bank usually reverses the charge within 10 business days, though it can take up to 30 days in some cases. During the investigation, the money is typically returned to your account provisionally while the bank confirms the fraud. Ask your bank for a timeline when you report it.