What a scammer can do with your account number alone
A scammer with only your bank account number—without your name, routing number, or online login—cannot drain your account or make purchases in your name. They cannot log into your online banking, transfer money out, or use it like a debit card. Your account number by itself is not enough to move money.
What they can do is more limited but still worth preventing. They can attempt to set up automatic payments or recurring charges to that account, or they can try to use it as a receiving account for fraudulent transfers. They can also use it as part of a larger scheme—combining it with other information they find or buy—to eventually access your account or impersonate you to your bank.
The real risk is not what they can do today with the number alone, but what they might do with it later if they gather more information, or what they might attempt while you are not watching.
Key Takeaways
- A scammer needs more than your account number to drain your account—they typically need your login credentials, routing number, or your name and other identifying information.
- With only your account number, a scammer can attempt to set up recurring charges or fraudulent transfers to that account.
- Your bank's fraud monitoring may block unauthorized transactions before they clear, but you should report any suspicious activity within 24 hours.
- If you gave out your account number to someone you do not trust, contact your bank immediately and ask them to watch for unauthorized activity.
Why your account number alone is not enough for a full theft
Your bank account number is one piece of information among many that a scammer would need to actually steal from you. Think of it like your street address—it tells someone where you live, but they still need a key to get inside.
To transfer money out of your account, a scammer typically needs either your online banking username and password, or they need to call your bank and convince a representative that they are you. To do that second thing, they need your name, your Social Security number, your date of birth, and possibly answers to security questions your bank has on file. Your account number alone does not give them those things.
To use your account number to make a purchase or payment, they would need to know your routing number as well—a separate nine-digit code that identifies your bank. Even then, many merchants and payment systems have fraud detection that flags unusual activity.
What scammers actually attempt with an account number
The most common move is to set up an automatic payment or subscription charge to your account. If you gave your account number to a fake website or a scammer posing as a utility company, they might try to bill you monthly for a service you never ordered. Your bank may catch this and block it, but you will still see the attempt on your statement.
Another tactic is to use your account number as a receiving account for money laundering or fraud. A scammer might deposit stolen funds or the proceeds of another scam into your account, then try to withdraw it. This puts you at risk of being flagged by your bank's compliance team, because your account is now part of a fraud chain.
Scammers also buy and sell account numbers on the dark web or in bulk data breaches. Your number might sit in a database for months before anyone tries to use it, or it might be combined with other stolen information—your name from a data breach, your Social Security number from a credit report—to build a fuller picture of you.
How to tell if someone is using your account number fraudulently
Check your bank statement every week, not just once a month. Look for charges you do not recognize, especially small recurring ones—scammers often test with a small charge first to see if it will go through. Look for transfers to accounts you do not own, or ACH debits from companies you have never heard of.
Your bank's fraud monitoring may catch unauthorized activity before it clears. If it does, you will usually see a notification or a hold on the transaction. Some banks send alerts for any transaction over a certain amount, or for any transaction from a new merchant. Turn these alerts on if your bank offers them.
If you see something suspicious, do not wait. Call your bank's fraud line immediately—the number is on the back of your card or in your online banking portal. Do not use a phone number from an email or text message, because that might be a scammer pretending to be your bank.
What to do if you gave your account number to a scammer
Call your bank right away. Tell them you gave your account number to someone you do not trust, and ask them to flag your account for monitoring. They may offer to issue you a new account number, which will close the old one and open a new one. This is the safest move if you are worried.
A new account number means any automatic payments you have set up—paychecks, bill payments, subscriptions—will stop working until you update them with your new number. This is inconvenient, but it is more secure than leaving an account number in a scammer's hands.
Ask your bank what their fraud liability policy is. Under federal law, if someone uses your account number without permission and your bank did not catch it, you are typically liable for no more than $50 if you report it within 60 days. If you wait longer, your liability can go up. Some banks offer zero-liability policies that are more generous, but you have to report fraud quickly to get that protection.
When your account number is part of a larger data breach
If your account number was exposed in a data breach—a hack of a retailer, a healthcare provider, or a financial company—the risk is different. In a breach, scammers often get your account number along with your name, address, and sometimes more. This combination is more dangerous because it gives them more of the puzzle pieces they need.
If you know your account number was in a breach, contact your bank and ask them to monitor your account. You do not necessarily need a new account number—many breaches are discovered and reported before scammers have time to act on the data. But staying alert is important.
You can also place a fraud alert or a credit freeze with the three credit bureaus (Equifax, Experian, and TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts in your name. A credit freeze blocks creditors from accessing your credit report at all, which stops most identity theft cold. Both are free and can be done online.
The difference between account number fraud and identity theft
Account number fraud is when someone uses your account number to make unauthorized charges or transfers. Identity theft is when someone uses your personal information—your name, Social Security number, date of birth—to open new accounts, apply for credit, or file a false tax return in your name.
A scammer with only your account number is attempting account fraud. A scammer with your account number plus your Social Security number and date of birth is in a position to attempt identity theft, which is much more serious and takes much longer to fix.
If you think you are a victim of identity theft, not just account fraud, you will need to file a report with the Federal Trade Commission (FTC) at IdentityTheft.gov. The FTC will create a recovery plan and give you a case number you can use when you contact creditors or dispute fraudulent accounts.
Frequently Asked Questions
Can someone withdraw money from my account with just my account number?
Not directly. They would need your online banking password, or they would need to call your bank and convince a representative they are you by answering security questions. An account number alone is not enough to authorize a withdrawal or transfer.
What if a scammer has my account number and routing number?
With both numbers, they can attempt to set up ACH transfers or automatic payments to your account. Your bank's fraud detection may block these, but you should still call your bank and report the situation. Ask them to monitor your account and consider getting a new account number if you are worried.
Do I need to close my account if someone got my account number?
Not necessarily. If you caught it quickly and your bank has not seen any fraudulent activity, monitoring may be enough. If there have been unauthorized charges, or if you are very worried, a new account number is safer. Your bank can walk you through the process and help you update your automatic payments.
How long does it take for fraudulent charges to show up on my statement?
It depends on the type of charge. An ACH transfer might post within one to three business days. A recurring subscription charge might not appear until the next billing cycle. Check your account online at least weekly, not just when your statement arrives, so you catch fraud faster.
What if my bank says they cannot help me because I gave out my account number?
Push back. Your bank has a responsibility to investigate unauthorized transactions, even if you were careless with your account number. If they refuse, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can pressure your bank to take action.