Yes, but not as much as you might fear

A scammer with only your bank account number and routing number can set up unauthorized withdrawals from your account, but they cannot drain it instantly or without leaving a trail. They can attempt ACH transfers, set up bill payments in your name, or create fraudulent checks. What they cannot do is access your online banking, change your password, or move money to their own account directly—those require additional information like your login credentials or Social Security number.

The real risk depends on how quickly you notice and report it. If you catch unauthorized activity within a few days, federal law limits your liability. If you wait weeks or months, you may lose money that the bank won't recover. The key is knowing what to watch for and what to do the moment you spot something wrong.

Key Takeaways

  • A scammer can use your account number to set up ACH withdrawals or bill payments, but cannot log into your online banking or transfer money to themselves without your routing number and account number together.
  • You are liable for unauthorized transactions only if you wait more than 60 days to report them to your bank; report within two business days and your loss is capped at $50.
  • Check your bank statements weekly, not monthly, because the sooner you report fraud the more the bank must recover on your behalf.
  • If someone uses your account number to create fraudulent checks, contact your bank immediately and ask them to flag your account for check fraud.
  • Your bank account number alone is not enough to commit identity theft, but combined with your name and address it becomes a tool for opening new accounts in your name.

What a scammer can do with your account and routing number

The most common fraud using just these two numbers is ACH fraud—setting up electronic transfers directly from your account. A scammer can pose as you and authorize a one-time transfer to their own account, or set up recurring payments for a fake subscription or loan. They do not need your password or permission; they only need your account number, routing number, and your name as it appears on the account.

A second method is check fraud. With your account number, a scammer can print counterfeit checks and cash them at retail stores or deposit them into their own account. The checks will clear initially, then bounce days later when the bank discovers the forgery. By then, the scammer is gone and you are left explaining the negative balance to your bank.

A third route is bill payment fraud. Some scammers set up online bill payments using your account number, routing number, and name, directing payments to accounts they control. This is slower than ACH fraud but harder to trace because it looks like you authorized the payment yourself.

What a scammer cannot do with only your account number

A scammer cannot log into your online banking portal without your username and password. They cannot change your password, add a new email address, or set up alerts. They cannot see your balance, transaction history, or any other account details. This is why banks treat your account number differently from your login credentials—one is payment information, the other is authentication.

They also cannot transfer money directly to their own account using only your account number. ACH transfers require both your account number and your routing number, and even then the transfer goes through the banking system, leaving a record. A scammer cannot simply move $5,000 from your account to theirs in seconds.

Finally, a scammer cannot commit identity theft with only your account number. Identity theft requires your Social Security number, date of birth, and address—information that opens new credit cards or loans in your name. Your account number alone does not do that. However, if a scammer has your account number and your name and address, they can use it as one piece of a larger identity theft scheme.

How to spot unauthorized activity on your account

Check your bank statement weekly, not monthly. Most people review statements once a month, which means a scammer has 30 days to drain your account before you notice. If you check weekly, you catch fraud within days, and your liability is capped at $50 under federal law.

Watch for small, unusual transactions first. Scammers often test a stolen account number with a small charge—$1 or $5—to see if it works before attempting larger transfers. If you see a charge you do not recognize, report it immediately, even if the amount is small. Do not assume it will reverse on its own.

Set up account alerts through your bank's app or website. Most banks let you set alerts for transactions over a certain amount, new payees, or transfers outside your usual pattern. These alerts arrive by text or email within minutes of the transaction, giving you a chance to report it before the scammer moves the money further.

What to do if you spot unauthorized charges

Call your bank immediately—do not email or use the chat feature. Get the phone number from the back of your debit card or from your bank's official website, never from a search result. Tell them you see unauthorized transactions and ask them to freeze your account and review the charges.

Your bank will likely reverse the fraudulent transactions within one to three business days if you report within 60 days of the statement date. If you report within two business days, your liability is capped at $50. If you wait longer, you may be liable for the full amount.

Ask your bank to issue you a new account number and debit card. Do not wait for them to offer—request it directly. A new account number stops the scammer from making further withdrawals, and a new card ensures they cannot use the old card number if they have it.

File a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record and may help you dispute charges later if your bank pushes back. Keep the FTC report number for your records.

How to prevent fraud using your account number

Do not share your full account number over the phone unless you initiated the call and verified the recipient. If a company calls you asking for your account number, hang up and call them back using the number on your bill or their official website.

Do not write your account number on checks. Use only the routing number and account number that are pre-printed on the bottom of your checks. If you must provide your account number in writing, do so only on documents you control, like a bill payment form you are mailing directly to a known company.

Shred bank statements, old checks, and any document with your account number before throwing it away. Dumpster diving is a real method scammers use to collect account numbers.

Use a credit freeze or fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) if you have been a victim of fraud before. This does not prevent ACH fraud, but it makes it harder for a scammer to open new accounts in your name using your account number as part of a larger scheme.

The difference between account number fraud and identity theft

Account number fraud is theft from your existing bank account. Identity theft is someone opening new accounts—credit cards, loans, phone lines—in your name. The two are related but different. A scammer might start with account number fraud, get caught, and then escalate to identity theft using information they collected during the first crime.

If you are a victim of account number fraud, your bank is responsible for reversing the charges (within the liability limits above). If you are a victim of identity theft, you are responsible for disputing the fraudulent accounts with each creditor and the credit bureaus. Identity theft is much harder and slower to recover from.

This is why protecting your account number matters, but protecting your Social Security number matters more. A scammer with your Social Security number can open credit cards in your name. A scammer with only your account number can drain your checking account, but cannot create new debt in your name.

Frequently Asked Questions

Can someone use my account number to open a new bank account in my name?

No. Opening a new account requires your Social Security number, date of birth, and address. Your account number alone is not enough. However, if a scammer has your account number and your name and address, they may use that information as part of a larger identity theft scheme to open accounts elsewhere.

How long does it take for a fraudulent ACH transfer to show up on my statement?

ACH transfers typically take one to two business days to process. You may see the transaction pending in your account within hours, but it will not be final until the next business day. Report it as soon as you see it pending—do not wait for it to settle.

What if my bank says the fraudulent charge was authorized by me?

Dispute it in writing. Send a letter to your bank's fraud department stating that you did not authorize the transaction and requesting a chargeback. Include copies of any evidence—screenshots of your account, statements showing the charge, and the date you reported it. Keep a copy for yourself and send the letter certified mail so you have proof of delivery.

Can I get my money back if I wait three months to report fraud?

It depends on your bank's policy and whether you can prove you were not negligent. Federal law says you are liable for the full amount if you wait more than 60 days, but some banks will still investigate and recover money if you have a good history with them. The longer you wait, the harder it is to recover anything, so report immediately.

Should I close my bank account after fraud?

Not necessarily. Closing the account does not erase the fraud from your record, and it may hurt your banking history. Instead, ask your bank for a new account number and card, and keep the old account open for at least 60 days so you can monitor it for any additional fraudulent charges. After 60 days, you can close it if you want.