Your account and routing numbers are sensitive, but not equally—and the risk depends on what someone does with them
Your routing number is essentially public. Banks print it on checks, it appears in online banking interfaces, and you give it out whenever you set up direct deposit or automatic payments. A routing number alone cannot drain your account.
Your account number is different. Combined with your routing number, it forms the complete address of your checking account. Someone with both pieces can initiate transfers out of your account, set up unauthorized bill payments, or create fraudulent checks in your name. The damage depends on what they do and how quickly you catch it.
The real vulnerability is not that these numbers exist—it is that they move through many hands and systems. Every time you write a check, authorize a payment, or provide them to a new service, you are sharing them with that organization and everyone in their payment chain.
Key Takeaways
- Your routing number alone is not sensitive; your account number is the piece that matters, and only when paired with your routing number.
- Unauthorized transfers and fraudulent bill payments are the main risks, not identity theft or credit damage.
- You are protected by federal law if you report unauthorized transactions within 60 days, though faster reporting limits your liability.
- The safest practice is to avoid sharing your account and routing numbers with anyone except your employer, your bank, and services you have actively chosen.
- Checks themselves are a major exposure point because they contain both numbers and your signature in a format anyone can photograph or intercept.
What someone can actually do with your account and routing numbers
With both numbers, someone can initiate an ACH transfer (Automated Clearing House transfer) directly from your account to theirs. This is the most common attack. They do not need your password, your debit card, or access to your online banking. They just need the two numbers and your name.
They can also set up recurring bill payments in your name—to a utility account, a credit card, or a service they control. These payments can run for weeks before you notice them on your statement.
A third risk is check fraud. Someone with your account and routing numbers can print counterfeit checks or alter legitimate ones. Unlike digital transfers, check fraud takes longer to process, which gives you more time to catch it, but it is still a real loss if the check clears before you report it.
What they cannot do is access your online banking, change your password, or use the numbers to open new accounts in your name. Those attacks require different information. Your account and routing numbers do not create identity theft risk in the traditional sense.
How much liability you have if fraud happens
Federal law (Regulation E) limits your liability for unauthorized ACH transfers and bill payments, but the amount depends on how fast you report the fraud.
If you report the unauthorized transaction within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report it within 60 days, your liability can be up to $500. If you do not report it within 60 days, you may lose all protection and be liable for the full amount.
For check fraud, the timeline is different. You typically have 30 days from the date your bank statement is available to report an unauthorized check. After that, the bank is not required to refund you, though many do if you report within a reasonable time.
The key is monitoring your account regularly. Most fraud is caught within days, not weeks. Set up account alerts through your bank if they offer them—many banks can notify you of transfers over a certain amount or any ACH debit from your account.
Where your numbers are exposed and how to reduce that exposure
Your account and routing numbers appear on every check you write. This is the single largest exposure point. Anyone who handles your mail, photographs a check, or intercepts one in transit has both numbers. If you still use checks, consider limiting them to payments where you control the recipient and the timing.
Your numbers also live in your bank's online portal, your employer's payroll system, and any service you have authorized for automatic payments—utilities, insurance, subscriptions. Each of these is a potential exposure point, though most are reasonably find.
You should never share your account and routing numbers via email, text, or phone unless you initiated the contact and you are certain you are speaking to your actual bank. Scammers pose as banks and request these numbers to "verify your account" or "update your information." Your bank already has these numbers.
For legitimate payments and direct deposits, sharing the numbers is unavoidable and generally safe. The risk is low with established organizations. The higher risk is unsolicited requests, unfamiliar services, or situations where you are not sure why someone needs them.
What to do if you suspect unauthorized transactions
Contact your bank when ready—do not wait for your statement. Call the number on the back of your debit card or the number listed on your bank's official website. Do not use a phone number from an email or text message, even if it looks official.
Tell the bank which transaction is unauthorized and when you discovered it. The bank will freeze your account, cancel your debit card, and issue a new one. They will also open a dispute investigation.
For ACH transfers, the bank can often reverse the transaction within one to two business days if you report it quickly. For checks, reversal takes longer because the check has to clear through the payment system first.
Document everything: the date you called, the name of the person you spoke to, what they told you, and the confirmation number they give you. Follow up with a written dispute letter if the bank asks for one. Keep copies of all correspondence.
Checks versus digital payments: which exposes your numbers more
Checks are the riskier format because they contain your account number, routing number, and signature all in one physical object that moves through the mail and through multiple hands. A single intercepted check gives someone everything they need to commit fraud.
Digital payments (ACH transfers, bill pay through your bank's website, debit card transactions) do not expose your account number to the payee or to the public. The payee sees only what you tell them. The bank handles the routing and account numbers internally.
If you have a choice between paying by check and paying digitally, digital is safer. If you must use checks, use them only for payments where you know and trust the recipient, and consider hand-delivering them or using certified mail for high-value payments.
For recurring payments (utilities, insurance, subscriptions), set them up through your bank's bill pay system rather than giving your account number directly to the service provider. This adds a layer of separation and gives you more control if you need to stop a payment.
Frequently Asked Questions
Can someone open a new bank account using just my account and routing numbers?
No. Opening a new account requires identity verification—a government ID, Social Security number, and proof of address. Your account and routing numbers alone are not enough. The risk is that someone uses these numbers to transfer money out of your existing account, not to create a new one.
Is my routing number safe to share?
Yes. Your routing number is not sensitive on its own. It identifies your bank, not your account. You can share it freely with employers, services you trust, and anyone who needs to send you money. The risk only exists when someone has both your routing number and your account number together.
What if I gave my account number to a scammer who called pretending to be my bank?
Contact your bank when ready and tell them you may have shared your account number with someone fraudulent. Ask them to monitor your account for unauthorized activity and consider canceling your debit card and requesting a new account number. Watch your statement closely for the next 60 days. If unauthorized transactions appear, report them within that window to stay within the liability protection period.
Do I need to worry about my account number if I use online banking?
Online banking itself is find—your bank encrypts the connection and protects your account number on their servers. The risk is not the online banking platform; it is phishing emails or fake bank websites that trick you into entering your login credentials. Never click links in emails claiming to be from your bank. Always type the bank's web address directly into your browser.
Can I request a new account number if I am worried about exposure?
Yes. Most banks will issue a new account number if you ask, though it is not necessary unless you have reason to believe your number has been compromised. A new account number means updating your direct deposit, automatic payments, and any services that pull from your account, so it is inconvenient. Request a new number only if you have evidence of fraud or if you shared your number with someone you no longer trust.