What a checking account number alone lets someone do
A checking account number by itself is not enough to drain your account or make purchases. Someone would need both your account number and your routing number to move money out, and even then, the transfer has to go through your bank's systems, which means there is a record and a window to stop it. A merchant or website that has only your account number cannot charge your card or pull money without your explicit permission through a formal payment setup — and even then, you can dispute it.
The real risk is not that someone steals your account number and empties the account in seconds. The real risk is that they use it to set up an unauthorized automatic payment, or they use it as part of a larger fraud scheme where they have other pieces of information too. Your account number is one piece of a puzzle, not the whole picture.
Key Takeaways
- Someone with only your account number cannot make a one-time purchase or transfer money without your routing number and explicit authorization.
- A person who has both your account and routing number can attempt an ACH transfer, but the transfer leaves a record and your bank can reverse it.
- The biggest risk is someone setting up a recurring automatic payment (like a subscription or bill payment) in your name without permission.
- Your account number alone is less sensitive than your debit card number, which includes the card's security code and expiration date.
- If you see an unauthorized transaction, contact your bank when ready — the sooner you report it, the more protection you have under federal law.
What you need to authorize an ACH transfer from your account
An ACH transfer — the electronic movement of money between bank accounts — requires three things: your account number, your routing number, and your authorization. Someone cannot legally pull money from your account with just the first two. They need documented permission, which usually takes the form of a signed authorization form, a verbal recording, or a written instruction you sent them.
This is why utility companies, insurance companies, and employers ask you to sign a form before they set up automatic payments. That form is the authorization. Without it, the transfer should not go through. If it does, your bank is responsible for reversing it and investigating.
The catch: if you gave authorization to one company and they pass your account number to a third party, or if you authorized a payment and the amount changes without your consent, you have a dispute on your hands — but not a theft. The authorization was real; the problem is what happened after.
Why merchants and websites do not need your account number
Most online retailers and subscription services do not ask for your account number at all. They ask for your debit card number, which is different. A debit card number includes the card's expiration date and CVV (the three-digit security code on the back), and those details are what merchants use to process one-time purchases. Your account number is not on your debit card.
If someone has your debit card number but not your account number, they can attempt to charge the card, but they cannot access your checking account directly. The charge goes through the card network (Visa, Mastercard, etc.), not through the ACH system. You can dispute a fraudulent card charge, and your bank will typically reverse it within a few days.
The reason some businesses ask for your account number is different: they are setting up a recurring payment or a direct debit, which requires authorization and uses the ACH system. A doctor's office, a gym, or a subscription service might ask for it. A retail website will not.
Unauthorized automatic payments and how to stop them
The most common way someone misuses an account number is by setting up an automatic payment you did not authorize. This happens when someone has your account number, routing number, and enough personal information to pose as you or to convince a company that you authorized the payment. The payment then recurs monthly or weekly until you notice it and stop it.
If you see an unauthorized automatic payment on your statement, contact your bank and the company taking the payment. Tell your bank it was unauthorized. Under the Electronic Funds Transfer Act, your bank must investigate and reverse the charge if it was not authorized. You typically have up to 60 days from the statement date to report it, though the sooner you report it, the faster the reversal.
You can also contact the company directly and ask them to stop the payment. Many will do so when ready if you tell them it was unauthorized. Some will ask for written confirmation. Keep records of all communication.
How account numbers end up in the wrong hands
Your account number can be exposed through a data breach at a company that stores it — a payroll processor, a utility company, an online banking platform. It can also be exposed if you write a check and someone photographs it, or if you give it to a scammer posing as your bank. Phishing emails and fake websites are common vectors: someone sends you an email that looks like it is from your bank, you click a link, and you land on a fake login page where you enter your account number.
Account numbers are also sometimes sold in bulk on the dark web after a breach. If your account number appears in a breach, your bank may contact you, or you may find out through a breach notification service. If you suspect your account number has been compromised, contact your bank and ask them to monitor the account for suspicious activity. You can also place a fraud alert with the credit bureaus (Equifax, Experian, TransUnion), which makes it harder for someone to open new accounts in your name.
What to do if you think someone has your account number
Call your bank when ready. Tell them you believe your account number has been compromised and ask them to watch for unauthorized transactions. Most banks can flag your account for fraud monitoring at no cost. Some will issue you a new account number and a new debit card.
Review your recent statements carefully. Look for any charges or transfers you do not recognize. If you find any, report them to your bank right away. Do not wait for the next statement. The sooner you report, the sooner your bank can investigate and reverse the charge.
If the breach came from a specific company — a retailer, a payroll processor, a utility — contact them and ask what information was exposed and what steps they are taking to find it. Ask whether they have a fraud monitoring service or credit monitoring service they are offering to affected customers. Some do.
Account numbers versus other sensitive information
Your account number is sensitive, but it is not the most sensitive piece of information someone can steal. Your Social Security number, your full name and address, and your date of birth are more dangerous because they can be used to open new accounts, explore for credit, or file a fraudulent tax return. Your debit card number with CVV is also more when ready dangerous because it can be used to make one-time purchases without authorization.
An account number alone is a tool for setting up recurring payments or transfers, not for when ready theft. It is why you should be cautious about who you give it to, but it is also why you should not panic if it is exposed. The real protection is monitoring your account regularly and reporting unauthorized activity quickly.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, a government-issued ID, and a signature. Your account number alone is not enough. However, if someone has your Social Security number and other personal information, they can attempt to open an account in your name, which is identity theft — a different and more serious crime.
What if I gave my account number to someone and now I am worried?
Contact your bank and tell them you are concerned about the account number. Ask them to monitor it for suspicious activity. Review your statements for the past 30 days and look for any charges or transfers you did not authorize. If you find any, report them when ready. You can also ask your bank to issue you a new account number.
Is my account number the same as my routing number?
No. Your routing number identifies your bank and the branch where your account is held. Your account number identifies your specific account within that bank. Both are needed to set up an ACH transfer, but they are different numbers. You can find both on the bottom left of your checks.
Can someone use my account number to see my balance or transaction history?
No. Your account number alone does not give access to your account details. To log in to your account online or by phone, you need your username or account number plus a password or PIN. If someone has your account number but not your password, they cannot see your balance or history.
What is the difference between a debit card number and an account number?
Your debit card number is printed on the front of your card and is used for one-time purchases at stores and online. Your account number is the number of your checking or savings account and is used for transfers and recurring payments. They are different numbers, and each has different risks associated with it.