What a bank account number alone lets someone do
A bank account number by itself is not enough to drain your account or make purchases. Someone would need additional information—usually your routing number, your name as it appears on the account, or both—to move money out. That said, a bank account number is still sensitive information and should not be shared casually, because it does enable certain actions that can cause real problems.
The most common risk is that someone uses your account number to set up an automatic debit or ACH transfer in your name. This is how many bills are paid: the biller pulls money directly from your account on a scheduled date. If someone has your account number and routing number, they can attempt to register your account with a utility company, subscription service, or other vendor and pull unauthorized payments. Your bank may not catch this when ready, especially if the first few small charges slip through.
Another risk is that your account number appears on a check or is used to set up a payment arrangement with a creditor or government agency. If someone has your account number and knows your name, they may be able to pose as you when calling your bank or a service provider to change your contact information, request a new debit card, or authorize a wire transfer.
Key Takeaways
- Your bank account number alone cannot be used to make online purchases or withdraw cash, but it can be used to set up unauthorized automatic payments or ACH transfers.
- Someone who has both your account number and routing number can attempt to register your account with billers and pull money directly from it.
- If your account number is exposed, monitor your account for unfamiliar recurring charges and contact your bank when ready if you spot them.
- Your bank is required to reverse unauthorized ACH transfers and automatic debits under federal law, though the process can take weeks.
- Changing your account number is possible but disruptive; disputing the unauthorized charges is usually faster and more practical.
Why your routing number matters as much as your account number
Your account number alone is less useful to a fraudster than your account number plus your routing number. The routing number identifies your specific bank branch. Together, these two pieces of information form the complete address of your account on the banking system.
With both numbers, someone can initiate an ACH debit—a direct pull from your account—without needing your password or access to your online banking. They can also set up recurring payments to themselves or a third party. This is why both numbers appear together on the bottom left of your checks: they are the standard way to identify an account for direct payment.
If only your account number is exposed—for example, if you gave it to a legitimate business that then had a data breach—the risk is lower but not zero. A determined fraudster could call your bank, claim to be you, and ask for your routing number. This is why you should never share your account number with anyone you do not know, and why you should be cautious about who you give it to even when you do know them.
How unauthorized ACH debits and automatic payments work
An ACH debit is a pull of money from your account initiated by someone other than you. It is different from a wire transfer or a debit card charge. ACH debits are how most recurring bills work: your utility company, insurance company, or loan servicer pulls money from your account on a set date each month.
If someone has your account number and routing number, they can attempt to register your account with a biller and set up an unauthorized ACH debit. Your bank does not verify that you authorized the debit before it goes through; the verification happens after the fact. This means the first unauthorized charge may post to your account before you notice it.
Automatic payments set up through a website or app work the same way. If someone gains access to your email or creates a fraudulent account using your name and account number, they can set up recurring charges from services like streaming platforms, online retailers, or payment processors.
What your bank must do if you report unauthorized charges
Federal law requires your bank to reverse unauthorized ACH debits and automatic payments if you report them within a certain timeframe. Under Regulation E, you have up to 60 days from the date the unauthorized charge appears on your statement to report it. Your bank must then investigate and return the money to your account within one to two business days if the charge is clearly unauthorized.
The process is straightforward: contact your bank by phone, online, or in person and tell them the charge is unauthorized. Provide the date, amount, and the name of the company that pulled the money. Your bank will place a temporary credit in your account while they investigate, which usually takes 10 business days. If the investigation confirms the charge was unauthorized, the credit becomes permanent.
If you report the charge after 60 days, your bank may still reverse it, but they are not required to by law. Some banks will do it anyway, especially if you have been a customer for a long time. It is worth asking, but do not count on it. This is why monitoring your account regularly—at least weekly—is important.
Steps to take if your account number has been compromised
If you know or suspect your account number has been exposed, start by checking your account for unfamiliar charges. Log into your online banking or call your bank and review the last 30 days of transactions. Look for small recurring charges, charges from companies you do not recognize, or charges that posted on unusual dates.
If you find unauthorized charges, contact your bank when ready. Have your statement in front of you and be ready to describe each charge: the date, the amount, and the company name. Your bank will start the dispute process and place a temporary credit in your account. Do not wait for your monthly statement to arrive; the sooner you report, the sooner the investigation begins.
Next, consider whether you need to change your account number. This is disruptive—you will need to update your account number with every legitimate biller and service that pulls money from your account, including your employer if they direct-deposit your paycheck. Most banks can change your account number within one business day, but the process requires a trip to a branch or a call to customer service. If you have only had one or two unauthorized charges and your bank has reversed them, changing your account number may not be necessary. If the fraud is ongoing or widespread, changing the number is worth the hassle.
You should also place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) if you believe your personal information has been compromised. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place a fraud alert by contacting any one of the three bureaus; they will notify the other two automatically. The alert lasts one year and is free.
What someone cannot do with just your account number
There are several things a fraudster cannot do with only your account number, even if they also have your routing number. They cannot make online purchases using your account number as a debit card; online retailers require a full card number, expiration date, and CVV. They cannot withdraw cash from an ATM. They cannot transfer money out of your account to their own bank account without your bank's involvement—a wire transfer requires additional verification.
They also cannot access your online banking account or change your password. Your bank account number is not the same as your login credentials. If someone has your account number but not your username and password, they cannot log in and see your balance or transaction history.
The main risk remains ACH debits and automatic payments. These are the most common form of fraud involving bank account numbers because they require the least additional information and are the hardest for banks to catch before the money leaves your account.
How to protect your account number going forward
Do not share your full account number with anyone unless you are certain they need it and you initiated the contact. Legitimate businesses will ask for your account number when you call them or visit their website; you should not volunteer it in an email or text message, and you should never give it to someone who calls you unsolicited.
Be cautious about where your account number appears. If you pay a bill by check, the recipient has your account number and routing number. If you set up an automatic payment with a utility or loan servicer, they have your account number. These are necessary risks, but they are still risks. Choose billers and service providers carefully, and avoid giving your account number to companies with poor security records or that you do not trust.
Monitor your account regularly. Set up account alerts through your bank's app or website so you are notified of any transaction over a certain amount, or any transaction at all if you prefer. Many banks offer free alerts for ACH debits and transfers. These alerts will not stop fraud, but they will help you catch it quickly.
If you receive a bill or notice from a company you do not recognize, contact that company when ready to confirm whether the charge is legitimate. Do not assume it is fraud; sometimes charges appear under unfamiliar company names or abbreviations. But if you confirm it is unauthorized, report it to your bank right away.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a Social Security number, government-issued ID, and proof of address. Your bank account number alone is not enough. However, someone could potentially use your account number along with other personal information to commit identity theft, which is a separate and more serious crime.
What if I gave my account number to a scammer thinking they were from my bank?
Contact your bank when ready and tell them you may have given your account number to a fraudster. Ask them to monitor your account for unauthorized activity and consider changing your account number. Also place a fraud alert with the credit bureaus. If the scammer has additional personal information about you, they may attempt identity theft as well.
How long does it take to get my money back after I report an unauthorized charge?
Your bank must place a temporary credit in your account within one to two business days of your report. The investigation usually takes 10 business days. If the charge is confirmed as unauthorized, the temporary credit becomes permanent. If the investigation is inconclusive, your bank may ask for additional documentation or may reverse the charge anyway at their discretion.
Do I need to change my account number if my number was exposed in a data breach?
Not necessarily. If no unauthorized charges have appeared on your account, changing your number may be unnecessary. Monitor your account closely for the next 30 to 60 days. If fraudulent charges do appear, your bank can reverse them. Change your account number only if fraud is ongoing or if you feel unsafe leaving the number unchanged.
Can my bank refuse to reverse an unauthorized ACH debit?
Your bank must reverse unauthorized ACH debits if you report them within 60 days. If you report after 60 days, they are not required to, but many will anyway. If your bank refuses to reverse a charge you believe is unauthorized, ask to speak with a supervisor and request a written explanation of their decision. You can also file a complaint with the Consumer Financial Protection Bureau if you believe your bank has violated Regulation E.