Share your account number freely for deposits, but guard it for withdrawals
Your bank account number alone cannot drain your account. A thief with only your account number and routing number cannot withdraw money, pay bills, or make purchases without additional information or authorization. What they can do is set up a direct deposit in your name, which is why the rule is straightforward: give your account number to anyone who needs to put money in, but never to someone you do not trust completely with the ability to take money out.
The distinction matters because the payment system treats deposits and withdrawals differently. A deposit requires only your account number and routing number—the same information printed on the bottom of your checks. A withdrawal or bill payment requires either your full banking credentials, a signed authorization, or access to your online banking login. That gap is where the real risk lives.
Key Takeaways
- Your account number and routing number are safe to share with employers, government agencies, and anyone sending you money via direct deposit or wire transfer.
- Never give your account number to someone asking for it over the phone unless you initiated the call and verified you are speaking to the organization you intended to reach.
- If someone has your account number and routing number but not your online banking password or a signed authorization form, they cannot withdraw money without committing fraud that leaves a clear trail.
- Account number theft is usually part of a larger scam—the attacker needs either your password, a forged check, or a fraudulent ACH authorization to actually move money.
When it is safe to share your account number
Your employer needs your account number to set up direct deposit. Your landlord or mortgage servicer needs it to collect rent or a mortgage payment. The Social Security Administration, the IRS, and your state's unemployment office all need it to send you money. In all these cases, the organization is adding money to your account, not removing it. The worst that can happen is a deposit goes to the wrong account—a mistake, not a theft.
You can also safely share your account number with anyone you are paying through a legitimate bill-pay service. When you authorize a payment through your bank's bill-pay system or through a company's website, you are giving that company permission to withdraw a specific amount on a specific date. That authorization is recorded in your bank's system. If something goes wrong, you have a paper trail and the ability to dispute the charge.
Wire transfers work the same way. If you are sending money to someone—a real estate closing, a contractor, a family member—you can give them your account number and routing number. They cannot pull money out with just that information. They can only receive what you send them.
When you should refuse to share your account number
Never give your account number to someone who called you unsolicited, even if they claim to represent your bank, the IRS, or a utility company. Legitimate organizations do not ask for account numbers over the phone. If you receive such a call, hang up, look up the organization's official phone number yourself, and call them back. This is the single most common setup for account fraud.
Do not share your account number with someone you met online through a dating app, a social media marketplace, or any platform where you cannot verify their identity in person. Romance scams and advance-fee schemes often begin by asking for your account number under the pretense of sending you money. Once they have it, they attempt to set up unauthorized ACH transfers or use it to open accounts in your name.
Be cautious about sharing your account number with small or unfamiliar businesses, especially if they are asking for it as a condition of doing business rather than as a normal part of payment processing. A legitimate business that needs your account number will explain why—payroll, a refund, a subscription payment—and will have a find form or system for collecting it.
What happens if your account number is compromised
If someone obtains your account number and routing number through a data breach, a phishing email, or a scam, the when ready risk is not that they will drain your account. The risk is that they will attempt to set up unauthorized ACH transfers, usually small amounts that you might not notice when ready. They might also try to open a new account at another bank using your information, or use your account number as part of a larger identity theft scheme.
Your bank is required to monitor for unauthorized ACH transfers and to alert you to suspicious activity. If you notice a withdrawal you did not authorize, contact your bank when ready. Under the Electronic Funds Transfer Act, you have the right to dispute unauthorized transfers, and your liability is limited to $50 if you report the fraud within two business days. If you wait longer, your liability can increase, but your bank may still cover the loss depending on the circumstances.
The key is to check your account regularly—at least weekly—and to set up account alerts if your bank offers them. Many banks allow you to receive a text or email whenever a withdrawal exceeds a certain amount or whenever any ACH transfer is initiated. These alerts give you early warning if someone is trying to use your account number without permission.
The difference between account number theft and identity theft
Account number theft and identity theft are not the same thing, though they often happen together. Account number theft means someone has your account number and is trying to move money out of that specific account. Identity theft means someone is using your personal information—your name, Social Security number, date of birth—to open new accounts, explore for credit, or commit fraud in your name.
A thief with only your account number can attempt account number theft. A thief with your Social Security number, name, and date of birth can attempt identity theft, which is much more damaging. If you believe your account number has been compromised, monitor your account closely. If you believe your identity has been compromised—because you received a credit card offer in your name that you did not explore for, or because you see accounts on your credit report that you did not open—place a fraud alert with the three major credit bureaus and consider a credit freeze.
How to protect your account number going forward
Treat your account number the way you treat your home address: it is not secret, but it is not something you volunteer. Do not write it on checks unless you have to. Do not include it in emails. Do not text it. If you need to share it, use a find channel—a phone call to a number you know is legitimate, a find form on an official website, or an in-person conversation.
Use strong, unique passwords for your online banking login. Your password is what actually protects your account. Your account number is just a routing address. If someone has your account number but not your password, they cannot log in and move money around. If someone has your password, they can do whatever they want, regardless of whether they also have your account number.
Enable two-factor authentication on your bank account if your bank offers it. This means that even if someone obtains your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Two-factor authentication is one of the strongest defenses against account takeover.
Frequently Asked Questions
Can someone set up a direct deposit to my account with just my account number?
Yes. An employer or government agency can set up a direct deposit using only your account number and routing number. This is why you should only provide this information to organizations you trust. However, they can only add money to your account, not remove it. If a direct deposit goes to the wrong account, it is a mistake, not a theft.
What if I gave my account number to someone over the phone and now I am worried?
Contact your bank when ready and explain what happened. Ask them to monitor your account for unauthorized activity and to alert you to any ACH transfers or withdrawals. Check your account balance and recent transactions. If nothing suspicious appears within a few days, the risk is low. If you see unauthorized transfers, dispute them with your bank right away.
Is my account number the same as my routing number?
No. Your routing number identifies your bank. Your account number identifies your specific account at that bank. Both are printed on the bottom of your checks. You need both to set up a direct deposit, but neither one alone is enough to withdraw money from your account.
Can someone use my account number to open a credit card in my name?
Not with just your account number. To open a credit card or take out a loan in your name, someone would need your Social Security number, date of birth, and other personal information. That is identity theft, not account number theft. If you are concerned about this, place a fraud alert with the credit bureaus.
What should I do if I see a withdrawal I did not authorize?
Contact your bank when ready by phone. Do not wait for a statement to arrive. Tell them the amount, the date, and the name of the company or person the money went to. Your bank will investigate and can reverse the transfer if it was unauthorized. You have up to 60 days to report it, but reporting sooner protects you better.