No, someone cannot drain your account with only the account number

A bank account number alone is not enough to transfer money out of your account or make purchases. Banks require additional verification before moving funds — usually a PIN, password, or signature. Your account number is more like your mailing address: it identifies where money should go, but it does not unlock access to the account itself.

That said, your account number is not worthless to someone with bad intent. It is one piece of information they might combine with other details to commit fraud. Understanding what is actually possible — and what is not — helps you know when to worry and when you do not need to.

Key Takeaways

  • Your account number alone cannot be used to withdraw money, transfer funds, or make purchases without additional authentication like a PIN or password.
  • Someone with your account number and routing number can set up direct deposits or automatic payments in your name, which your bank may process before verifying the request.
  • If someone uses your account number fraudulently, your bank is responsible for reversing unauthorized transactions under federal law, though the process takes time.
  • The real risk is when your account number is combined with other information like your name, address, or Social Security number, which enables identity theft or account takeover.
  • Monitoring your account regularly and reporting suspicious activity within 60 days is your strongest protection against fraud involving your account number.

What someone can do with your account number and routing number

If someone has both your account number and your routing number, they can attempt to set up automatic payments or direct deposits in your name. This is the real vulnerability. Your employer or a creditor, for example, uses these two numbers to deposit or withdraw money. A fraudster can do the same thing — they can try to set up a payment from your account to theirs, or redirect a paycheck.

The catch is that these transactions do not happen when ready. When someone initiates an ACH transfer (the system most direct deposits and bill payments use), the bank processes it over one to two business days. During that window, the receiving bank has a chance to verify the request, though many do not perform thorough checks on incoming transfers. If the transfer goes through, you will see it on your statement, and you can report it as unauthorized.

Some fraudsters also use account numbers to set up recurring payments — subscriptions, gym memberships, or utility bills — that charge your account monthly. These are easier to spot because they appear on your statement, but they are also easier to reverse if you report them quickly.

Why your bank cannot straightforward reverse everything

Federal law (Regulation E) protects you from unauthorized electronic transfers, but the process is not when ready. If you report fraud within 60 days of the transaction appearing on your statement, your bank must investigate and typically refund the money while they look into it. If you wait longer than 60 days, your protection shrinks significantly, and the bank may not refund you at all.

The investigation itself takes time — usually 10 business days, though the bank can extend it to 45 days if they need more information. During that period, the money may stay out of your account. If the bank finds the transaction was truly unauthorized, they reverse it and the fraudster's bank claws back the money. If the fraudster has already withdrawn it or closed the account, recovery becomes much harder.

This is why timing matters. The moment you notice a suspicious transaction, report it. Do not wait to see if it resolves itself.

How account number fraud usually starts

Fraudsters rarely operate with just an account number. They usually collect it as part of a larger theft. Common routes include phishing emails that ask you to "verify your account," data breaches at retailers or service providers, or social engineering where someone calls your bank pretending to be you.

Once they have your account number, they often combine it with information from public records, social media, or other breaches — your name, address, phone number, or Social Security number. With that combination, they can attempt account takeover by calling your bank and claiming to be you, or they can use the account number to set up fraudulent payments.

The account number itself is often the least valuable piece of information in a fraud scheme. It is the supporting details that make the fraud possible.

What to do if your account number has been compromised

If you believe your account number has been shared or stolen, contact your bank when ready. You do not need to wait for fraudulent activity to appear. Your bank can flag your account, monitor it for suspicious activity, and in some cases issue you a new account number.

A new account number is not automatic — some banks do it for free if fraud has occurred, others charge a small fee, and some require you to close the account and open a new one. Ask your bank what options they offer. If you have automatic payments or direct deposits set up, you will need to update those with your new number, so factor that into your decision.

You should also place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) if you suspect identity theft. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place one for free by contacting any one of the three bureaus, and they notify the others.

Protecting your account number going forward

Your account number is not secret in the way a password is — it appears on every check you write and on your statements. But that does not mean you should hand it out casually. Only provide it to organizations you initiated contact with and trust: your employer, your bank, a utility company you called directly.

Be skeptical of unsolicited requests. If someone calls or emails asking for your account number, hang up or close the email and call the organization directly using a number you find yourself. Scammers often spoof caller ID or create fake websites that look legitimate.

Check your statements regularly — at least monthly, ideally weekly. Most banks offer free online access, and many let you set up alerts for transactions over a certain amount. The faster you spot fraud, the faster you can report it and the more protection you have under federal law.

Frequently Asked Questions

Can someone open a new bank account using my account number?

No. Opening an account requires identity verification — a government ID, Social Security number, and usually an in-person visit or video call. An account number alone is not enough. However, if a fraudster has your full identity information, they can open accounts in your name, which is identity theft rather than account number theft.

What if someone uses my account number to set up a subscription I did not authorize?

Report it to your bank as an unauthorized transaction. The bank will investigate and typically refund you while they do. You should also contact the company running the subscription and ask them to cancel it and remove your account number from their system. Keep records of your report to the bank and the company.

Is it safe to write my account number on a check?

Yes. Checks are designed to show your account number — that is how they work. The risk is not the account number itself but what happens to the check after you write it. Only write checks to people and organizations you trust, and do not leave blank checks lying around.

Do I need to close my account if my account number was exposed in a data breach?

Not necessarily. Contact your bank and ask whether they recommend closing the account or issuing a new number. Many data breaches involve millions of account numbers, and most do not result in fraud. Your bank can monitor your account and help you decide whether a new number is worth the hassle of updating automatic payments and direct deposits.

How long do I have to report fraud before I lose protection?

You have 60 days from the date the unauthorized transaction appears on your statement. After that, your protection under federal law shrinks significantly. Report suspicious activity as soon as you see it — do not wait to gather more evidence or see if it resolves itself.