Your account number alone is not enough to drain your account
A person who knows only your account number cannot transfer money out, make purchases, or access your balance. They need additional information — usually your routing number, your name as it appears on the account, and often a PIN or online password — to move money or make changes. Your account number by itself is like knowing someone's street address: it identifies where you bank, but it does not open the door.
That said, your account number is not worthless to a bad actor. It is one piece of information they might use in combination with other details to commit fraud. Understanding what they can and cannot do with it helps you know when to worry and when you can relax.
Key Takeaways
- Your account number alone cannot be used to withdraw money, make online transfers, or access your account without additional security information.
- Someone with your account number and routing number can set up automatic payments from your account if they also have your name and authorization.
- The biggest risk is ACH fraud — where someone initiates a transfer or payment using your account details without your permission.
- If you suspect fraud, contact your bank when ready; federal law limits your liability if you report within 60 days of receiving your statement.
- Sharing your account number for legitimate purposes like direct deposit or bill payments is normal and safe when you control who receives it.
What someone can do with your account number and routing number
If someone has both your account number and routing number, they can attempt to set up an ACH transfer — an automated bank-to-bank movement of money. ACH stands for Automated Clearing House, and it is the system banks use for direct deposits, bill payments, and transfers between accounts. The barrier here is not the account number itself; it is that most ACH transfers require authorization, and your bank can reverse unauthorized ones.
A person with these two numbers might also try to set up automatic bill payments in your name, redirecting money to an account they control. Again, this requires them to initiate the transaction, and your bank can catch and stop it if you report it quickly. The key word is attempt — having the numbers does not may provide success.
What they cannot do: log into your online banking, see your balance, make debit card purchases, or withdraw cash. Those actions all require passwords, PINs, or physical access to your card.
Why your bank asks for your account number
Legitimate reasons to share your account number include setting up direct deposit with your employer, arranging automatic bill payments, or receiving a wire transfer. In these cases, you are initiating the transaction and controlling who receives the information. Your employer, utility company, or the person sending you money needs the account number to know where to send the funds.
The difference between safe and unsafe sharing comes down to control: you decide when, why, and with whom you share it. If you give your account number to your landlord to set up rent payments, that is safe because you chose it and you can cancel it. If someone obtains your account number without your knowledge through a data breach or by stealing mail, that is the risk.
How ACH fraud happens and how to stop it
The most common fraud involving account numbers is ACH debit fraud. Someone uses your account number and routing number to pull money out without your permission. They might pose as a utility company, a loan servicer, or a government agency to make the unauthorized debit seem legitimate. Your bank processes it because the account number is correct, but the authorization was forged.
You catch this when you review your bank statement and see a charge you did not make. At that point, you contact your bank and report it as unauthorized. Your bank reverses the charge and investigates. Under the Electronic Funds Transfer Act, if you report the fraud within 60 days of receiving your statement, your liability is limited to $50 — and many banks waive even that.
To reduce the risk, monitor your statements regularly (weekly is better than monthly), set up account alerts if your bank offers them, and be cautious about sharing your account number with unfamiliar companies. If someone calls claiming to be from your utility or a government agency and asks for your account number, hang up and call the official number on your bill or website instead.
The difference between account number and full banking access
Your account number is one piece of information in a much larger security system. Banks layer protections: they require passwords for online access, PINs for debit cards, and verification steps for large transfers. A scammer with only your account number is like someone with your address but no key to your house.
Where account numbers become dangerous is when combined with other breached information. If a data breach exposes your account number, routing number, name, and address all together, the risk rises because a fraudster has more of the puzzle. This is why data breaches are serious even if they seem to involve "just" account numbers — the real danger is what else was exposed alongside them.
What to do if you think your account number was compromised
If you suspect your account number was exposed — through a data breach you heard about, a phishing email, or a lost piece of mail — you do not need to close your account when ready. Instead, take these steps: first, monitor your statements closely for the next few months, looking for charges or transfers you did not authorize. Second, consider setting up account alerts with your bank so you are notified of large transactions or transfers. Third, if fraud does occur, report it to your bank right away.
You can also request that your bank flag your account for extra verification on certain transactions, though this varies by bank. Some banks offer this as a free service; others may charge a small fee. Ask your bank what options they have.
Closing your account is an option if you are very concerned, but it is not required and creates its own inconvenience. Most people who have their account number exposed never experience fraud. The account number is just one piece, and your bank's fraud detection systems catch most unauthorized attempts.
Frequently Asked Questions
Can someone open a new account using my account number?
No. Opening a new account requires a government ID, a Social Security number, and usually an in-person visit or video verification. Your account number alone cannot create an account. However, if a fraudster has your Social Security number and other personal information along with your account number, they could attempt identity theft, which is a separate and more serious crime.
What if I gave my account number to someone and now I am worried?
If you gave your account number to a legitimate business (your employer, your landlord, a utility company), there is no when ready danger. If you gave it to someone you do not trust or cannot verify, monitor your statements for the next 60 to 90 days. If you see unauthorized charges, report them to your bank when ready. You are protected under federal law if you report within 60 days.
Is it safe to write my account number on a check?
Yes. Your account number appears on every check you write, and checks are designed to be handled by multiple people and organizations. The account number on a check is expected and necessary. The risk with checks is different — it is the physical check itself being lost or stolen, not the account number being visible.
Can someone use my account number to get a loan in my name?
Not with just the account number. A lender would need your Social Security number, date of birth, and a government ID to open a loan account. Your account number alone cannot be used to borrow money. If you are concerned about identity theft, you can place a fraud alert with the credit bureaus, which adds an extra verification step to any new credit applications.
Should I change my account number if it was exposed in a data breach?
You can request a new account number from your bank if you are very concerned, but it is not required. Changing your account number is inconvenient because you will need to update direct deposits, automatic payments, and any other recurring transactions. Most people monitor their statements instead and report any fraud if it occurs. Ask your bank what they recommend based on what information was exposed in the breach.