Your account number alone is not enough to drain your account, but it is enough to cause real problems

A person with only your account number cannot log into your account or transfer money out on their own. Banks require additional verification—usually a PIN, password, or biometric authentication—before any transaction goes through. However, your account number is sensitive information that should not be shared casually. Combined with other details, it can be used to set up unauthorized payments, initiate wire transfers, or file fraudulent claims against your account.

The risk depends on what else someone has. Your account number paired with your routing number lets someone set up ACH transfers (automated payments) in your name. If they also have your name and address, they can attempt to change your contact information or add themselves as an authorized user. The damage is real, but it is also containable if you act quickly.

Key Takeaways

  • Your account number alone cannot be used to log in or withdraw cash, but it can be used to set up unauthorized ACH payments or wire transfers.
  • ACH fraud is the most common threat when someone has your account and routing numbers, and it can take days to reverse.
  • If you suspect unauthorized activity, contact your bank when ready and file a dispute within 60 days to receive provisional credit under federal law.
  • You are not liable for unauthorized ACH transfers if you report them promptly, but delays in reporting can limit your protection.
  • Monitoring your account regularly and setting up transaction alerts are the most effective ways to catch fraud early.

What ACH fraud looks like and how it happens

ACH stands for Automated Clearing House, and it is the system that handles most routine bank transfers. If someone has your account number and routing number, they can attempt to set up a recurring payment or one-time transfer from your account to theirs. They do not need your password. They do not need to log in. They straightforward initiate the transfer as if they were a business collecting a payment from you.

This is why utility companies, subscription services, and landlords ask for your account number—it is how they set up legitimate payments. A fraudster uses the same mechanism. The transfer may appear in your account as a pending debit within hours, or it may take one to two business days to process. Many people do not notice until the money is already gone.

ACH fraud is common because it is low-risk for the fraudster and because many people do not monitor their accounts daily. The fraudster may use a fake business name or a name similar to a legitimate company you do business with, hoping you will not notice the discrepancy.

Wire transfers and what your account number enables

Wire transfers are faster and harder to reverse than ACH transfers, but they require more information. Your account number alone is not enough to wire money out of your account. The person initiating the wire also needs to be able to verify their identity to the bank—either by logging into an account, calling with the correct PIN, or presenting ID in person.

However, if someone has your account number and has also compromised your email or phone number, they may be able to reset your password and gain access to your online banking. From there, they can initiate a wire transfer directly. This is why protecting your email and phone number is as important as protecting your account number itself.

If a wire transfer is sent out of your account fraudulently, the window to recover it is much smaller than with ACH fraud. Wire transfers typically cannot be reversed once they leave your bank. You will need to file a fraud claim when ready and work with law enforcement, but recovery is not may provide.

How to protect your account number from misuse

Do not share your account number with anyone you do not trust completely. Legitimate businesses will ask for it, and that is normal—your landlord, employer, or utility company needs it to process payments. But unsolicited requests for your account number, especially by phone or email, should raise a red flag. Banks do not ask for account numbers via email or unsolicited calls.

If you must share your account number, verify you are dealing with the real organization. Call the main phone number on the back of your credit card or on the company's official website, not a number provided in an email or text. This prevents you from accidentally giving your account number to a fraudster posing as the company.

Set up transaction alerts through your bank's app or website. Most banks allow you to receive a notification whenever a transaction over a certain amount is processed. This gives you hours to dispute a fraudulent transfer before it fully clears. Some banks also offer alerts for any ACH transfer initiated from your account, regardless of amount.

What to do if you see unauthorized activity

Contact your bank when ready—do not wait for a statement to arrive. Call the number on the back of your debit card or the number listed on your bank's official website. Tell them you see a transaction you did not authorize. Do not use a phone number from an email or text, as that may connect you to a fraudster.

Your bank will ask you to describe the transaction and confirm that you did not authorize it. They will likely freeze your account or issue you a new debit card on the spot. For ACH transfers, federal law (Regulation E) requires your bank to provide provisional credit within one to three business days while they investigate. This means the money goes back into your account temporarily while the bank determines what happened.

The investigation itself takes up to 10 business days. If the bank confirms the transfer was fraudulent, the provisional credit becomes permanent. If they determine you authorized it (or cannot prove you did not), they may reverse the credit. This is rare if you report promptly and have no history of disputing legitimate transactions.

Your legal protection under federal law

Under Regulation E, you are not liable for unauthorized ACH transfers if you report them within 60 days of the statement date. This is a hard important date. If you wait longer, your liability increases significantly, and the bank may refuse to reimburse you at all.

If you report within 60 days, your liability is capped at $50, and most banks waive even that. If you report between 60 and 120 days, your liability can be up to $500. After 120 days, you may lose all protection, depending on your bank's policy.

Wire transfers are not covered by Regulation E, which is why they are riskier. If someone wires money out of your account fraudulently, you will need to file a fraud claim and work with law enforcement. Recovery is possible but not may provide, and it takes much longer.

Monitoring your account and catching fraud early

Check your account at least once a week, more often if possible. Look for transactions you do not recognize, even small ones. Fraudsters sometimes test stolen account information with a small charge first to see if it will go through before attempting a larger transfer.

Many banks offer free account monitoring tools that flag unusual activity. Some also offer credit monitoring, which alerts you if someone tries to open a new account in your name. These tools are worth setting up because they catch fraud you might otherwise miss.

If you notice a pattern of small unauthorized charges, report them when ready. Do not assume they are a mistake or that the company will fix it. Each unauthorized transaction is a separate fraud incident, and reporting them protects you legally and gives your bank a clearer picture of what is happening.

Frequently Asked Questions

Can someone use my account number to make a purchase online?

Not directly. Online retailers use credit card numbers, not bank account numbers. However, if someone has your account number and routing number, they can set up a payment through your bank's bill pay system or initiate an ACH transfer to themselves. This is different from a credit card purchase but has the same result—money leaves your account without your permission.

What if I gave my account number to someone and now I am worried?

Contact your bank and explain the situation. Ask them to monitor your account for unusual activity and consider requesting a new account number. You can also set up transaction alerts when ready. If no fraudulent activity appears within 30 days, the risk is likely low, but continued monitoring is still wise.

How long does it take to get my money back after I report fraud?

For ACH fraud, your bank must provide provisional credit within one to three business days. The full investigation takes up to 10 business days. For wire transfers, recovery is much slower and depends on whether law enforcement can locate the receiving account. Some wire fraud is never recovered.

Do I need to close my account if someone has my account number?

Not necessarily. Closing your account can actually complicate fraud recovery. Instead, ask your bank to issue a new debit card and monitor your account closely. If fraudulent activity continues, then closing the account and opening a new one may be necessary, but your bank can usually stop the fraud without that step.

Can someone open a new bank account using my account number?

No. Opening a new account requires a Social Security number, government ID, and proof of address. Your account number alone is not enough. However, if someone has your account number along with your name, address, and Social Security number, they could attempt identity theft, which is a separate and more serious crime.