A bank account number alone is not enough to move money out of your account

Your account number is one piece of information, but not the complete set needed to withdraw funds or make transfers. To actually move money, someone needs your account number and your routing number and authorization from you or from your bank. A scammer or curious person with only your account number cannot drain your account or make purchases without additional steps that you would likely notice.

That said, your account number does have real uses that you should understand. It identifies your specific account within your bank, so it appears on checks, statements, and wire transfer forms. The risk is not that someone steals money with it alone, but that they use it as a starting point for something else—like setting up an unauthorized automatic payment, requesting a wire transfer in your name, or using it to commit fraud elsewhere.

Key Takeaways

  • Your account number by itself cannot be used to withdraw cash or make online transfers without your routing number and some form of authorization.
  • Someone with your account number and routing number can set up automatic payments or ACH transfers if they also have access to your online banking or can impersonate you to your bank.
  • Your account number appears on checks and statements, so it is visible to anyone who handles your mail or sees a check you write.
  • The real risk is not when ready theft but unauthorized recurring charges or transfers that take time to notice and dispute.
  • If you suspect misuse, contact your bank when ready and review your account for unfamiliar transactions or payment authorizations.

What actually happens when someone has your account number

If someone obtains your account number through a data breach, a lost check, or a bill you throw away, they have information that identifies your account at your specific bank. They do not have permission to touch it. Your bank's systems require additional verification before any transaction clears—either a password, a signature, a PIN, or a request that comes through a verified channel.

The most common misuse is setting up an automatic payment or ACH debit in your name. This requires either access to your online banking login or a phone call to your bank in which someone convinces a representative they are you. Neither is trivial. If someone calls your bank claiming to be you and asks to set up a payment to their account, a competent bank will ask security questions: your mother's maiden name, your Social Security number, a recent transaction, or a code sent to your phone number on file.

The second risk is a wire transfer request. Wire transfers move money quickly and are hard to reverse, so they are attractive to fraudsters. But again, your bank will not send a wire based on a phone call from someone who cannot answer security questions or provide a password. Some banks require a separate wire transfer password or a code sent to your phone.

How your account number gets exposed and what to do

Your account number appears on every check you write, so anyone who handles your mail, sees a check on your desk, or receives a check from you has it. It also appears on your bank statements, which is why you should not leave statements in the trash or recycling bin unshredded. Data breaches at retailers, utilities, or other companies you pay can expose it too.

If your account number has been exposed in a breach or you suspect someone has it, you do not need to close your account when ready. Instead, monitor your account for unfamiliar transactions and set up alerts with your bank. Most banks offer free alerts for large deposits, withdrawals, or transfers. You can also check your online banking regularly for any payment authorizations you did not set up—these appear as "scheduled payments" or "recurring transactions" in your settings.

If you find an unauthorized transaction or payment authorization, contact your bank right away. Federal law protects you against unauthorized electronic transfers, and your bank is required to investigate. The sooner you report it, the better your protection. Most banks will reverse unauthorized ACH transfers within one to three business days if you report them promptly.

The difference between account number and routing number in fraud

Your account number identifies your account. Your routing number identifies your bank and branch. Together, they form the information needed for an ACH transfer or automatic payment. Separately, each is less useful to a fraudster.

Someone with only your account number cannot initiate an ACH transfer without knowing which bank to send it to—they would have to guess your routing number or already know it. Someone with only your routing number cannot target you specifically. But if a fraudster has both, they can attempt to set up an automatic payment to themselves or request a wire transfer in your name.

This is why your routing number is printed on every check (bottom left corner) and your account number is printed next to it (bottom center). Anyone who sees a check has both pieces. This is not a security flaw in the system—it is by design, because legitimate businesses need this information to process payments and direct deposits. The security comes from the authorization layer, not from keeping the numbers secret.

What you should and should not worry about

You should not worry about someone making a one-time purchase or withdrawal with your account number alone. Credit card fraud works that way—a number is stolen and used when ready—but bank account fraud does not. Banks do not process transactions based on account numbers the way merchants process credit card numbers. Every transaction requires verification.

You should watch for recurring unauthorized charges. These are easier to set up because they often go unnoticed for weeks or months. An unauthorized gym membership, subscription service, or utility payment might not show up in your mental accounting until you review your statement. Set up account alerts and review your transactions weekly, especially if your account number has been exposed.

You should also be cautious about who you give your account number to. Legitimate businesses—your employer for direct deposit, your utility company for bill payment, your mortgage lender—need it and are trustworthy. But you should not give it to someone who calls you unsolicited, even if they claim to be from your bank. Your bank already has your account number. If they need to verify something, they will ask security questions or send you to their official website or phone number.

Steps to take if you think your account number has been misused

First, log into your online banking and review your recent transactions. Look for any transfers, withdrawals, or payments you did not make. Also check your scheduled or recurring payments—fraudsters sometimes set these up to run in the future, giving them time to disappear before you notice.

Second, contact your bank by phone using the number on your statement or their official website. Do not use a phone number from an email or text message, as these could be fraudulent. Tell them you suspect unauthorized activity and ask them to review your account. They can place a temporary hold on your account or flag it for monitoring.

Third, file a dispute for any unauthorized transactions. Your bank will investigate and typically reverse the charge within one to three business days if it is clearly fraudulent. Keep records of all communications with your bank, including the date, time, and name of the representative you spoke with.

Fourth, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion). This makes it harder for someone to open new accounts in your name, though it does not protect your existing bank account. A fraud alert is free and lasts one year; a credit freeze is also free and lasts until you remove it.

When to close your account and open a new one

Closing your account should be a last resort, not your first move. It is inconvenient—you have to update your direct deposit, change bill payment information, and get new checks—and it does not actually protect you if the fraudster already has your information. If they have your account number, they likely have other information too, and closing the account does not erase that.

Close your account only if your bank tells you to, or if you have experienced repeated unauthorized activity that the bank cannot stop. In most cases, monitoring your account, setting up alerts, and disputing unauthorized charges is enough. Your bank's fraud protection is designed to handle this, and federal law requires them to investigate and reverse unauthorized transfers.

If you do decide to close your account, do it in person at a branch if possible. Bring a photo ID and ask the bank to close the account and issue you a cashier's check for any remaining balance. Then open a new account at the same bank or a different one, and update all your automatic payments and direct deposits to the new account number.

Frequently Asked Questions

Can someone use my account number to make an online purchase?

No. Online retailers process credit and debit card transactions, not bank account numbers. If you give a retailer your account number, they cannot charge it without additional authorization. Some legitimate businesses ask for your account number for ACH payments (like utility companies or insurance), but these require you to authorize the payment first.

What if someone uses my account number to open a new bank account?

This is identity fraud, not account fraud. Opening a new account requires more than your account number—it requires your name, address, Social Security number, and often a government ID. If you suspect someone has done this, contact the bank where the fraudulent account was opened, file a report with the Federal Trade Commission, and place a fraud alert with the credit bureaus.

Do I need to change my account number if it has been exposed?

Not necessarily. Changing your account number is inconvenient and does not may provide protection if the fraudster has other information about you. Instead, monitor your account closely and set up alerts. If you experience repeated unauthorized activity that your bank cannot stop, then ask about changing your account number.

Is my account number the same as my debit card number?

No. Your debit card number is different from your account number. Both are printed on your debit card, but they serve different purposes. Your card number is used for point-of-sale purchases and online transactions. Your account number is used for ACH transfers, wire transfers, and direct deposits. If your debit card is lost or stolen, you can cancel it without closing your account.

What should I do if I see a charge from a company I do not recognize?

Contact your bank when ready and ask what the charge is for. The company name on your statement might be abbreviated or use a parent company name you do not recognize. If you confirm it is unauthorized, dispute it with your bank. They will investigate and reverse it if it is fraudulent. Keep records of all communications with your bank and the company.