What a bank account number alone lets someone do

A bank account number by itself is not enough to drain your account or make purchases. Your account number identifies where money goes, but it does not authorize anyone to move it. What matters is what else they have—your routing number, your signature, access to your online login, or a forged check.

The real risk is not that they can spend your money directly. The risk is that they can use your account number as one piece of a larger fraud, or as a starting point to gather more information about you. Someone with your account number can request a wire transfer in your name if they also have other details. They can set up automatic payments from your account if they convince your bank they are you. They can deposit a forged check and withdraw it before the bank catches on.

The damage depends entirely on what else they know or can obtain. A bank account number sitting alone in a data breach is low-risk. A bank account number combined with your name, address, and Social Security number is much higher risk.

Key Takeaways

  • Your account number alone cannot be used to withdraw money or make purchases—someone needs additional information or authorization to move funds.
  • The real danger is using your account number as part of a larger fraud scheme, such as setting up unauthorized automatic payments or requesting wire transfers.
  • Forged checks and ACH (automated clearing house) transfers are the most common ways fraudsters use account numbers to steal from bank accounts.
  • If you believe your account number has been compromised, contact your bank when ready to place a fraud alert and monitor your account for unauthorized activity.
  • Your routing number is more sensitive than your account number because it identifies your specific bank, making it easier for someone to target you.

How forged checks put your account at risk

A forged check is the most straightforward way someone uses your account number to steal. If a fraudster has your account number and routing number, they can print a check with your name on it, deposit it at their own bank, and withdraw the money before your bank discovers the check is fake.

The fraud typically works like this: the check clears at the fraudster's bank within one or two business days. Your bank does not catch the forgery until days or weeks later, after the money has already been withdrawn. By then, the fraudster is gone. You are left responsible for the loss until your bank's investigation concludes—which can take 10 business days or longer.

This is why banks ask for both your account number and routing number when you give out payment information. Together, they form the complete address of your account. Alone, an account number is less useful, but it is still a piece of the puzzle.

Unauthorized ACH transfers and automatic payments

ACH transfers are electronic transfers between bank accounts. They are slower than wire transfers but cheaper and easier to set up. A fraudster with your account number can attempt to initiate an ACH transfer out of your account, or set up a recurring automatic payment to themselves.

The barrier here is that your bank should require authorization before allowing an ACH transfer from your account. In theory, a fraudster cannot straightforward request money and have it leave. In practice, if they have your account number, routing number, and enough personal information to pass your bank's verification questions, they may be able to convince a customer service representative that they are you.

This is why banks ask security questions and require you to verify your identity before approving transfers. But if a fraudster has your Social Security number, date of birth, and address along with your account number, they have a real chance of passing that verification.

Wire transfers requested in your name

Wire transfers move money faster than ACH transfers and are harder to reverse. A fraudster cannot initiate a wire transfer from your account using only your account number. They would need to either call your bank and convince a representative they are you, or access your online banking login.

However, if they have your account number along with other personal details—your name, address, phone number, and answers to your security questions—they can call your bank's wire transfer line and request a transfer. The representative will verify your identity using information the fraudster has already gathered.

Once a wire transfer leaves your account, it is nearly impossible to recover. Wire transfers are designed to be final. Your bank can attempt to recall the transfer, but if the receiving bank has already released the funds, you have lost the money.

What fraudsters need beyond your account number

Your account number is useful to a fraudster, but it is not the whole story. To actually move money, they typically need one or more of the following:

  • Your routing number (to identify your specific bank)
  • Your name and address (to match what your bank has on file)
  • Your Social Security number or date of birth (to pass security questions)
  • Access to your online banking login and password
  • Access to your email or phone number (to intercept verification codes)
  • Your signature (to forge checks in your name)

A data breach that exposes only account numbers is less dangerous than one that exposes account numbers along with names, addresses, and Social Security numbers. This is why you should be more concerned if your account number appears in a breach alongside other personal information.

Steps to take if your account number has been exposed

If you learn that your account number has been compromised—through a data breach notification, suspicious activity on your account, or any other means—contact your bank when ready. Do not wait. Call the number on the back of your debit card or the number listed on your bank's official website.

Tell your bank that your account number may have been exposed. Ask them to monitor your account for unauthorized activity and to alert you if they see anything suspicious. Some banks will place a fraud alert on your account, which means they will call you before approving any large transfers or changes to your account.

Request a new debit card and a new account number if your bank offers it. A new account number makes any forged checks or ACH transfers using the old number useless. Some banks will do this for free if fraud has occurred; others may charge a small fee if you are straightforward being cautious.

Monitor your account statements closely for the next several months. Set up account alerts through your bank's app or website so you are notified when ready of any withdrawals or transfers. If you see unauthorized activity, report it to your bank right away.

How to protect your account number going forward

Your account number is not secret in the same way your password is. You give it out regularly—to your employer for direct deposit, to creditors for bill payments, to merchants for online purchases. But that does not mean you should give it out carelessly.

Be cautious about who you provide your account number to. If someone calls you claiming to be from your bank, do not give them your account number. Legitimate banks already have this information. Hang up and call your bank directly using the number on your card or statement.

When you receive bills or statements in the mail, shred them before throwing them away. Dumpster diving for account numbers is old-school fraud, but it still happens. Use a cross-cut shredder if possible.

If you use online bill pay or automatic payments, review them regularly. Make sure every recurring payment is one you authorized. If you see a payment you do not recognize, contact your bank when ready and dispute it.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

No. Opening a new account requires a government-issued ID, proof of address, and a Social Security number. Your account number alone is not enough. However, if a fraudster has your name, address, and Social Security number along with your account number, they could potentially open an account in your name at a different bank.

What is the difference between my account number and my routing number in terms of fraud risk?

Your routing number identifies your bank; your account number identifies your specific account within that bank. Together, they form the complete address of your account. Your routing number is slightly more sensitive because it narrows down which bank to target. But both together are what a fraudster needs to move money.

If someone has my account number, will my bank automatically protect me?

Your bank is required by law to investigate unauthorized transactions and typically refunds fraudulent charges within 10 business days. However, you must report the fraud. If you do not notice unauthorized activity and report it within 60 days, your liability may be higher. Check your account regularly and report anything suspicious when ready.

Should I close my account if my account number was exposed in a data breach?

Not necessarily. Closing an account can be disruptive if you have automatic payments or direct deposits set up. Instead, ask your bank for a new account number and monitor your account closely. If you see unauthorized activity, then consider closing the old account and transferring everything to a new one.

Can someone use my account number to get a loan in my name?

No. A lender needs much more than an account number to approve a loan. They need a credit process, proof of income, and a credit check. Your account number alone cannot be used to borrow money. However, if a fraudster has your full personal information, they could potentially explore for a loan in your name using your account number as proof of banking history.