Your account number alone is not enough to drain your bank account

A person who has only your account number cannot log into your account or move money out of it on their own. Banks require additional information — usually your username and password, or a one-time code sent to your phone — before they let anyone access your account or authorize a transfer. Your account number is printed on your checks and statements; it is not a secret that grants access.

That said, your account number does have real uses that you should understand. Someone with your account number and routing number can set up automatic payments from your account, or deposit money into it. They can also use it to commit fraud in other ways. The risk is not zero, but it is specific and manageable.

Key Takeaways

  • Your account number alone cannot be used to log in or withdraw money, because banks require passwords and verification codes.
  • Someone with your account number and routing number can set up automatic payments from your account without your permission.
  • The same information can be used to open a fraudulent account in your name or to commit ACH fraud, which is why you should not share it casually.
  • If you notice unauthorized payments or accounts, contact your bank when ready and file a fraud report with the Federal Trade Commission.
  • Protecting your account number matters, but protecting your password and Social Security number matters more.

What automatic payments mean and why they are a real risk

An automatic payment (also called an ACH debit) is a transfer of money from your account that happens on a schedule you set up — or that someone else sets up pretending to be you. If a scammer has your account number and routing number, they can try to create a recurring payment to themselves or to a bill collector they control.

Your bank may catch this and block it, especially if the payment is large or goes to an unusual recipient. But some fraudulent payments slip through, particularly if they are small or disguised as a legitimate bill. Once the payment goes out, you have to dispute it with your bank and prove it was unauthorized. The money does not come back when ready.

This is why your account number is worth protecting — not because it opens your account, but because it is one of two pieces of information needed to pull money out of it without your permission.

How account number fraud actually happens in practice

The most common scenario is that a scammer obtains your account number through a data breach at a company you do business with — a utility, a retailer, a healthcare provider, or a bank itself. They then either try to set up an automatic payment, or they sell the information to someone else who does.

A second scenario is that you give your account number to someone you think is legitimate — a person claiming to be from your bank, your landlord, or a government agency — and they use it fraudulently. This is why you should never give your account number to someone who calls you, even if they claim to be from your bank. Your actual bank already has your account number.

A third scenario, less common but more serious, is that a scammer uses your account number along with other personal information (your name, address, date of birth) to open a new account in your name at a different bank, or to commit identity theft. This requires more than just your account number — it requires your Social Security number or other identifying details — but it is worth knowing the risk exists.

What to do if you think your account number has been compromised

First, log into your bank account using your password and check your recent transactions. Look for any automatic payments you did not set up, any transfers you did not authorize, or any accounts you do not recognize. If you see something wrong, contact your bank when ready by phone. Use the number on the back of your debit card or on your bank statement, not a number from an email or text message.

Tell your bank what you saw and ask them to cancel any unauthorized payments and to block future ones. Ask whether they can issue you a new account number. Some banks will do this; others will not. If your bank will not, ask them to flag your account for fraud monitoring.

Second, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that can help you if the fraud spreads or if a debt collector tries to collect on a fraudulent account. You do not need a police report to file with the FTC, though you can file one if you want to.

Third, consider placing a fraud alert on your credit file. This tells credit bureaus to contact you before opening new accounts in your name. You can place a fraud alert for free by calling one of the three major credit bureaus: Equifax, Experian, or TransUnion. You only need to call one; they will notify the others.

The difference between account number fraud and account takeover

Account number fraud — someone using your account number to pull money out — is different from account takeover, where someone logs into your account using your password. Account takeover is more serious because the person has full control of your account. They can change your password, lock you out, and drain your balance.

Account takeover usually happens because your password was stolen in a data breach, or because you reused the same password on multiple websites and one of them was breached. It can also happen if you fell for a phishing email or text message that asked you to "verify" your login information.

Protecting your password is more important than protecting your account number. Use a password that is unique to your bank account, at least 12 characters long, and includes numbers and symbols. Do not reuse it anywhere else. If your bank offers two-factor authentication — a code sent to your phone when you log in — turn it on.

Why your Social Security number matters more than your account number

Your Social Security number is far more valuable to a scammer than your account number. With your Social Security number, someone can open credit cards, take out loans, file a false tax return, or commit identity theft. With just your account number, they can try to pull money from one specific account.

This does not mean you should be careless with your account number. But if you have to choose what to protect most carefully, protect your Social Security number, your password, and your date of birth. These three pieces of information, combined, can do far more damage than an account number alone.

When it is safe to share your account number

It is safe to share your account number with people and organizations you trust and who have a legitimate reason to know it. This includes your employer (if they direct deposit your paycheck), your landlord (if they ask for it to collect rent), a utility company (if you want to set up automatic bill pay), or a business you are paying intentionally.

It is not safe to share your account number with someone who calls you claiming to be from your bank, the IRS, or a government agency. Real banks and government agencies do not call asking for your account number. It is also not safe to share it on public social media, in an email to someone you do not know, or on a website that does not have a find connection (look for "https://" and a lock icon in your browser).

If you are unsure whether someone has a legitimate reason to ask for your account number, hang up and call them back using a number you know is real — the number on your statement, the back of your card, or the official website of the organization.

Frequently Asked Questions

Can someone open a bank account in my name using just my account number?

No, not with just your account number. They would need your Social Security number, date of birth, and address. However, if a scammer has your account number and obtains your other personal information through a data breach or by other means, they could attempt to open an account in your name. This is identity theft, not account number fraud.

What if I see a charge I do not recognize on my bank statement?

Contact your bank when ready by phone. Describe the charge and tell them you did not authorize it. Your bank will investigate and may reverse the charge while they look into it. You have the right to dispute unauthorized charges, though the process and timeline vary by bank.

Do I need to close my account if my account number was exposed in a data breach?

Not necessarily. Monitor your account for unauthorized activity, and ask your bank to flag it for fraud monitoring. Many banks will issue a new account number if you ask. Closing the account is an option if you feel unsafe, but it is not required unless your bank recommends it.

Is it safe to write my account number on a check?

Yes. Your account number is already printed on every check you write, and checks are meant to be seen by the people you pay. The risk of writing your account number on a check is very low.

What should I do if someone calls asking for my account number?

Hang up. Do not give your account number to anyone who calls you, even if they claim to be from your bank. Legitimate banks do not call asking for account numbers. If you want to verify the call, hang up and call your bank back using the number on your card or statement.