Your account number alone is not enough to drain your account, but it is part of what a criminal needs
A hacker or scammer cannot transfer money out of your account using only your account number. They need your account number plus your routing number to identify your bank, and then they still need either your online banking password, your debit card number with its expiration date and security code, or authorization from you directly. Your account number by itself is like having someone's street address but not their house key.
That said, your account number is valuable to someone with bad intent. It is one piece of a larger puzzle. The real risk is not that your account number alone gets stolen—it is that it gets stolen along with other information, or that you are tricked into authorizing a transaction yourself.
Key Takeaways
- Your account number alone cannot be used to withdraw or transfer money without additional information like your password, debit card details, or direct authorization from you.
- Criminals typically use your account number in combination with your routing number to set up unauthorized ACH transfers or bill payments, which requires your online banking login or a phone call pretending to be you.
- The biggest risk is not theft of the number itself, but social engineering—someone calling your bank pretending to be you and using your account number to convince the bank representative to change your password or authorize a transfer.
- If you believe your account number has been compromised, contact your bank when ready to monitor for unauthorized activity and ask about fraud alerts or account freezes.
- Sharing your account number for legitimate purposes like direct deposit or bill payment is generally safe, but never share it with someone who contacts you unsolicited.
What a criminal can do with your account number and routing number
If someone has both your account number and routing number, they can attempt to set up an ACH transfer (Automated Clearing House transfer) or create a bill payment in your name. ACH transfers move money between bank accounts and are commonly used for payroll, mortgage payments, and utility bills. The problem is that many banks allow ACH transfers to be initiated online or by phone without requiring the account holder to be present.
However, most banks now require you to log into your online banking account to set up a new ACH transfer or bill payment. If the criminal does not have your password, they cannot complete the transfer through your bank's website. They would have to call your bank and try to convince a representative that they are you—which brings us to the real vulnerability.
Social engineering: the actual threat
The most common way criminals use a stolen account number is through social engineering—calling your bank, providing your account number and some personal details, and convincing the representative that they are you. If they succeed, they can ask the bank to reset your online banking password, authorize a wire transfer, or add a new payee to your bill payment system.
Banks have safeguards against this. Most require you to answer security questions or provide information that is not public (like the last four digits of your Social Security number, your mother's maiden name, or recent transactions). But if a criminal has gathered enough information about you from data breaches, social media, or public records, they may be able to answer these questions.
This is why your account number is valuable to someone with bad intent, even though it cannot be used alone. It is the starting point for a social engineering attack.
When it is safe to share your account number
You will need to provide your account number and routing number for legitimate purposes: setting up direct deposit with your employer, paying bills automatically, receiving wire transfers, or opening a new account at another bank. In these cases, sharing the numbers is generally safe because the person or organization receiving them has a specific, verifiable purpose.
The key is who is asking and how they are asking. If you initiated the contact—you called your employer's payroll department, you visited your utility company's website, you walked into a bank branch—then sharing your account number is low-risk. If someone contacted you unsolicited by phone, email, or text claiming to be from your bank or a government agency, do not share your account number, no matter what they say.
Signs that your account number may have been compromised
Watch for unauthorized ACH transfers, unexpected bill payments, or charges you did not make. You may also notice that your online banking password no longer works, or that you receive a password reset confirmation email that you did not request. Some people discover the problem when their bank calls to ask about a suspicious transaction.
If you see any of these signs, contact your bank when ready by calling the number on the back of your debit card or on your bank statement—not a number from an email or text message. Tell them you suspect fraud and ask them to review recent transactions, freeze your account, and reset your online banking credentials.
What to do if your account number has been stolen
Call your bank right away. Most banks have a fraud department that operates 24/7. Explain what happened and ask them to:
- Review your recent transactions for unauthorized activity
- Freeze your account or debit card to prevent further unauthorized use
- Reset your online banking password
- Change your security questions if possible
- Place a fraud alert on your account
Your bank may also issue you a new debit card and a new account number, depending on how the fraud occurred and how much unauthorized activity took place. If money was stolen, your bank is required by federal law to investigate and typically refunds the money within a set timeframe—usually 10 business days for initial investigation, though the process can take longer if the bank needs more information from you.
You should also check your credit report for signs of identity theft. You can request a free credit report from each of the three major credit bureaus (Equifax, Experian, and TransUnion) once per year at annualcreditreport.com. If you see accounts you did not open, place a fraud alert with the credit bureaus and consider a credit freeze.
Protecting your account number going forward
Do not write your account number on checks or bills that you mail. Do not share it in response to unsolicited calls, emails, or texts. Do not post it on social media or in online forums. Be cautious about sharing it even with people you know, unless there is a clear reason they need it.
Use strong, unique passwords for your online banking account—a mix of uppercase and lowercase letters, numbers, and symbols, at least 12 characters long. Enable two-factor authentication if your bank offers it. This means that even if someone steals your password, they cannot log in without a code sent to your phone or generated by an authentication app.
Monitor your bank statements regularly, either online or by mail. Many banks allow you to set up alerts for transactions over a certain amount, or for any transaction at all. These alerts can help you catch fraud quickly.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a government-issued ID, proof of address, and a Social Security number. Your account number alone is not enough. However, if a criminal has your account number along with other personal information, they might be able to commit identity theft and open accounts in your name.
What if I gave my account number to someone and now I am worried?
Contact your bank when ready and describe the situation. If the person had a legitimate reason for asking (like your employer or a utility company), the risk is low. If the contact was unsolicited, ask your bank to monitor your account closely and consider resetting your online banking password as a precaution.
Is it safe to write my account number on a check?
Your account number is already printed on every check you write, so anyone who sees a check has your account number. The risk comes from mailed checks being intercepted or checks being lost. For bill payments, use your bank's online bill pay system or pay directly through the company's website instead.
How long does it take to get money back if someone steals from my account?
Federal law requires banks to investigate fraud claims and typically refund money within 10 business days for initial investigation. If the bank needs more information, they have up to 45 days to complete the investigation. Once they determine the transaction was unauthorized, the money is returned to your account.
Can my bank prevent unauthorized ACH transfers without my password?
Most banks require a password to set up new ACH transfers online, but some still allow them by phone. Call your bank and ask whether they require additional verification for phone-initiated transfers, or whether you can place a restriction on your account that prevents any new ACH transfers without your in-person approval.