A routing number alone is not enough to drain your account
Your routing number is not a secret. It appears on the bottom left of every check you write, and banks publish them online so people can send you wire transfers. A hacker who has only your routing number—without your account number—cannot access your funds or open new accounts in your name.
What matters is what else they have. A routing number paired with your account number gives someone the ability to set up unauthorized transfers or recurring payments. A routing number paired with your name and address opens the door to social engineering—calling your bank and pretending to be you. A routing number paired with other personal details can be one piece of a larger identity theft puzzle. The routing number itself is the least dangerous part.
Key Takeaways
- Your routing number is public information and cannot be used alone to access your account or move money.
- A routing number combined with your account number allows someone to initiate transfers or set up bill payments without your permission.
- If someone has your routing number, name, and address, they may be able to call your bank and convince them they are you.
- Check your account regularly for unauthorized transactions, and report any suspicious activity to your bank within 60 days.
- Protecting your account number matters far more than protecting your routing number.
What a hacker needs to actually move your money
To transfer money out of your account, a hacker needs your account number in addition to the routing number. Together, these two pieces of information form what is called the bank account identifier—the same information you would give to an employer for direct deposit or to a creditor to set up a payment plan.
With both numbers, someone can initiate an ACH transfer (Automated Clearing House), which moves money between bank accounts. They can also set up recurring bill payments or authorize third-party withdrawals. Your bank may or may not catch this before the money leaves. Some banks verify the account holder's identity before processing; others process first and investigate later if you dispute it.
This is why your account number should be treated as confidential, while your routing number can be shared freely. If someone asks for your routing number over the phone or email, that is normal. If they ask for your account number without a clear reason you initiated, that is a red flag.
How social engineering works with a routing number
A more common attack is social engineering—calling your bank and pretending to be you. If a hacker has your routing number, name, address, and possibly your phone number, they may have enough to convince a bank employee that they are the account holder.
The hacker's goal is usually to change your contact information, reset your password, or authorize a wire transfer. They do not need your account number for this; they need to sound credible. A routing number is one small piece of the puzzle, but it signals that they know something real about your banking relationship.
Banks have gotten better at verifying identity over the phone, but the process varies. Some ask security questions; others ask for the last four digits of your Social Security number or a recent transaction amount. If a hacker has gathered multiple pieces of your personal information from data breaches or public records, they may pass these checks.
Where your routing number gets exposed
Your routing number appears in several places where it is meant to be visible: on your checks, on your bank's website, in wire transfer instructions, and in any direct deposit setup you have completed. It is also included in any ACH authorization you have signed—for payroll, bill payments, or loan applications.
If your routing number appears in a data breach, it is usually alongside your account number, name, and address. Breaches of payroll systems, mortgage servicers, and payment processors have exposed routing numbers at scale. In these cases, the routing number is the least of your concerns; the account number is what matters.
You may also see your routing number in public records if you have filed for bankruptcy or had a judgment against you. Court documents are searchable online in many jurisdictions.
What to do if you think your routing number was compromised
If your routing number was exposed in a data breach but your account number was not, you do not need to take action. Your bank will not change your routing number—it is tied to your branch and account type, not to you personally. Changing it would break any existing direct deposits or automatic payments you have set up.
If your routing number and account number were both exposed, monitor your account for unauthorized transactions. Check your bank's website or app at least weekly for the next few months. Look for ACH transfers you did not authorize, bill payments you did not set up, or wire transfers you did not initiate.
If you spot something suspicious, contact your bank when ready. Under the Electronic Funds Transfer Act, you have up to 60 days from the date the unauthorized transaction appears on your statement to report it. If you report within two business days, your liability is capped at $50. If you wait longer, you may be liable for up to $500 or more, depending on how long you waited.
You can also place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) if you are concerned about identity theft. This makes it harder for someone to open new accounts in your name, though it does not protect your existing bank account.
Signs of unauthorized ACH activity
Unauthorized ACH transfers often appear as small, recurring charges before a larger theft. A hacker may test the account with a $1 or $5 transfer to confirm the account is active before draining it. They may also set up bill payments to themselves or to a money transfer service.
Check your account statement for:
- Transfers to accounts you do not recognize
- Bill payments set up with companies you do not use
- Recurring charges that started recently and are not yours
- Withdrawals from ATMs you did not visit
- Debit card charges at merchants you do not recognize
If you use your bank's app or website, you can usually see pending transactions before they clear. Some banks also offer real-time alerts for transfers over a certain amount. Set these up if your bank offers them.
Protecting your account number versus your routing number
Your energy should go toward protecting your account number, not your routing number. Treat your account number the way you treat your Social Security number—do not share it unless you initiated the request and you know exactly why the person needs it.
Your routing number can be shared with anyone who needs to send you money: employers, creditors, family members, or service providers. It is not a secret, and protecting it will not meaningfully reduce your risk.
If you are concerned about a specific transaction or relationship, you can request a new account number from your bank. This breaks any existing ACH authorizations, so you will need to re-set up direct deposits and bill payments. It is inconvenient but possible if you believe your account number has been compromised.
Frequently Asked Questions
Can someone open a bank account in my name using my routing number?
No. Opening an account requires your full name, address, date of birth, Social Security number, and usually a government ID. A routing number alone tells them nothing about you. However, if they have your routing number along with other personal information from a data breach, they may have enough to attempt fraud.
What should I do if I gave my routing number to someone I do not trust?
Monitor your account for unauthorized transactions. If your account number was not also shared, your risk is low. If you are unsure whether your account number was exposed, contact your bank and ask them to flag your account for suspicious activity.
Is it safe to write my routing number on a check?
Yes. Your routing number is printed on every check you write, and it is meant to be visible. Anyone who receives a check from you will see it. The account number is also on the check but is harder to read. If you are concerned about a specific check, you can stop payment through your bank.
Can a hacker use my routing number to set up a wire transfer?
Not without your account number. A wire transfer requires both pieces of information. If someone calls claiming to be from your bank and asks for your account number to "verify" a wire, hang up and call your bank directly using the number on your statement.
What is the difference between a routing number and an account number in terms of security?
Your routing number is public and identifies your bank branch. Your account number is private and identifies your specific account. Together they allow someone to move money. Separately, the routing number is nearly useless for fraud; the account number is dangerous.