A routing number alone is not enough to drain your account
Your routing number identifies your bank, not your money. A person who has only your routing number cannot transfer funds, make purchases, or access your account. They would also need your account number, and even then, most transfers require additional verification—a password, a one-time code, or authorization through your bank's app.
The routing number is printed on every check and is public information. Your bank publishes it on their website. It is designed to be shared. What matters for account security is what comes after: your account number, your login credentials, and the verification methods your bank uses to confirm you are really you.
Key Takeaways
- A routing number by itself cannot be used to access or drain your account because it does not identify which account holds the money.
- Criminals need both your routing number and account number to set up a transfer, and most banks require additional proof of identity before processing it.
- The real risk is when routing and account numbers are combined with other information—your name, address, or login password—that lets someone impersonate you.
- Checking accounts and savings accounts linked to your routing number are protected by different fraud rules depending on how the unauthorized transfer happened.
- If you notice an unauthorized transfer, contact your bank when ready; the window to dispute it is typically 60 days, but faster reporting protects you better.
What a routing number actually identifies
A routing number is a nine-digit code that tells the banking system which institution holds the account. When you receive a direct deposit or pay a bill by bank transfer, your employer or the biller uses your routing number to find your bank. The routing number for Chase in New York is different from the routing number for Chase in California, and both are different from Bank of America's routing number.
The routing number does not point to a specific account. Thousands of accounts at the same bank share the same routing number. Without your account number—the second piece of information—a routing number is like having a street address without a house number. A person cannot access money without knowing which account to access.
Why criminals need more than just a routing number
To move money out of your account, someone needs to initiate a transfer. The most common methods are ACH transfers (the system used for direct deposits and bill payments), wire transfers, or setting up automatic payments. Each method requires the account number. Many also require a password or login credentials.
If someone tries to set up an ACH transfer using your routing and account number, your bank's system will recognize the request and may flag it if the destination account is new or unusual. Some banks require the account holder to confirm the transfer through a text message, email link, or app notification. Others require a phone call to verify. These steps exist specifically to catch transfers that the real account owner did not authorize.
Wire transfers have higher security barriers. Most banks require you to call a specific phone number, verify your identity with security questions or a PIN, and confirm the destination account details. Some banks will not process a wire to a new recipient without a waiting period or additional verification.
When routing and account numbers become dangerous
The risk rises sharply when your routing number and account number are combined with other information. If someone has your full name, address, account number, and routing number—information that might appear on a check or in a data breach—they can attempt to set up an ACH transfer. If they also have your online banking password, they can log in and initiate transfers themselves, bypassing some verification steps.
The most dangerous scenario is when someone uses your routing and account number to set up unauthorized automatic payments or recurring transfers. Once the first payment goes through, subsequent payments may process with less scrutiny. This is why criminals sometimes target people's bank details through phishing emails, fake websites, or data breaches that expose multiple pieces of information at once.
Another risk is check fraud. If someone has your routing number and account number, they can print counterfeit checks and attempt to cash them. The check will have the correct routing and account numbers, making it appear legitimate. The bank may not catch the forgery when ready, especially if the check is deposited at an ATM or through mobile deposit rather than presented in person.
What your bank will and will not cover
If someone makes an unauthorized transfer from your account using ACH, you are protected under Regulation E, a federal rule that limits your liability. If you report the fraud within two business days of discovering it, you are responsible for no more than $50 of the loss. If you wait longer than two business days but report it within 60 days, you could be liable for up to $500. After 60 days, you may not be able to recover the money at all.
Wire transfers and checks have different rules. Wire fraud is covered under different regulations, and your bank may have a longer window to investigate but may not be required to refund the money if you authorized the wire (even if you were tricked into doing so). Counterfeit checks are the bank's responsibility to catch, though the process of proving the check was forged and getting your money back can take weeks.
The key is speed. The moment you notice a transfer you did not make, contact your bank. Do not wait to see if it reverses on its own. Call the phone number on the back of your card or the number listed on your bank's official website—not a number from an email or text message, which could be fraudulent.
Steps to take if you think your account is at risk
If your routing and account number have been exposed in a data breach or you suspect someone has them, you do not need to close your account when ready. Instead, monitor your account closely for the next 60 to 90 days. Check your transactions daily, set up account alerts if your bank offers them, and watch for small test transfers—criminals sometimes make a small unauthorized transfer first to see if it goes through before attempting a larger one.
If you see unauthorized activity, contact your bank right away by phone. Provide the date and amount of the unauthorized transfer, and ask the bank to reverse it and investigate. Request that they place a fraud alert on your account, which adds an extra verification step to future transfers. You can also place a fraud alert with the credit bureaus (Equifax, Experian, and TransUnion) to make it harder for someone to open new accounts in your name.
Consider changing your online banking password and enabling two-factor authentication if your bank offers it. Two-factor authentication requires you to confirm your identity through a second method—usually a code sent to your phone or generated by an authenticator app—before you can log in or make transfers. This is one of the strongest protections available.
Frequently Asked Questions
Can someone use my routing number to set up a direct deposit to their account?
No. A direct deposit requires your account number, not theirs. The routing number tells the system where to send the money; the account number tells it which account at that bank. Someone cannot redirect your paycheck without your account number.
What if I gave my routing number to a scammer by mistake?
A routing number alone is not enough to access your account. Monitor your account for unauthorized activity, but you do not need to take when ready action unless you also shared your account number, password, or other personal information. If you did share those details, contact your bank and change your password.
Is my routing number the same as my account number?
No. Your routing number is nine digits and identifies your bank. Your account number is typically 10 to 12 digits and identifies your specific account. Both appear on your checks, but they serve different purposes.
Can someone hack my account if they have my routing number and name?
They would still need your account number. A name and routing number are not enough to initiate a transfer or access your account. However, if they also have your address or other identifying information, they may be able to guess or find your account number through other means, so treat any exposure of personal information seriously.
How long do I have to report unauthorized transfers?
For ACH transfers, you have up to 60 days to report fraud and potentially recover your money, but your liability increases after two business days. For wire transfers and checks, the timeline varies. Contact your bank when ready rather than waiting—the sooner you report it, the better your chances of recovery.