The short answer: not much without additional information
A hacker with only your account number and routing number can set up automatic transfers out of your account, but they cannot log in to your online banking, change your password, or access your funds directly through an ATM or debit card. The damage is real but limited to what they can do through the ACH system — the network that moves money between bank accounts.
Your account and routing number are meant to be shared. You give them to employers for direct deposit, to creditors for bill payments, and to anyone you want to send money to via bank transfer. The system assumes that if someone has these numbers, they have a legitimate reason to move money in or out. That assumption is the vulnerability.
Key Takeaways
- Someone with your account and routing number can initiate ACH transfers out of your account, but cannot access online banking or use your debit card.
- Fraudulent ACH transfers can be reversed through your bank within a specific window, usually 10 business days, if you report them promptly.
- Banks are required to reimburse unauthorized ACH transfers if you report them before the money leaves your account or within a short time after.
- The real risk comes when account and routing numbers are combined with other information like your name, address, or Social Security number.
- Monitoring your bank statements weekly and setting up transaction alerts reduces the window between when fraud occurs and when you catch it.
What an ACH transfer actually requires
The ACH network processes about 30 billion transactions per year in the United States. It is the backbone of direct deposit, bill pay, and peer-to-peer transfers. To initiate an ACH transfer, someone needs your account number, routing number, and your name — and ideally your address, though some transfers go through without it.
The system does not verify that the person initiating the transfer is actually you. It assumes the originating bank (the one sending the money out) has already done that verification. This is why fraudsters can move money if they have these pieces of information. They contact a bank or use a bill-pay service and request a transfer. The originating bank may ask for a phone number or address to match against their records, but they are not calling your bank to confirm you authorized it.
Once the transfer is initiated, it typically takes one to two business days to settle. During that window, your bank can still stop it. After it settles, reversal becomes more complicated but is still possible if you report it quickly.
What happens when you report unauthorized transfers
Federal law (Regulation E) requires banks to reimburse you for unauthorized ACH transfers if you report them within a specific timeframe. The timeline depends on when you discover the fraud and when you report it.
If you report the transfer before it settles (within one to two business days), your bank can stop it entirely. If you report it after it settles but within 10 business days, your bank must reverse it and return the money to your account. After 10 business days, the bank still has to investigate, but they have more latitude to deny the claim if they determine you were negligent or if the transfer was technically authorized by someone with access to your account.
The bank will ask you to provide a written statement describing the unauthorized transfer, the date you discovered it, and the date you reported it. Keep records of all communication — emails, call logs, the names of bank employees you spoke with. This documentation matters if the bank initially denies your claim.
When account and routing numbers become dangerous
Account and routing numbers alone are a limited threat. The real danger emerges when they are combined with other information. If a hacker has your account number, routing number, name, and address, they can open a bill-pay account at a third-party service and transfer money out. If they also have your Social Security number, they can potentially open accounts in your name at other banks.
The progression looks like this: first, fraudsters test small transfers ($1 to $5) to confirm the account is real and active. If those go through, they escalate to larger amounts. If your bank catches the small test and freezes the account, the fraud stops there. If you do not notice, they may drain thousands before you see the statement.
This is why the combination matters more than any single piece of information. Your account and routing number on a check or in a bill-pay system is normal. Your account and routing number plus your full name and address in a data breach is a problem. Your account and routing number plus your Social Security number is a serious problem.
How to reduce the window between fraud and detection
The faster you catch unauthorized transfers, the faster your bank can reverse them and the stronger your legal position. Most fraud goes undetected for weeks because people check their bank statements monthly or not at all.
Set up transaction alerts through your bank's app or website. Most banks allow you to set alerts for transfers over a certain amount (you choose the threshold), transfers to new recipients, or any ACH transfer at all. These alerts arrive by text or email within minutes of the transaction posting. If you receive an alert for a transfer you did not authorize, you can call your bank when ready and report it before it settles.
Check your account online at least weekly, ideally more often. Look for transfers you do not recognize, changes to your contact information, or new bill-pay recipients you did not add. Many frauds are caught this way before they escalate.
What fraudsters cannot do with just these numbers
Someone with your account and routing number cannot log into your online banking account. They do not have your username or password. They cannot order a new debit card, change your address, or set up a new phone number for your account. They cannot access your credit card or savings account if you have one at the same bank.
They cannot use your debit card to make purchases in stores or online. They cannot withdraw cash from an ATM. They cannot see your account balance or transaction history. The ACH system is separate from these access points. It is a back-channel for moving money between accounts, not a way to impersonate you in the banking system.
This is an important distinction. Account and routing numbers are a specific vulnerability, not a master key to your financial life. The damage is real but contained to what the ACH network allows.
Steps to take if you suspect fraud
Call your bank when ready. Do not email or use the app's message feature — call the phone number on the back of your debit card or on your bank statement. Explain the unauthorized transfer, the date it occurred, and the amount. Ask the bank to freeze your account and issue a new account number if possible.
Request that the bank place a fraud alert on your account. This tells the bank to verify your identity more carefully before processing future transfers. Some banks call this a "fraud block" or "transfer restriction." Ask what options they offer.
File a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record and may help if the fraud is part of a larger scheme. The FTC does not investigate individual cases, but the report is useful for your records and for law enforcement if you choose to file a police report.
Check your credit report at AnnualCreditReport.com (the only free, official source). Look for accounts you did not open or inquiries you did not authorize. If your Social Security number was also compromised, fraudsters may have opened credit accounts in your name.
Frequently Asked Questions
Can someone use my account and routing number to open a new bank account in my name?
Not directly with just those numbers. They would need your Social Security number, date of birth, and address to open an account. However, if your account and routing number were exposed in the same breach as other personal information, that combination becomes dangerous. Monitor your credit report for new accounts you did not open.
How long does it take to get my money back after reporting fraud?
If you report before the transfer settles, it can be stopped within one to two business days. If you report after it settles, the bank typically reverses it within 10 business days. Some banks move faster. Ask your bank for a specific timeline when you report the fraud.
Will my bank charge me a fee for disputing an unauthorized transfer?
No. Federal law prohibits banks from charging you a fee to dispute an unauthorized ACH transfer. If a bank tries to charge you, that is a violation of Regulation E. Report it to your state's banking regulator or the Consumer Financial Protection Bureau.
Should I close my account if my account and routing number were exposed?
Not necessarily. Closing the account does not erase the exposure. Instead, ask your bank to issue a new account number and set up fraud alerts and transfer restrictions. If fraudulent transfers have already occurred, keep the account open long enough to document them and work with your bank on reversals.
What if the fraudster used my account number to pay a bill I actually owe?
Report it as unauthorized. The fact that the money went to a legitimate creditor does not make the transfer authorized. Your bank must still reverse it if you report it within the required timeframe. The creditor will then pursue you for the unpaid bill through normal channels, but that is a separate issue from the unauthorized transfer.