Your account number alone is not enough to drain your account, but it is enough to cause real problems

A person with only your account number and routing number cannot log into your online banking or transfer money out on their own. Banks require additional verification—a password, a PIN, or biometric authentication—before any transaction happens. That said, your account number is not harmless. Someone with this information can set up unauthorized ACH transfers (automatic payments from your account), create fraudulent checks, or use it to open new accounts in your name. The risk is real, but it is different from what most people fear.

The distinction matters because it changes what you should do if your account number leaks. You are not racing to move money to safety. You are moving to prevent someone from using that number as a starting point for fraud that takes weeks or months to notice.

Key Takeaways

  • Your account number alone cannot be used to log in or make when ready transfers, because banks require passwords or other verification.
  • Someone with your account number can set up ACH transfers, write fraudulent checks, or attempt to open accounts using your identity.
  • The most common attack is a fraudulent ACH debit, which pulls money from your account but leaves a paper trail that makes it reversible.
  • Monitoring your account weekly for unauthorized transactions is more effective than trying to prevent all possible misuse.
  • Notifying your bank within 60 days of spotting fraud protects you from liability under federal law, even if the fraud took weeks to discover.

What an ACH fraud attack looks like

An ACH (Automated Clearing House) transfer is a bank-to-bank payment that moves money from one account to another. If someone has your account number and routing number, they can attempt to initiate an ACH debit—a pull of money from your account to theirs. They do not need your password. They do not need to log in anywhere. They straightforward submit the request to their own bank, claiming they have authorization to pull from your account.

Your bank is supposed to verify the request before honoring it, but the verification process is not foolproof. Some banks check less carefully than others, especially for smaller amounts. If the fraudster's request goes through, the money leaves your account. You will see it on your statement as a debit to an unfamiliar recipient. The good news: ACH transactions are reversible. Your bank can pull the money back, and the fraudster's bank is required to cooperate. The bad news: you might not notice for weeks, and the fraudster might have already moved the money again.

Fraudulent checks and account takeover attempts

Someone with your account number can order checks printed with that number and your bank's routing number. They write checks to themselves or to someone else, and those checks clear against your account. This is slower than an ACH transfer and leaves a physical trail, but it is still a real threat. You might not notice until your bank statement arrives or you log in to check your balance.

A more serious risk is account takeover. If a fraudster has your account number and can gather other personal information—your name, address, date of birth, Social Security number—they can call your bank, claim to be you, and request a password reset or a new debit card. Once they have control of the account, they can transfer money, change contact information, or lock you out. This is why account number leaks are often bundled with other data breaches. The account number alone is a tool; combined with identity information, it becomes a key.

How to respond if your account number is compromised

If you know or suspect your account number has been shared or stolen, contact your bank when ready. Tell them the account number may be compromised and ask them to flag the account for fraud monitoring. Many banks will place a temporary hold on ACH debits or require additional verification for any new ACH requests. Some will issue you a new account number and routing number, which invalidates the old ones for future transactions.

Do not close the account right away unless your bank advises it. Closing the account can actually make fraud harder to reverse, because the account no longer exists in the system. Instead, keep the account open, monitor it closely, and let your bank manage the security response. Ask your bank whether they offer free credit monitoring or fraud monitoring services as part of their fraud response.

File a report with the Federal Trade Commission at reportfraud.ftc.gov if you believe your information was used fraudulently. This creates an official record and can help you dispute charges later. You do not need to wait until fraud actually appears on your account; reporting the compromise itself is useful.

Monitoring your account for unauthorized activity

The most practical defense is regular monitoring. Check your account at least weekly—more often if you have had a data breach or know your account number is at risk. Look for ACH debits to unfamiliar recipients, checks you did not write, or transfers to accounts you do not recognize. Most unauthorized transactions appear within days or weeks of the fraud attempt, not months later.

Set up account alerts if your bank offers them. Many banks allow you to set a threshold—for example, alert me if any single transaction exceeds $500, or alert me for any ACH debit. These alerts will not stop fraud, but they will help you catch it faster. The faster you report it, the faster your bank can reverse it and the less likely the fraudster is to have moved the money beyond recovery.

If you spot a fraudulent transaction, report it to your bank in writing (email or a message through your online banking portal counts). Keep a copy of your report. Under the Electronic Funds Transfer Act, you are protected from liability for unauthorized ACH transfers as long as you report them within 60 days of the statement date. After 60 days, your liability increases, and after 120 days, you may lose protection entirely.

What your bank can and cannot do

Your bank cannot prevent someone from knowing your account number—that information is printed on every check you write and is part of your routing information. What they can do is monitor for suspicious activity and reverse fraudulent transactions. They can also place restrictions on the account, require additional verification for certain types of transactions, or issue you a new account number.

Your bank cannot force you to change your password or PIN, but they can require it as a condition of fraud protection. They cannot may provide that fraud will never happen, but they can make it less likely and easier to reverse. The relationship is a partnership: the bank provides the tools and the reversal process, and you provide the monitoring and the timely reporting.

The difference between account number leaks and full identity theft

A leaked account number is a specific, reversible problem. A leaked Social Security number combined with your name and address is the beginning of identity theft, which is much harder to undo. If your account number leaks in isolation—for example, from a merchant you paid—the risk is limited to ACH fraud and check fraud. If your account number leaks as part of a broader data breach that includes your SSN, name, and address, the risk expands to account takeover, new account fraud, and credit card fraud.

Check your credit report for signs of broader identity theft. You can request a free credit report from each of the three major bureaus (Equifax, Experian, TransUnion) once per year at annualcreditreport.com. Look for accounts you did not open, inquiries from creditors you did not contact, or negative marks that are not yours. If you find evidence of identity theft, place a fraud alert with the credit bureaus and consider a credit freeze.

Frequently Asked Questions

Can someone transfer money out of my account with just my account number?

Not directly. They cannot log in to your online banking or use your debit card. They can attempt an ACH debit, which is a request to pull money from your account, but your bank is supposed to verify the request before honoring it. If the request goes through, the transaction is reversible.

What should I do if I gave my account number to someone I do not trust?

Contact your bank and tell them the account number may be compromised. Ask them to monitor for suspicious activity and to flag any unusual ACH requests. Many banks will place a temporary hold on ACH debits or issue you a new account number. Monitor your account weekly for unauthorized transactions.

How long does it take to reverse a fraudulent ACH transfer?

Once you report it, your bank typically initiates a reversal within one to three business days. The fraudster's bank is required to cooperate. The money is usually back in your account within five to ten business days, though the timeline depends on both banks' processes. Report the fraud as soon as you spot it.

Will my bank cover the loss if someone commits fraud with my account number?

Yes, as long as you report it within 60 days of the statement date. Under federal law, you are not liable for unauthorized ACH transfers if you report them promptly. After 60 days, your liability increases. After 120 days, you may lose protection. Report fraud when ready.

Is it safe to give my account number to a merchant or employer?

Yes. Merchants and employers need your account number to process payments and direct deposits. The risk is not in giving it to legitimate businesses—it is in data breaches at those businesses or in giving it to someone you do not trust. If you are unsure whether a request is legitimate, contact the organization directly using a phone number or website you know is real.