Yes, but not in the way most people fear

Someone with your account number and routing number can set up automatic withdrawals from your account — but only if you authorize it, even if you do that unknowingly. They cannot straightforward drain your account by guessing your number at an ATM or logging into your bank. The real risk is unauthorized ACH transfers (the system banks use for direct deposits and bill payments), where a fraudster poses as a business collecting a payment you supposedly owe.

The second risk is smaller but real: a scammer could use your account details to open a merchant account in your name, then process fake transactions through it. This creates a paper trail that looks like you authorized the charges, which makes disputes harder to win.

Your bank account number alone is not enough to access your money through online banking, mobile apps, or ATMs. Those require a password, PIN, or biometric authentication. But your account number is enough to initiate a pull from your account — and that is where the vulnerability sits.

Key Takeaways

  • Someone with your account and routing number can request an ACH withdrawal from your account, but your bank should block it if you report it as unauthorized before it clears.
  • The most common fraud using account numbers is fake billing — a scammer claims you authorized a recurring charge and your bank honors it until you dispute it.
  • Sharing your account number with a legitimate business (utilities, payroll, loan servicers) is safe because those companies are regulated and have fraud liability.
  • If an unauthorized withdrawal hits your account, report it to your bank within two business days to limit your liability to $50 under federal law; waiting longer can cost you more.
  • Your account number appearing in a data breach does not automatically put you at when ready risk, but monitoring your statements for unfamiliar charges becomes more important.

How ACH fraud actually works with your account number

An ACH transfer is a request to move money from one account to another through the banking system. Unlike a wire transfer, which is nearly impossible to reverse, an ACH can be disputed and reversed if you report it quickly. A fraudster with your account number can initiate an ACH debit (a pull) from your account by claiming to be a business you owe money to.

The fraudster does not need your permission in advance. They submit the ACH request to their bank, which forwards it to yours. Your bank checks whether the account number is valid and whether there are sufficient funds — it does not verify that you authorized the charge. If both checks pass, the money moves. You find out when you see it on your statement.

This is why the first 24 hours matter. If you spot the charge and report it to your bank before the ACH fully clears (usually one to two business days), your bank can reverse it and return the money. If you wait longer, the transaction is considered settled, and you have to dispute it as a consumer rather than stop it as a bank.

Unauthorized billing and recurring charges

The most common fraud using account numbers is not a one-time theft — it is fake recurring billing. A scammer sets up a charge that looks like a subscription or service you might use: a gym membership, a streaming service, a software trial, a "premium" version of a free app. They use your account number to process the first charge, betting you will not notice a small amount on your statement.

If the first charge goes unnoticed, they keep charging. If you do notice and dispute it, they often have a paper trail showing a sign-up page or terms you supposedly agreed to. That makes the dispute harder to win, even though you never actually agreed to anything.

The defense is straightforward: check your bank and credit card statements monthly, even if you think you know what is on them. Most people catch these charges within the first month or two. Once you spot it, contact your bank and dispute the charge as unauthorized. You can also ask your bank to block future charges from that merchant.

When sharing your account number is actually safe

You need to share your account number regularly for legitimate purposes: setting up direct deposit with your employer, paying bills through your bank's bill-pay system, receiving refunds, or authorizing a loan servicer to collect payments. These are safe because the businesses involved are regulated, licensed, and have fraud liability if they misuse your information.

Your employer, your bank, your utility company, and your loan servicer all have compliance requirements and audit trails. If they misuse your account number, they face fines, license suspension, or lawsuits. That regulatory weight makes them trustworthy in a way a random website is not.

The risk is not that these businesses will steal from you. The risk is that their systems get hacked, and your account number ends up in a database sold on the dark web. That is a real risk, but it is not unique to your account number — it is a risk that comes with participating in the modern financial system at all.

What to do if your account number is compromised

If your account number appears in a data breach (you will usually hear about this through a notification from the affected company), you do not need to close your account when ready. Instead, monitor your statements closely for the next few months. Most fraudsters who obtain account numbers in bulk do not use them right away — they test them slowly to avoid triggering fraud alerts.

Set up transaction alerts with your bank if you have not already. Most banks let you set a threshold — for example, alert me on any transaction over $50, or any transaction outside my home state. This gives you early warning if someone tries to use your account.

You can also contact your bank and ask them to flag your account for extra scrutiny or to require verbal confirmation before processing ACH debits. Some banks call this a "fraud alert" or "security freeze" on ACH transactions. It slows down legitimate transactions slightly, but it stops most automated fraud.

If an unauthorized charge does appear, report it to your bank when ready. Under the Electronic Funds Transfer Act, if you report it within two business days, your liability is capped at $50. If you wait longer, your liability can be up to $500. If you wait more than 60 days, you may lose the right to dispute it entirely.

Account number versus other information a fraudster needs

Your account number is useful to a fraudster, but it is not the most valuable piece of information they can steal. A fraudster with just your account number can initiate an ACH debit, but they cannot log into your online banking, transfer money to another account, or change your password. For those, they need your username and password, or your Social Security number and other identity information.

If a fraudster has your account number plus your name and address (which are often public), they can set up fake billing in your name. If they have your account number plus your Social Security number, they can open new accounts in your name. The account number alone is a piece of the puzzle, not the whole picture.

This is why data breaches that expose account numbers are serious but not catastrophic. A breach that exposes account numbers plus Social Security numbers is much worse. And a breach that exposes passwords is worse still. The damage depends on what else got out.

Frequently Asked Questions

Can someone withdraw cash from my account with just my account number?

No. Withdrawing cash requires either a debit card, a PIN at an ATM, or access to your online banking account. Your account number alone cannot be used at an ATM or to log in. However, someone can use your account number to initiate an ACH transfer that moves money out of your account, which you would then have to dispute.

What if I gave my account number to someone and now I am worried?

If you gave it to a legitimate business (your employer, your bank, a utility company), there is no when ready action needed. If you gave it to someone you are not sure about, monitor your statements for the next 30 to 60 days. If you see an unauthorized charge, report it to your bank right away. You can also ask your bank to monitor your account for suspicious activity.

Does my bank have to refund an unauthorized ACH charge?

Yes, if you report it within two business days. Your bank must reverse the transaction and return the money to your account. If you report it after two business days but within 60 days, your bank should still reverse it, but they have more discretion. After 60 days, you may lose the right to dispute it. Always report unauthorized charges as soon as you notice them.

Is it safer to use a credit card than to give out my bank account number?

Yes, in most cases. Credit card fraud is easier to dispute, and your liability is capped at $50 by law. ACH fraud is also reversible, but the timeline is tighter and the process is slower. For one-time purchases from unfamiliar businesses, a credit card is the safer choice. For recurring payments from trusted businesses, your bank account is fine.

What should I do if I see a charge from a company I do not recognize?

Contact your bank when ready and report it as unauthorized. Do not contact the merchant first — contact your bank. Your bank will investigate and reverse the charge if it is fraudulent. Once the charge is reversed, you can research who the merchant is and whether you might have authorized it unknowingly (some companies use different names on statements than on their websites).