Yes, but it's harder than you might think, and your bank has rules to protect you

Someone who has only your account number and routing number cannot walk into a bank and withdraw cash. They cannot use it like a debit card at a store. But they can use those numbers to set up an ACH transfer — an electronic movement of money from your account to theirs — or to create a fake check. The good news is that banks are required to refund most of this theft, and you have legal protection under federal law. The catch is that you have to notice it quickly and report it.

The real risk is not a stranger with your account number. It is someone you gave permission to — a contractor, a landlord, a utility company, someone you paid online — who then takes more money than you authorized, or keeps taking money after you told them to stop. That happens more often than outright theft, and it is also recoverable, but the process is different.

Key Takeaways

  • A thief with only your account and routing numbers can create unauthorized ACH transfers or counterfeit checks, but cannot withdraw cash or use your account like a debit card.
  • Federal law requires your bank to refund unauthorized transfers if you report them within 60 days of the statement showing the theft.
  • The biggest risk is not a stranger but someone you authorized to take one payment who then takes more — a contractor, landlord, or subscription service.
  • You can stop future payments from a company by contacting your bank and filing a dispute, even if you originally said yes to the first payment.
  • Monitoring your account weekly, not monthly, catches theft early enough to recover the money.

How a thief uses your account number to steal

An ACH transfer is how most bills are paid electronically — your mortgage company, your employer, your insurance company all use it. To set one up, you need a bank account number, a routing number, and the name on the account. A thief with those three pieces can log into their own bank account and create a transfer out of your account into theirs.

The bank's computer system does not verify that the person requesting the transfer actually owns the account. It assumes that if someone has the account number and routing number, they have permission. This is why ACH fraud happens — the system trusts the numbers, not the person.

A thief can also use your account number to print a counterfeit check. They write a check from your account to themselves or to a business they control, deposit it into their bank, and cash it. This takes longer to discover because checks clear slowly, sometimes days after deposit.

What your bank is required to do

Under the Electronic Funds Transfer Act, a federal law, your bank must refund unauthorized ACH transfers if you report them within 60 days of the statement date showing the theft. This is not a favor — it is a legal requirement. The bank's job is to prove the transfer was authorized, not your job to prove it was not.

For counterfeit checks, the rules are slightly different. Your bank has a duty to catch forged checks, but the timeline and your protection depend on how quickly you report it. If you catch it within 30 days of the statement, the bank almost always has to refund you. After 30 days, your protection weakens, and after one year, you lose it entirely.

The key word in both cases is report. Your bank cannot refund theft it does not know about. If you check your account once a month and do not notice a fraudulent transfer for 90 days, you are past the 60-day window and the bank may refuse to refund it.

Authorized payments that turn into theft

This is where most account-number theft actually happens. You authorize a contractor to take one payment for work, or you sign up for a subscription service, or you give a landlord permission to draft your rent. Then they take more money than you said yes to, or they keep taking money after you canceled.

This is not technically theft — you did authorize the first payment — but it is fraud, and your bank has to stop it. You file what is called a dispute or a chargeback. You tell your bank: "I authorized one payment of $500, but they took $500 twice," or "I canceled this service in March but they are still taking money in April."

Your bank will freeze the disputed amount while they investigate. They contact the company and ask for proof that you authorized the larger amount or the ongoing payments. If the company cannot show that proof, your bank refunds you. This usually takes 10 to 30 days.

How to stop a company from taking more money

If a company is taking money from your account without permission, you have two options that work at the same time. First, contact the company directly and tell them to stop. Get confirmation in writing — an email, a text, anything that shows you asked them to stop on a specific date. Keep that proof.

Second, contact your bank and file a dispute for any unauthorized charges. Tell your bank the date you asked the company to stop. Your bank will then block future payments from that company to your account — a process called stopping payment. This is different from disputing a charge that already happened. Stopping payment prevents future charges.

If the company tries to take money again after you have stopped payment, your bank will reject it. The company will see the rejection and know they cannot collect from you that way. Some will try other methods — sending you a bill, hiring a collector — but they cannot pull money from your account anymore.

Why monitoring your account weekly matters

The 60-day window for reporting ACH fraud is real, and it starts the moment your bank sends you the statement showing the theft. If you check your account once a month, you might not see the fraudulent transfer until 35 days after it happened. That leaves you only 25 days to report it and stay within the window.

If you check weekly — even just a quick look at your phone — you catch unauthorized transfers within days. That gives you plenty of time to report it and stay well within the 60-day protection window. Many banks now let you set up alerts: you can ask your bank to text you or email you whenever a transfer over a certain amount leaves your account.

Weekly monitoring also catches the "authorized payment that became theft" problem faster. If a contractor takes an extra $500 on day one and you do not notice until day 45, you have already lost 45 days of the 60-day window. If you notice on day three, you have 57 days to dispute it.

What to do if you spot unauthorized transfers

Call your bank when ready. Do not email, do not wait. A phone call creates a record with a date and time. Tell them you see a transfer you did not authorize, give them the date and amount, and ask them to start an investigation. Write down the name of the person you spoke to and the time of the call.

Your bank will ask you to confirm that you did not authorize the transfer. They may ask where the money went — to what account or business. If you know, tell them. If you do not, say so. They will then freeze that amount in your account while they investigate.

Follow up in writing. Send an email or a letter to your bank's fraud department restating what you reported by phone. Include the date of the call, the name of the person you spoke to, the date and amount of the unauthorized transfer, and the date you are sending this follow-up. This creates a paper trail that protects you if there is a dispute later about when you reported it.

Frequently Asked Questions

Can someone use my account number to open a new account in my name?

No. Opening a new account requires a government ID, a Social Security number, and usually an in-person visit or a video call. An account number alone is not enough. What they can do is use your account number to transfer money out of your existing account, which is why monitoring matters.

What if my bank says the transfer was authorized and refuses to refund it?

You can file a complaint with the Consumer Financial Protection Bureau, a federal agency that oversees banks. You can also contact your state's banking regulator. If the bank cannot prove you authorized the transfer, these agencies can force them to refund it. Keep all documentation of your dispute.

Do I have to pay for fraud protection or monitoring services?

No. Your bank is required by law to refund unauthorized transfers at no cost to you. Services that charge you to monitor your account or protect you from fraud are selling something you already have. Your bank's free alerts are sufficient.

How long does it take to get my money back?

For ACH transfers, your bank usually refunds you within 10 business days while they investigate. The full investigation can take up to 45 days, but you get your money back much sooner. For counterfeit checks, it depends on how quickly you report it, but refunds usually happen within 10 to 30 days.

Should I close my account if someone stole from it?

Not necessarily. Closing the account does not undo the theft or speed up the refund. What matters is that you reported it to your bank. You can keep the account open while the investigation happens, or close it after you are refunded. Either way, your legal protection is the same.