Someone can use your account number to set up unauthorized transfers out of your account, but only if they also have your routing number and can pass your bank's verification steps

Your account number alone is not enough to drain your account. A person who has only your account number cannot log into your online banking, cannot call your bank and pose as you, and cannot walk into a branch and withdraw cash. But your account number is half of what they need to move money out through ACH transfers — the system that moves money between accounts electronically.

The other half is your routing number, which is public information printed on every check and available through a straightforward search. Together, these two numbers let someone initiate a transfer from your account to theirs. Whether that transfer actually goes through depends on what your bank requires to verify the request, and what fraud detection catches before the money leaves.

Key Takeaways

  • Your account number and routing number together can be used to start an ACH transfer out of your account, but your bank will verify the request before the money moves.
  • Verification usually means a confirmation code sent to your phone or email, or a password you set — not something a stranger would have.
  • If someone transfers money out without your permission, your bank is required to investigate and return the funds if you report it within 60 days.
  • The real risk from sharing your account number is not theft, but unwanted recurring charges from merchants you authorized once and forgot about.
  • Protecting your account number matters less than protecting your password, PIN, and the phone number or email linked to your account.

How an ACH transfer actually requires more than just your numbers

An ACH transfer is the electronic movement of money between bank accounts. It is how payroll deposits work, how you pay bills online, and how someone could theoretically move money out of your account without your permission. The system is built on the assumption that the person initiating the transfer has a legitimate reason to do so.

To start an ACH transfer, someone needs your account number and routing number. But to complete it, your bank has to verify that the request is real. Most banks do this by sending a confirmation code to your phone or email, or by requiring you to log in with a password. A person who has only your account number cannot do any of these things. They would need access to your phone, your email account, or your online banking password — at which point your account number is almost irrelevant, because they already have everything else.

Some banks also flag transfers that are unusual for your account — transfers to new recipients, transfers larger than your typical activity, or transfers at odd times. These flags do not stop the transfer, but they trigger a call or email asking you to confirm. If you did not authorize it, you can say so when ready, and the bank can reverse it before the money leaves.

What happens if someone does move money out without permission

If an unauthorized ACH transfer leaves your account, you have legal protection under the Electronic Funds Transfer Act. You have up to 60 days from the date the transaction appears on your statement to report it to your bank. Once you report it, your bank is required to investigate and return the money while they investigate — usually within 10 business days.

The bank's investigation takes up to 45 days. If they determine the transfer was truly unauthorized, the money stays in your account. If they determine you authorized it (even if you forgot you did), you lose the money and the bank keeps it. This is why the 60-day window matters: the sooner you report it, the sooner the investigation starts, and the sooner you get your money back if it was fraud.

In practice, unauthorized ACH transfers are rare. They require either that someone has your full banking information plus a way to verify the transfer, or that they have already compromised your email or phone. The more common problem is authorized charges you forgot about — subscriptions, memberships, or one-time purchases where you gave a merchant your account number and they kept charging it.

The real risk: recurring charges from merchants you authorized

If you have given your account number to a merchant — for a subscription, a utility bill, a gym membership, or a one-time purchase — that merchant can charge your account again. They are supposed to stop when your membership ends or when you tell them to, but some do not. This is not theft, because you authorized the first charge. But it is unauthorized in the sense that you did not consent to the second, third, or tenth charge.

To stop a recurring charge, contact the merchant first and ask them to cancel. If they do not, you can tell your bank to block future charges from that merchant. This is called a stop payment order, and it costs nothing. Your bank will block any charges from that merchant for a set period — usually 6 months to a year. You can renew it if the charges continue.

This is why your account number is less sensitive than your password or PIN. Your password controls access to your entire account. Your account number controls only what merchants you have already authorized can do. And even then, you have a 60-day window to dispute it.

What actually needs protecting: your password, PIN, and phone number

Your account number is printed on your checks and visible to anyone who sees a check you write. Your routing number is public — it is the same for every customer of your bank. Neither of these is secret. What is secret is your password, your PIN, and the phone number or email linked to your account.

Your password is what lets someone log into your online banking and move money directly. Your PIN is what lets someone withdraw cash at an ATM or use your debit card. Your phone number or email is what lets someone reset your password or intercept a confirmation code. If someone has any of these three, they can take money from your account without needing your account number at all.

Protect these by using a password manager to create and store a unique, strong password for your bank. Do not use the same password anywhere else. Do not share your PIN with anyone, and do not write it down. Keep your phone number and email current with your bank, and turn on two-factor authentication if your bank offers it — this means a confirmation code is sent to your phone or email before any sensitive action, like changing your password or adding a new payee.

What to do if you think someone has your account information

If you think someone has your account number and routing number but nothing else, you do not need to close your account. Monitor your statements for unauthorized charges, and report any you find within 60 days. Your bank will investigate and return the money.

If you think someone has your password, PIN, or phone number, act when ready. Log into your online banking and change your password. Call your bank and ask them to change your PIN. Update your phone number and email with your bank if either has changed. Ask your bank to place a fraud alert on your account — this tells other banks to verify your identity carefully if someone tries to open new accounts in your name.

If you see unauthorized charges on your statement, report them to your bank right away. Do not wait until the 60-day window is almost closed. The sooner you report it, the sooner your bank can reverse it and investigate.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

No. Opening a new account requires a government ID, proof of address, and a Social Security number. Your account number alone cannot do this. However, if someone has your Social Security number, date of birth, and address, they might be able to open an account in your name — but that is identity theft, not account number theft.

Is it safe to give my account number to a merchant or employer?

Yes, it is standard practice. Employers need your account number to deposit your paycheck. Utilities, insurance companies, and subscription services need it to charge your account. The risk is not that they will steal from you, but that they will keep charging after you cancel. You can always dispute unauthorized charges within 60 days.

What if I wrote a check and the person who received it has my account number?

They have your account number, but they cannot access your account without your password or PIN. They could theoretically set up an ACH transfer, but your bank would verify the request before the money moves. If you are worried, monitor your statements and report any unauthorized charges within 60 days.

Do I need to close my account if someone has my account number?

No. Closing your account is unnecessary and inconvenient. Instead, monitor your statements for unauthorized activity, and report anything suspicious within 60 days. Your bank is required to investigate and return the money if the charge was unauthorized. If you see a pattern of fraud, then consider closing the account and opening a new one.

What is the difference between a debit card number and an account number?

Your debit card number is different from your account number. If someone has your debit card number, they can make purchases online or over the phone. If someone has your account number, they can set up ACH transfers or recurring charges. Both are protected by your bank's fraud policies, but account number fraud is less common because it requires more steps to complete.