Yes, but only if they also have your account number, and the damage is limited by federal law
A routing number alone cannot drain your account. A routing number identifies your bank; it does not identify you. Someone would need both your routing number and your account number to initiate a transfer or set up automatic withdrawals. Even with both numbers, federal law limits what they can recover from you if fraud occurs, and your bank has a legal obligation to investigate.
The real risk is not that someone steals everything and vanishes. The real risk is that you do not notice unauthorized activity for weeks, or that you miss a important date to report it. The faster you report, the smaller your liability becomes.
Key Takeaways
- A routing number by itself is not enough to steal from your account; a thief also needs your account number.
- With both numbers, someone can set up unauthorized ACH transfers or recurring debits, but federal law caps your liability at $50 if you report within two business days.
- Your liability rises to $500 if you wait more than two business days but report within 60 days; after 60 days you may lose everything.
- Your bank must investigate any unauthorized transfer you report and return your money while the investigation is open.
- Monitoring your account weekly and setting up low-balance alerts reduces the window in which fraud can happen undetected.
What a thief can do with your account and routing number
With both numbers, someone can initiate an ACH transfer (Automated Clearing House) to move money out of your account, or set up a recurring debit that pulls money on a schedule. They cannot walk into a branch and withdraw cash, and they cannot use a debit card. But they can move money electronically, and that is the main threat.
The second threat is less obvious: they can use your account number to receive payments. If they set up a fake business or list themselves as a payee for a refund, money flows into your account instead of theirs. You then become the person holding stolen funds, which creates a different legal problem for you.
The third threat is that they use your account to test stolen credit card numbers. Fraudsters sometimes make small deposits to accounts they do not own to see if a card works before using it for larger purchases. This does not drain your account, but it does create a paper trail linking your account to fraud.
Your liability under federal law
The Electronic Funds Transfer Act (EFTA) sets your maximum liability based on how fast you report the fraud. These limits explore to unauthorized ACH transfers, wire transfers initiated from your account, and debit card fraud.
| When you report | Your maximum liability |
|---|---|
| Within 2 business days of discovering the fraud | $50 |
| Between 2 and 60 calendar days after your statement arrives | $500 |
| After 60 calendar days from when your statement was sent | Unlimited — you may lose everything |
The clock starts when your bank sends your statement, not when you open it. If your statement arrives on the 15th and you do not check your account until the 75th, you have already missed the 60-day window. This is why monitoring your account weekly matters more than the amount stolen.
How to report unauthorized transfers
Call your bank's fraud line when ready — do not use the main customer service number. The phone number is on the back of your debit card and on your monthly statement. Have your account number and a list of the unauthorized transactions ready.
Your bank will place a temporary hold on your account while they investigate, usually 10 business days. During this time, the money stays frozen and you cannot access it. After 10 days, the bank must either return your money or explain in writing why they believe the transfer was authorized. If they return it, the investigation continues for up to 45 days total, but you have your money back while they work.
Follow up the phone call with a written statement. Send a letter to your bank's fraud department (the address is on your statement) describing each unauthorized transaction, the date you discovered it, and the date you reported it by phone. Keep a copy. This creates a paper trail if you need to dispute the bank's decision later.
Steps to take right now if you think you are at risk
If you have shared your account and routing number with someone you no longer trust, or if you suspect someone has them, contact your bank when ready. You do not need to wait for fraud to occur. Ask your bank to issue you a new account number. This is free and takes one to two weeks. Your direct deposits and automatic bill payments will need to be updated, but your old account number becomes useless.
Request a new debit card at the same time. Your old card will be deactivated within 24 hours. If you have set up online bill pay through your bank's website, update those payments to use your new account number before the old one closes.
Set up account alerts through your bank's app or website. Most banks allow you to set a low-balance alert (for example, if your balance drops below $500) and an alert for any transfer over a certain amount. These alerts arrive by text or email within minutes of the transaction, so you catch fraud before it spreads.
What your bank is required to do
Your bank must investigate any unauthorized transfer you report within 60 days of your statement. During the investigation, the bank cannot charge you fees related to the fraudulent transaction, and they cannot close your account without giving you written notice and a chance to respond.
If the bank finds that the transfer was unauthorized, they must return your money plus any interest you would have earned. If they find that you authorized it (for example, you gave someone permission to use your account and later changed your mind), they can hold you liable for the full amount, even if it exceeds the EFTA limits. This is why the distinction between "I did not authorize this" and "I authorized it but now regret it" matters legally.
If the bank cannot determine what happened after 45 days, they must still return your money while they continue investigating. You get your account back to normal while they work, which can take another 30 days or more.
How to reduce the risk of unauthorized transfers
Do not share your account and routing number with anyone except your employer (for direct deposit), your landlord (for rent payment), or established businesses you are paying. Treat these numbers the way you treat your Social Security number — as sensitive financial information.
If you are paying a contractor, freelancer, or small business, ask them to provide their own account number instead of giving them yours. If they insist on having your account number, use a payment service like PayPal, Venmo, or your bank's bill pay feature instead. These services do not expose your account number to the recipient.
Check your account at least once a week, not once a month. Most fraud is caught within the first week because the thief tests the account with a small transfer first. If you catch it on day three, your liability is $50. If you catch it on day 35, your liability is $500.
Frequently Asked Questions
Can someone open a new bank account using my account and routing number?
No. Opening an account requires a Social Security number, government ID, and a signature. Your account and routing number alone are not enough. However, someone could use these numbers to commit fraud in your name, which is why you should monitor your credit report and consider placing a fraud alert with the credit bureaus if you believe your information has been compromised.
What if my bank says the transfer was authorized and refuses to refund me?
You have the right to file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can force them to reconsider. You can also file a complaint with your state's banking regulator — the name and contact information are on your bank's website under "regulatory information" or "disclosures."
If I report fraud after 60 days, am I definitely liable for everything?
The EFTA says you may be liable for everything, but your bank may still investigate and refund you as a courtesy. Some banks have their own fraud policies that go beyond the federal minimum. Call your bank and ask what they will do. Document the call in writing and follow up with a letter to the fraud department.
Does changing my password protect my account from unauthorized transfers?
No. A password protects your online banking login, but someone with your account and routing number can initiate an ACH transfer without logging into your account. They can do it through their own bank's bill pay system or through a third-party payment processor. A password is still important for other reasons, but it does not stop ACH fraud.
What should I do if I gave my account number to someone and now I am worried?
Call your bank when ready and ask them to issue a new account number. This is free and takes one to two weeks. You will need to update any automatic deposits and bill payments, but your old account number becomes useless. This is the fastest way to stop any potential fraud before it starts.