Someone can steal money with your account number, but only if they also have your routing number and know your bank's payment system

Your bank account number alone is not enough for a thief to drain your account. They need two pieces of information together: your account number and your routing number. Even with both, they cannot straightforward log into your account or swipe money like a debit card. Instead, they can set up what is called an ACH transfer — an electronic payment that moves money between bank accounts — or write a check in your name.

The real risk is not that your account number is secret. Banks print it on every check you write. The risk is what someone can do once they have both numbers and know which bank you use. They can pose as you and move money out, but the process takes a few days and leaves a paper trail that your bank can follow.

Key Takeaways

  • A thief needs your account number, routing number, and the name of your bank to set up an unauthorized ACH transfer or write a check in your name.
  • ACH transfers take one to three business days to complete, which gives you time to notice and report the fraud before the money leaves.
  • Your bank is required to investigate unauthorized transfers and return the money if you report them within 60 days.
  • The fastest way to stop a fraudulent transfer is to call your bank's fraud line when ready, not to send an email or visit a branch.
  • Checks written on your account are easier to stop than ACH transfers because you can put a stop payment on them before they clear.

How a thief uses your account and routing numbers

With your account number and routing number, a thief can initiate an ACH debit — a request to pull money from your account and send it to theirs. They do this by posing as a business or creditor that you owe money to. They contact their own bank and say "pull $500 from this account" and provide your account and routing numbers. Their bank then sends an electronic message to your bank asking for the transfer.

Your bank does not verify that the person requesting the transfer is actually you. It checks that the account number and routing number match a real account, and that there is enough money in it. If both are true, the transfer goes through. This is why ACH fraud happens — the system assumes that if someone has your account details, they have permission to move money.

A thief can also write a check on your account if they know your account number. They would need to know or guess your name, but many people's names are not hard to find. The check would have to be deposited into another account, which takes a few days to clear, giving you time to spot it and put a stop payment on it.

Why your account number is printed on every check

Banks print your account number on the bottom of every check because it is not meant to be secret. The routing number and account number are the address of your account — they tell one bank where to send money when someone writes you a check or sets up a direct deposit. Anyone who receives a check from you can see both numbers.

This is why your account number alone is not dangerous. What makes it dangerous is when someone has both numbers and decides to use them to take money out instead of putting money in. The system was designed this way because legitimate businesses need your account and routing numbers to pay you or collect a payment you authorized. The trade-off is that someone with both numbers can also attempt unauthorized transfers.

What your bank will do if someone steals from your account

If you report an unauthorized ACH transfer within 60 days of when it happened, your bank is required by federal law to investigate and return the money. The investigation usually takes 10 business days. During that time, the money stays out of your account, but you can ask your bank for a provisional credit — a temporary refund while they investigate — if the transfer will cause you to overdraft or miss a bill payment.

Your bank will contact the other bank (the one that received the stolen money) and ask them to return it. If the receiving bank can recover the money, it goes back to you. If the thief has already spent it, the receiving bank may not be able to recover anything, but your bank still has to cover the loss under federal law. This protection is called Regulation E, and it applies to ACH transfers and electronic payments.

Checks are handled differently. If someone writes a fraudulent check on your account, you can call your bank and put a stop payment on it before it clears. This costs a small fee (usually $25 to $35) but prevents the check from being paid. If the check has already cleared, you can still dispute it, and your bank will investigate and return the money if they confirm it was fraudulent.

Steps to take if you think someone has stolen from your account

Call your bank's fraud line when ready — do not wait for a letter or email. The phone number is on the back of your debit card or on your bank's website. Tell them which transaction is fraudulent and ask them to freeze your account so no more transfers can go out. Ask for a provisional credit if the transfer will cause you to overdraft.

Write down the date and time you called, the name of the person you spoke to, and what they told you. Ask them to send you a written confirmation of the fraud report. This creates a record in case you need to dispute the charge later or if the bank claims you never reported it.

Check your account every few days for the next two weeks to make sure no other unauthorized transfers go through. If you see more fraud, call again and report each one. Keep all documentation — bank statements, emails, call records — in case you need to file a dispute with your state's banking regulator.

How to prevent ACH fraud with your account number

You cannot keep your account number secret — it is on every check you write. What you can do is monitor your account regularly so you catch fraud quickly. Log into your bank's website or app at least once a week and look for transfers you do not recognize. The sooner you report fraud, the easier it is for your bank to recover the money.

If you are giving your account and routing numbers to a business (to set up a payment plan, for example), make sure you trust them. Scammers sometimes pose as utility companies or debt collectors and ask for your account details over the phone. If you did not call them, hang up and call the company directly using the number on your bill or their official website.

Some banks offer fraud alerts or transaction monitoring that will notify you by text or email if a large transfer goes out of your account. Ask your bank whether this is available and turn it on. It will not stop fraud, but it will help you catch it faster.

The difference between ACH fraud and debit card fraud

ACH fraud and debit card fraud are different, and your bank treats them differently. With a debit card, a thief needs the card number, expiration date, and CVV code — information that is harder to get because it is not printed on checks or public documents. Debit card fraud is also easier to dispute because your bank knows the card was not physically present for the transaction.

With ACH fraud, the thief only needs your account and routing numbers, which are easier to obtain. But ACH transfers take a few days to complete, so you have time to catch them. Debit card fraud can happen when ready, but it is also easier to prove you did not authorize it because you can show that your card was in your possession.

Both types of fraud are covered by federal law, and your bank must return the money if you report it within 60 days. The main difference is speed: ACH fraud gives you more time to notice and report it, but debit card fraud is easier to dispute once you do.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

No. Opening a bank account requires a government ID, proof of address, and a Social Security number. Your account number alone is not enough. However, someone with your account number and routing number can attempt to transfer money out of your existing account, which is the real risk.

What if I gave my account number to someone and now I am worried?

Call your bank's fraud line and tell them you are concerned about unauthorized transfers. Ask them to monitor your account and flag any large or unusual transfers. You can also ask to change your account number, though this is not always necessary unless you have reason to believe the person will try to use it fraudulently.

How long does it take for an unauthorized ACH transfer to go through?

ACH transfers usually take one to three business days to complete. This means you have a window of time to notice the transfer and report it to your bank before the money leaves your account. The sooner you call, the better your chances of stopping it.

Will my bank refund me if I report fraud after 60 days?

Federal law requires your bank to refund you if you report fraud within 60 days. After 60 days, your bank may still investigate, but they are not required to return the money. This is why it is important to check your account regularly and report fraud as soon as you notice it.

Can I stop an ACH transfer after it has been sent?

If you catch it before it clears (usually within one to three business days), you can call your bank and ask them to recall it. This is not may provide to work, but it is worth trying. For checks, you can put a stop payment on them, which is more reliable but costs a fee.