The short answer: not much without additional information

A thief cannot withdraw money or make purchases using only your account number. Banks do not process transactions based on account number alone. They need either your debit card (with PIN or signature), your online login credentials, or explicit authorization from you to move money out.

What matters more is what else they have alongside that number. Your account number combined with your routing number, for instance, is enough to set up an unauthorized ACH transfer — a bank-to-bank electronic payment. Your account number with your name and address might be enough to open a new account in your name. The risk is not the number itself, but what doors it opens when paired with other pieces of information.

Key Takeaways

  • Your account number alone cannot be used to withdraw cash, make card purchases, or transfer money without additional information or authorization.
  • Your account number plus routing number together can be used to set up an ACH transfer, which is why both are considered sensitive.
  • The real risk comes when your account number is combined with your name, address, or other identifying details that let someone impersonate you.
  • Checks and bill payment forms display both your account and routing numbers, making them a higher-risk way to share payment information than other methods.
  • If you suspect unauthorized activity, contact your bank when ready — federal law limits your liability if you report within a specific timeframe.

What an ACH transfer requires and how it works

An ACH transfer (Automated Clearing House) is an electronic payment from one bank account to another. To initiate one, someone needs your account number, your routing number, and your name. They do not need your password, your PIN, or your permission — at least not initially.

Here is how it typically happens: a scammer uses your account and routing number to set up a transfer to their own account, often claiming to be you or claiming you authorized it. The transfer goes through the ACH network, which processes it within one to three business days. By the time your bank flags it as unauthorized, the money may already be gone from your account and sitting in the scammer's bank.

This is why your routing number and account number together are treated as sensitive information. Checks print both numbers at the bottom, which is why paying a stranger by check carries more risk than paying by credit card or debit card.

Why account number alone is not enough for most transactions

Debit card transactions require either a PIN (at an ATM or point of sale) or a signature plus the physical card itself. Online banking requires a username and password, often with two-factor authentication. Credit card transactions require the card number, expiration date, and CVV — none of which appear on a check or standard bank statement.

A thief with only your account number cannot walk into a branch and withdraw cash, because tellers verify identity through ID. They cannot use it at a store, because stores do not accept account numbers as payment. They cannot log into your online banking portal, because that requires separate credentials you set yourself.

The exception is ACH transfers, which operate on a different principle: they are assumed to be authorized unless you dispute them afterward. This is why ACH fraud is a real risk even with limited information.

How your account number gets exposed and what happens next

Your account number appears on checks, on bank statements, and on any bill payment form you submit. It may be visible to customer service representatives at companies you do business with. If you write a check to a contractor or a small business, that person now has your account and routing number.

Exposure alone is not the same as fraud. Most people and businesses who see your account number do nothing with it. The risk increases if your account number is combined with other information — your name, address, phone number, or Social Security number — that lets someone impersonate you or convince your bank they are authorized to act on your behalf.

Data breaches are the most common source of large-scale exposure. When a company's database is compromised, attackers may obtain account numbers along with names and addresses. Phishing emails and fake websites can trick you into entering your account number directly. Skimming devices on ATMs can capture your card number, though this is less common than it once was.

What to do if you think your account number has been misused

Contact your bank when ready — do not wait. Tell them you suspect unauthorized ACH transfers or other fraudulent activity. Your bank can freeze your account, cancel pending transfers, and investigate the transaction.

Under the Electronic Funds Transfer Act, your liability for unauthorized ACH transfers is limited if you report within two business days of discovering the fraud. If you report after two business days but within 60 days, your liability increases but is still capped. If you wait longer than 60 days, you may lose all protection.

Ask your bank to place a fraud alert on your account and to review recent transactions with you. Request a new account number if the old one has been compromised — some banks do this automatically, others only if you ask. Check your credit report through one of the three major bureaus (Equifax, Experian, TransUnion) to see if anyone has opened accounts in your name.

Steps to reduce the risk of account number theft

Do not share your account number over the phone unless you initiated the call and you are certain you are speaking to your bank. Legitimate banks do not ask for account numbers via email or text. If someone contacts you claiming to be from your bank, hang up and call the number on the back of your card or on your statement.

Shred checks and statements before throwing them away. If you pay bills online, use your bank's bill pay feature rather than mailing checks when possible — it is faster and keeps your account number off the mail. When you must provide your account number to a business, ask how they store it and whether they use encryption.

Monitor your account regularly. Set up alerts through your bank's app or website so you are notified of large transfers or unusual activity. Review your statement each month, not just when you think something is wrong. The sooner you spot fraud, the sooner you can report it and limit your liability.

Frequently Asked Questions

Can someone open a credit card in my name using just my account number?

Not with account number alone. They would need your name, address, date of birth, and Social Security number. If a data breach exposes your account number along with these other details, the risk increases significantly. Check your credit report regularly to catch fraudulent accounts early.

What is the difference between ACH fraud and debit card fraud?

Debit card fraud requires the physical card or card number plus CVV. ACH fraud requires only account number, routing number, and name. ACH fraud is often slower to detect because transfers take one to three days, while debit card fraud shows up when ready. Both are covered by federal law, but the reporting timeline differs.

If I give my account number to a legitimate company, how do I know they will not misuse it?

You cannot know for certain, but you can reduce risk by using companies with strong security practices. Ask whether they encrypt your information, how long they keep it, and whether they share it with third parties. Avoid giving your account number to unfamiliar businesses. Use credit cards or payment apps when possible instead of sharing bank details directly.

Does my bank have to refund me if someone steals money via ACH?

Most banks will refund you if you report within 60 days, but your liability depends on when you report. Report within two business days and you are protected. Report after 60 days and you may not be protected at all. Contact your bank when ready if you see unauthorized transfers.

Is it safe to write checks if my account number is on them?

Checks are relatively safe if you know and trust the recipient, but they do expose both your account and routing number. The risk increases if you write checks to strangers or businesses you have not verified. For one-time payments to unknown parties, consider money orders or payment apps instead.