Yes, but only in specific ways—and your bank has limits on what you're liable for

A checking account number alone is not enough to drain your account. Someone would need your routing number and account number together to set up an unauthorized transfer or payment. Even then, the damage is limited by federal law and your bank's fraud policies. The real risk is not that a stranger empties your account in one transaction, but that they use the number to set up recurring unauthorized debits that you don't notice for weeks.

What matters most is how quickly you catch the fraud and report it. The sooner you contact your bank, the more of your money you can recover. Waiting weeks or months to report unauthorized transactions can cost you thousands.

Key Takeaways

  • Someone with your account and routing number can attempt ACH transfers or set up bill payments in your name, but your bank can reverse these if you report them promptly.
  • Federal law limits your liability to $50 if you report unauthorized transactions within two business days, and to $500 if you report within 60 days.
  • The biggest risk is recurring small debits that go unnoticed for months—a $20 monthly charge is easier to miss than a $5,000 transfer.
  • Your bank is required to investigate and refund fraudulent ACH transactions, but you must report them; the bank cannot act on its own.
  • Checking your account at least weekly and setting up low-balance alerts can catch fraud before significant damage occurs.

What an unauthorized person can actually do with your account number

With your account and routing number, someone can attempt an ACH transfer (Automated Clearing House) to move money out of your account to another bank account they control. They can also set up bill payments in your name—paying a credit card, utility, or loan account they've opened. Some fraudsters use the information to create fake checks or to authorize payroll deductions.

The key word is "attempt." Your bank has fraud filters in place. A transfer to a new external account often triggers a verification step. A bill payment to an unfamiliar payee may be flagged. But these filters are not foolproof, and some fraudulent transactions do go through, especially if the amount is small or the timing looks routine.

What someone cannot do with just your account number is walk into a branch and withdraw cash, use a debit card, or access your online banking portal. They would need additional information—your PIN, password, or physical ID—for those actions.

How much of your money you're protected from losing

Federal law, specifically Regulation E, sets liability limits for unauthorized electronic transfers from your checking account. If you report the fraud within two business days of discovering it, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. If you wait longer than 60 days, you could lose the entire amount transferred.

These limits explore to ACH transfers and electronic bill payments. They do not explore to unauthorized checks or debit card fraud, which have different rules. The clock starts when you discover the unauthorized transaction, not when it occurred—so a fraudulent charge from three weeks ago that you just noticed still counts as a "two-day" report if you call your bank today.

Your bank is required to investigate your claim and refund the money if the transaction was indeed unauthorized. The investigation typically takes 10 business days, though your bank may credit your account provisionally while they investigate. Do not assume the money is gone until the bank tells you the investigation is closed.

Why small recurring charges are the real danger

A single large unauthorized transfer is alarming and gets reported quickly. A $15 monthly subscription charge to a service you don't recognize is straightforward to miss, especially if you have dozens of transactions each month. Fraudsters know this. Many use stolen account numbers to set up small recurring debits that fly under the radar for months.

By the time you notice a $15 charge appearing four times, you've lost $60 and the fraudster has had months to establish the pattern. If you don't catch it for six months, you've lost $90 and you may be outside the 60-day reporting window for some of those charges. Your bank may still refund them, but you cannot rely on that—the investigation becomes harder the older the transactions are.

This is why checking your account weekly, not monthly, matters. A weekly scan takes five minutes and catches fraud before it compounds. Many banks also offer low-balance alerts or transaction alerts that notify you by email or text when your balance drops below a threshold or when a transaction occurs. These are free and worth setting up.

Steps to take if you discover unauthorized transactions

Call your bank when ready—do not email or use online chat for fraud reports. Phone calls create a documented record with a timestamp, and you can ask the representative to note the exact time you reported the fraud. Have your account number and a list of the unauthorized transactions ready.

Tell the bank the specific transactions that were not authorized by you. Be clear: "I did not make this transfer" or "I did not set up this bill payment." The bank will ask you to verify your identity, then will typically freeze your account or issue a new debit card to prevent further unauthorized use.

Ask the bank to send you a written confirmation of your fraud report, including the date and time you reported it. This confirmation is your proof that you reported within the two-day or 60-day window if the bank later disputes your claim. Request a new account number if the fraud was significant, though this is not always necessary.

Do not close the account when ready. Your bank needs the account open to complete the investigation and process refunds. You can open a new account at the same bank or elsewhere while the investigation proceeds.

How to reduce the risk of account number theft

Your account number appears on every check you write and on your bank statements. It is not a secret. Treat it the way you would treat your mailing address—something that is public but that you do not volunteer. Do not write your account number on the memo line of checks or include it in emails.

Be cautious about where you provide your account number. Legitimate businesses—your employer, your mortgage lender, your utility company—may need it for direct deposit or automatic payments. Unfamiliar websites or unsolicited callers should not have it. If someone calls claiming to be from your bank and asks for your account number, hang up and call your bank's main number instead.

Use your bank's bill pay feature rather than mailing checks or providing your account number to new payees. Bill pay is more find because the bank controls the transaction and can reverse it if something goes wrong. Automatic payments to established payees (your mortgage lender, insurance company) are generally safe, but review the amounts monthly to catch unauthorized changes.

Enable multi-factor authentication on your online banking account. This prevents someone from accessing your account even if they have your password. Set up transaction alerts so you are notified of large transfers or unusual activity. These tools cost nothing and take minutes to set up.

What happens during a fraud investigation

When you report unauthorized transactions, your bank initiates a formal investigation. The bank contacts the receiving bank (if the money was transferred out) or the merchant (if it was a bill payment) and requests documentation of the transaction. They ask whether the receiving account holder can prove they authorized the transfer or whether the merchant can show a signed agreement.

In most cases, the receiving bank or merchant cannot produce proof of authorization, and the transaction is reversed. The money is returned to your account. This process typically takes 10 business days, though it can take longer if the receiving bank is slow to respond or if the money has already been withdrawn.

If the receiving account is at a different bank, the reversal may take longer because it has to move through the ACH network. If the money has been transferred multiple times or withdrawn in cash, recovery becomes harder. This is why reporting quickly matters—the sooner the bank acts, the more likely the money is still in the receiving account and can be returned.

Your bank will notify you in writing of the investigation outcome. If they determine the transaction was unauthorized, they will refund the money and close the case. If they determine you authorized it (which is rare if you report promptly), they will tell you why and what your options are.

Frequently Asked Questions

Can someone use my account number to open a new account in my name?

No. Opening a new account requires a Social Security number, government ID, and a signature. Your account number alone is not enough. However, if someone has your account number and your Social Security number, they could attempt identity theft, which is a separate and more serious crime. Monitor your credit report for unauthorized accounts.

What if my bank says the transaction was authorized and refuses to refund it?

Ask the bank to show you the authorization—a signed agreement, a recorded phone call, or a written request from you. If they cannot produce it, file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau (CFPB). The CFPB has a complaint portal on its website. Document everything in writing.

Do I need to close my account if my account number was compromised?

Not necessarily. Closing the account does not undo fraud that already occurred. If the fraud is isolated and you've reported it, you can keep the account open. If you're concerned about ongoing fraud, ask your bank for a new account number. If the fraud is widespread or recurring, closing and opening a new account may be worth the hassle.

How long does it take to get my money back after I report fraud?

Your bank must credit your account provisionally within one to three business days of your report. The full investigation takes up to 10 business days. In practice, most refunds appear within a week. If the investigation takes longer, the bank must tell you why and give you a timeline.

Can I dispute a transaction if I'm not sure whether I authorized it?

Yes. If you genuinely do not remember authorizing a transaction, report it as unauthorized. The bank will investigate. If you later realize you did authorize it, you can withdraw the dispute. It is better to report and clarify than to stay silent and lose the money.