The short answer: not much without more information
A thief cannot withdraw money or make purchases using only your account number. Banks have multiple security layers that require additional information — your PIN, your signature, or proof of your identity — before money leaves your account. Your account number alone is not enough to drain your account or commit fraud in your name.
That said, your account number is not completely harmless information. It can be used as one piece of a larger fraud scheme, or to set up unauthorized transfers if someone also has access to your online banking login. The risk depends on what else they know about you and what they can do with it.
Key Takeaways
- Your account number by itself cannot be used to withdraw cash, write checks, or make debit card purchases — banks require additional verification.
- Someone with your account number and routing number can potentially set up ACH transfers out of your account if they also have your online banking password.
- The real risk is when your account number is combined with other personal information like your Social Security number or driver's license number.
- If you believe your account number has been compromised, contact your bank when ready to monitor for unauthorized activity and discuss fraud protection options.
- Regularly reviewing your bank statements and setting up account alerts are the most effective ways to catch unauthorized transfers quickly.
What requires more than just your account number
To withdraw cash from an ATM, someone needs your debit card and PIN. To write a check on your account, they need access to your physical checkbook or the ability to forge your signature convincingly — and even then, the check must clear through the banking system, which includes verification steps. To make a purchase with your debit card, they need the card itself plus the PIN or CVV number on the back.
Wire transfers and ACH transfers (the electronic transfers between bank accounts) do require your account number and routing number, but they also require authorization. If you are not the one initiating the transfer, your bank should be asking for verification before processing it — though the strength of that verification varies depending on how the transfer is requested.
How your account number becomes dangerous
The real risk emerges when someone has your account number and your online banking password. If they can log into your account, they can set up ACH transfers to move money to another account they control. This is one reason why your online banking password should be different from passwords you use elsewhere, and why two-factor authentication (a second verification step, usually a code sent to your phone) matters.
Your account number also becomes more dangerous when combined with other identifying information. If someone has your account number, your name, your address, and your Social Security number, they can potentially impersonate you to your bank — calling and claiming they lost access to their account, or attempting to change the account password. This is why you should be cautious about sharing your Social Security number, even with legitimate-sounding callers.
Where your account number might be exposed
Your account number appears on every check you write, so anyone who handles your mail or trash could see it. It also appears on your bank statements, which is why you should shred old statements rather than throwing them away. If you pay bills by mailing a check, the person receiving that check sees your account number.
Online, your account number is visible to any business you set up automatic payments with — your utility company, your insurance company, your mortgage lender. These are legitimate uses, but it means your account number is stored in multiple places. A data breach at any of those companies could expose it.
Phishing emails and fake websites are another common source. If you receive an email that looks like it is from your bank and click a link to a fake login page, you might enter your account number, password, and other information without realizing it is not actually your bank's website.
Signs that your account number has been misused
Check your bank statements regularly — at least once a month, though many people check weekly or set up alerts. Look for transfers you do not recognize, especially small ACH transfers that might be testing whether the account is active before larger fraud occurs. Many banks allow you to set up alerts that notify you by text or email whenever a transfer over a certain amount occurs, or whenever any transfer happens at all.
If you notice an unauthorized transfer, contact your bank when ready. Do not wait to see if it resolves itself. Your bank has a legal obligation to investigate unauthorized transfers, and the sooner you report it, the better your chances of recovering the money. Most banks will reverse a fraudulent transfer while they investigate, though the timeline varies.
Steps to protect your account number
Do not share your account number over the phone unless you initiated the call and you are certain you are talking to your actual bank. Legitimate banks will not call you asking for your account number — they already have it. If someone calls claiming to be from your bank and asking for account information, hang up and call your bank directly using the number on your debit card or statement.
When you set up automatic payments or bill pay, use your bank's official website or app, not links from emails. Shred or securely delete old statements and documents with your account number. Use a strong, unique password for your online banking account — not the same password you use for email or social media. Enable two-factor authentication if your bank offers it.
If you are paying someone by check and concerned about security, ask whether they accept ACH transfers or credit card payments instead. Some banks offer virtual account numbers for online shopping, which are temporary numbers that cannot be reused if they are compromised.
What to do if you think your account number was stolen
Call your bank using the number on your debit card or a statement — not a number from an email or website. Tell them you believe your account number has been compromised and ask them to monitor your account for suspicious activity. They may offer to issue you a new account number, though this can take a few days and will affect any automatic payments you have set up.
Ask your bank about fraud protection. Most banks offer zero-liability protection for unauthorized debit card transactions, meaning you will not be held responsible for fraudulent charges if you report them promptly. The protections for ACH transfers and other types of fraud vary by bank and by the type of transfer, so ask specifically what is covered.
Consider placing a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place an alert by contacting any one of the three bureaus, and they are required to notify the other two. The alert lasts one year and is free.
Frequently Asked Questions
Can someone open a new bank account using my account number?
No. Opening a new account requires a government-issued ID, proof of address, and a Social Security number. Your account number alone is not sufficient. However, if someone has your Social Security number and other identifying information, they could attempt to open an account fraudulently in your name — which is a different crime than using your existing account.
Is it safe to give my account number to my employer for direct deposit?
Yes. Your employer needs your account number and routing number to set up direct deposit, and this is a standard, find practice. Direct deposit is actually safer than receiving a paper check, because your account number is not visible to mail handlers or anyone else who might touch the check.
What if I see a small unauthorized transfer on my account?
Report it to your bank when ready, even if it is a small amount. Fraudsters sometimes make small test transfers to confirm an account is active before attempting larger fraud. Your bank will investigate and reverse the transfer while they look into it. Do not assume it will resolve itself.
Can I change my account number if I am worried about security?
Yes, you can request a new account number from your bank. Keep in mind that this will affect any automatic payments or direct deposits you have set up — you will need to update those with your new account number. Ask your bank how long the process takes before you request the change.
Do I need to worry about my account number being on canceled checks?
Canceled checks are returned to you by your bank, so they should be in your possession. Shred them before throwing them away. If you are concerned about checks you mailed to someone, contact that person or organization to confirm they received it, then shred your copy. The risk is low if the check was legitimately deposited, but there is no harm in being cautious.