Your account number alone is not enough to drain your account

A thief with only your account number cannot transfer money out of your account or make purchases in your name. Banks use your account number as one piece of information among several, and moving money requires additional verification—usually a PIN, password, or authorization you provide yourself. The real risk is not that someone empties your account with a number they found; it is that they use your account number as part of a larger fraud scheme, often one you do not see coming.

What matters is understanding what a thief can actually do with that number, what they cannot do, and what combination of information puts you at real risk. That distinction changes how you should protect yourself.

Key Takeaways

  • Your account number by itself cannot be used to withdraw money, transfer funds, or make online purchases without additional authentication.
  • A thief can use your account number to set up unauthorized automatic payments or recurring charges if they also have your routing number and permission from you (often obtained through deception).
  • The real danger is ACH fraud—where someone initiates a transfer or payment using your account and routing number, which requires you to dispute the transaction after it happens.
  • Your account number appears on every check you write and on statements you may leave in the trash, so treating it as secret is less important than monitoring your account regularly.
  • Protecting yourself means watching for unauthorized transactions, not hiding your account number from every person and business you deal with.

What a thief can do with your account number and routing number

If someone has both your account number and your routing number, they can initiate an ACH transfer (Automated Clearing House transfer) or set up a recurring payment in your name. This is the real vulnerability. They cannot do this when ready—ACH transfers take one to two business days—but they can start the process without your password or PIN.

The mechanism works because ACH transfers are designed to be initiated by the account holder, and the system assumes that if someone has your account and routing number, they have authority to move money. Banks verify these numbers match a real account, but they do not verify that you authorized the transfer until after it posts. This is why ACH fraud exists: the thief moves the money first, and you dispute it later.

A thief could also set up an automatic bill payment to themselves using your account number—for example, creating a fake utility company and routing payments to their own account. Again, this requires your account and routing number, but not your password. The payment would post, and you would see it on your statement days later.

What a thief cannot do with only your account number

A thief cannot log into your online banking without your username and password. They cannot make a debit card purchase without the card itself and the PIN or CVV. They cannot withdraw cash from an ATM without your card and PIN. They cannot transfer money through your bank's website or app. None of these actions require only an account number.

This is why your account number is printed on every check you write and visible to anyone who sees your bank statements. It is not treated as a secret in the way your password or PIN is. Businesses you pay regularly—your employer, your insurance company, your mortgage lender—all have your account number. They need it to deposit or withdraw money on your behalf, but they cannot access your account without authorization from you or from the bank.

How ACH fraud actually happens

ACH fraud usually begins with a phone call, email, or text that appears to come from your bank, a government agency, or a company you do business with. The message says there is a problem with your account, a refund waiting, or a payment due. It asks you to "verify" your information or "confirm" a transaction. You provide your account number (which you think is harmless) and routing number (which you may not even know you are giving). The thief now has what they need.

Alternatively, the thief may have obtained your account number from a data breach at a company that stores it—a retailer, a utility, a healthcare provider. They then use it to initiate transfers or payments. Because the system assumes the account holder authorized the transaction, the money moves before you notice.

The second common route is a fake invoice or bill. A thief sends you an invoice that looks legitimate, with instructions to pay by ACH transfer or automatic payment. You provide your account number to set up the payment. The money goes to the thief's account instead of the vendor you thought you were paying.

What to do if you see an unauthorized ACH transaction

If you spot a transfer or payment you did not authorize, contact your bank when ready. Do not wait for the next statement. Banks have a window—usually 60 days from the statement date—to investigate and reverse unauthorized ACH transactions. If you report it within that window, the bank must return the money while they investigate, and the burden is on them to prove you authorized it.

When you call, have your statement ready and be specific: the date of the transaction, the amount, and the name of the company or account it went to. Your bank will file a dispute, contact the receiving bank, and attempt to recover the funds. This process takes time—often two to four weeks—but the money is usually returned if you reported it promptly.

Keep records of your dispute: the date you called, the name of the bank representative, and any confirmation number they give you. If the bank does not reverse the transaction within 10 business days, follow up in writing.

How to reduce the risk of ACH fraud

Monitor your account regularly—at least weekly, ideally more often. Set up account alerts through your bank's app or website so you are notified of any transfer or payment over a certain amount. Most banks offer this for free. You will see unauthorized activity quickly, which means you can dispute it before the window closes.

Be cautious about providing your account number over the phone or email, especially if you initiated the contact. If a company calls you claiming there is a problem, hang up and call the company directly using a number from their official website or your statement. Do not use a number from the call or email. Legitimate companies rarely ask for your account number unsolicited.

When you do provide your account number to a business—your employer, your landlord, a vendor you are paying—verify that you are dealing with the real company. Check the website URL, call the main number and ask to be transferred, or visit in person. Fake invoices and phishing emails are common, and they often look very close to the real thing.

Do not assume your account number is secret. It is not. It appears on checks, statements, and anywhere you have authorized a payment. Treat it the way you would treat your mailing address: it is information other people have, but that does not mean they can use it without your knowledge.

The difference between account number fraud and identity theft

Account number fraud—someone using your account number to move money—is different from identity theft, where someone opens new accounts in your name or applies for credit using your personal information. Account number fraud is faster and requires less information. Identity theft is more damaging long-term but takes longer to set up.

If you are worried about identity theft specifically, you would want to monitor your credit report and consider a credit freeze. If you are worried about someone using your account number for ACH fraud, the protection is account monitoring and quick dispute reporting. The tools and the timeline are different.

Frequently Asked Questions

Can someone pay a bill from my account if they have my account number?

Yes, if they also have your routing number and can convince you (or a system) that they have authority to do so. They could set up an automatic payment in your name, and it would post to your account. You would see it on your statement and could dispute it, but the money would move first. This is why you should verify who you are paying before you provide your account number.

Is my account number the same as my routing number?

No. Your routing number identifies your bank or credit union. Your account number identifies your specific account at that bank. Both are printed on the bottom left of your checks. A thief needs both to initiate an ACH transfer, but having only one is not enough to move money from your account.

What if I gave my account number to someone by mistake?

Monitor your account closely for the next few weeks. Set up alerts for transfers and payments if you have not already. If you see unauthorized activity, report it to your bank when ready. If nothing appears within 30 days, the risk has likely passed. Your account number alone cannot be used to access your account without your routing number as well.

Can my bank reverse an ACH transfer if I authorized it but was tricked?

Yes, if you can show you were deceived. If someone called pretending to be your bank and you provided your information based on that false claim, that is fraud, and your bank should reverse it. You will need to explain what happened and provide any evidence—the phone number they called from, emails they sent, or details about what they claimed. Banks take this seriously because it is not your fault.

Should I shred my bank statements to protect my account number?

Shredding statements is good practice for general security, but it is not the main protection against account number fraud. The real protection is monitoring your account and reporting unauthorized transactions quickly. Your account number is already in the hands of your employer, your landlord, and any company you have authorized to take payments. Protecting it from the trash is less important than watching for fraud.