The short answer: not much, but it depends on what else they have
A bank account number alone—without your routing number, name, or permission—is not enough for someone to withdraw money or make charges. Banks use multiple pieces of information to verify your identity before moving funds. That said, your account number is still sensitive information, and the risk increases sharply if someone has it combined with other details like your routing number, name, or access to your online login.
The real danger is not the account number itself. It is what someone can do once they have your account number plus one or two other pieces of information, or once they use it to set up unauthorized transactions that your bank may not catch when ready.
Key Takeaways
- Your account number alone cannot be used to withdraw cash or make purchases without additional information like your routing number or online login credentials.
- Someone with your account number and routing number can set up unauthorized ACH transfers or bill payments, which may take days to reverse.
- If you gave your account number for a legitimate reason—direct deposit, wire transfer, bill payment—the risk is low unless the recipient is untrustworthy.
- Fraudulent ACH transfers and unauthorized bill payments are reversible, but the process takes time and requires you to contact your bank and dispute the transaction.
- Monitor your account regularly and set up transaction alerts so you catch unauthorized activity before it becomes a larger problem.
What someone can do with your account number and routing number
If someone has both your account number and routing number, they can initiate an ACH transfer (Automated Clearing House transfer) from your account to theirs, or set up a bill payment in your name. They cannot walk into a bank and withdraw cash, and they cannot use it like a debit card at a store. But they can move money out of your account electronically.
ACH transfers are not when ready. They typically take one to three business days to complete, which gives you a window to spot the transaction and contact your bank before the money leaves. However, once the transfer settles, reversing it requires filing a dispute with your bank, which can take another five to ten business days to investigate and resolve.
Bill payments set up through your bank's bill pay system work the same way. Someone with your account and routing number could theoretically set up a payment to themselves or a third party, though most banks require online login credentials or a phone call to set up bill pay for the first time.
What they cannot do with account number alone
Without your routing number, someone cannot initiate an ACH transfer or bill payment. Without your online banking password or access to your email, they cannot log into your account to set up transfers themselves. Without your debit card number and CVV, they cannot make purchases online or in stores. Without your name on file with the bank, many institutions will reject transactions that do not match their records.
If you shared your account number for a legitimate reason—setting up direct deposit at a new job, receiving a wire transfer from a family member, or paying a bill to a utility company—the risk is very low. Those organizations have no reason to take money from your account, and they are regulated or have reputational incentives not to commit fraud.
When account number sharing is actually risky
The risk rises if you gave your account number to someone you do not know or trust, or if you shared it in response to an unsolicited request. Scammers sometimes pose as utility companies, government agencies, or debt collectors and ask for account numbers over the phone or email. If you gave your number to someone like that, contact your bank when ready and ask them to watch for unauthorized activity.
The risk also rises if your account number was exposed in a data breach. Large retailers, healthcare providers, and financial services companies sometimes suffer breaches that leak customer information. If you know your account number was compromised, contact your bank and ask about fraud monitoring or account freezes.
If someone has your account number, routing number, and name—all three pieces—they have enough information to attempt an ACH transfer. This is why you should be cautious about sharing your routing number, even though it is technically public information.
How to spot unauthorized activity on your account
Check your account at least once a week, or set up transaction alerts through your bank's app or website. Most banks allow you to receive a text or email notification whenever a transaction over a certain amount occurs, or whenever any ACH transfer or bill payment is initiated.
If you see a transaction you did not authorize, contact your bank when ready. Do not wait. The sooner you report it, the sooner they can freeze the account, reverse the transaction, and investigate. Most banks have a fraud department that handles these calls separately from customer service, so ask to be transferred if your first call does not reach them.
You will likely need to file a written dispute as well. Your bank will send you a form or allow you to file it through your online account. Keep records of all communication with your bank, including the date, time, and name of the person you spoke with.
What happens after you report unauthorized activity
Your bank will typically place a temporary hold on the disputed amount while they investigate. This usually takes five to ten business days. During that time, the bank contacts the receiving bank (if the money was transferred out) or the merchant (if it was a bill payment) and asks them to reverse the transaction.
If the receiving bank or merchant cooperates, the money returns to your account within a few days. If they do not cooperate or if the investigation takes longer, your bank may issue you a provisional credit—a temporary refund—while they continue investigating. Provisional credits usually appear within three business days and become permanent after the investigation closes.
If the investigation finds that the transaction was indeed unauthorized, your bank will issue a permanent refund and close the case. If they find that you authorized it (or that you cannot prove you did not), they may reverse the provisional credit and hold you responsible for the charge.
Steps to take if you are worried about your account number
If you shared your account number with someone and now you are concerned, you do not need to close your account or panic. Contact your bank and describe the situation. Ask them to flag your account for fraud monitoring and to watch for any unusual activity. Many banks can do this over the phone in a few minutes.
If you shared your account number with a business or organization, you can also contact them directly and ask whether they have received or stored your information securely. Legitimate organizations should be able to tell you how they protect customer data.
Change your online banking password if you think someone may have accessed your login. Use a password that is at least 12 characters long and includes numbers, uppercase and lowercase letters, and symbols. Do not reuse passwords across different websites.
Consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) if you believe your personal information has been compromised. A fraud alert tells lenders to verify your identity before opening new accounts in your name. A credit freeze prevents lenders from accessing your credit report entirely, which stops most identity theft cold.
Frequently Asked Questions
Can someone use my account number to open a new account in my name?
No. Opening a new account requires a Social Security number, government ID, and a signature or digital verification. Your account number alone cannot be used for this. However, if someone has your full name, address, and Social Security number, they could attempt identity theft. A credit freeze with the three bureaus prevents this.
What if I gave my account number to a scammer?
Contact your bank when ready and describe what happened. Ask them to monitor your account for unauthorized activity and to flag it for fraud. If the scammer also has your routing number or other information, ask your bank whether you should close the account and open a new one. Most banks can do this quickly.
How long does it take to reverse an unauthorized ACH transfer?
The dispute process typically takes five to ten business days. Your bank may issue a provisional credit within three business days while they investigate. Once the investigation closes, the credit becomes permanent if the transaction was unauthorized, or it is reversed if you are found responsible.
Do I need to close my account if someone has my account number?
Not necessarily. Closing your account is a last resort. Start by contacting your bank and asking them to monitor for fraud. If unauthorized transactions occur, dispute them. If the fraud continues or if you feel unsafe, then close the account and open a new one.
Can I get my money back if someone transfers it out using my account number?
Yes, if you report it quickly. File a dispute with your bank within 60 days of the unauthorized transaction. Your bank will investigate and issue a refund if they find the transaction was unauthorized. The process takes time, but the money is recoverable.