Yes, but only in specific ways—and most of them require your permission

Someone who has your bank account number alone cannot drain your account or make purchases in your name. They cannot open a credit card, take out a loan, or access your online banking. What they can do is set up a direct deposit or automatic payment to that account, or send you money via ACH transfer. The risk is not theft—it is that they send you money you did not ask for, or set up a payment you did not authorize.

The real danger comes when someone has your account number and your routing number together, or when they have your account number plus other identifying information like your name, address, or Social Security number. That combination opens different doors. But the account number by itself is less of a security threat than most people think.

Key Takeaways

  • Your bank account number alone cannot be used to withdraw money, make purchases, or access your account without additional information or authorization.
  • Someone with your account number can initiate an ACH transfer to send you money or set up a direct deposit, but the transaction still goes through your bank's verification process.
  • The real risk emerges when your account number is combined with your routing number, name, and address—enough information to create unauthorized ACH debits.
  • Your bank's fraud protections and dispute processes exist to reverse unauthorized transactions, though the process takes time.
  • Monitoring your account regularly and setting up transaction alerts catches unauthorized activity faster than waiting for a statement.

What requires only your account number

Direct deposit and ACH transfers are the two legitimate uses of an account number without additional authorization. An employer can set up direct deposit with just your account number and routing number. A friend can send you money via ACH using the same information. These transactions move through the automated clearing house network, which is designed to move money into accounts, not out of them.

The barrier here is not security—it is the receiving bank's verification. When money arrives in your account, your bank checks that the account number exists and is active. If the number is wrong or closed, the transfer bounces back. If the number is correct, the money lands in your account. You do not have to approve it; it straightforward appears.

What requires your account number plus routing number

An unauthorized ACH debit—a withdrawal from your account—requires both your account number and your routing number. This is where the real risk sits. Someone with both pieces of information can attempt to pull money out of your account by creating an ACH debit entry in the banking system.

Your bank has a process called ACH debit filtering that can block these transactions, but not all banks use it by default. Some banks require you to request it. The filtering works by flagging debit requests from accounts the bank does not recognize as regular billers. If you have never authorized payments to a particular company or person, the bank can reject the debit before it clears.

If a debit does go through without your permission, you have the right to dispute it. Under the National Automated Clearing House Association rules, you have up to 60 days from the transaction date to file a dispute. Your bank must investigate and return the money while the investigation is underway—usually within 10 business days.

Why account number plus other details matters more

Your account number becomes more useful to a bad actor when paired with your name, address, phone number, or Social Security number. With that combination, someone can attempt to open accounts in your name, set up utilities, or create fraudulent ACH debits that are harder to dispute because they appear to come from a legitimate source.

This is why data breaches that expose account numbers alongside names and addresses are more serious than breaches of account numbers alone. The account number is the routing instruction; your identity is the authorization. Together, they are dangerous.

How your bank protects you from unauthorized debits

Banks are required by federal law to reverse unauthorized ACH debits if you report them. The process is not when ready—it typically takes 10 to 20 business days—but the money comes back. You file a dispute through your bank's online portal, by phone, or in person. You will need to state that you did not authorize the transaction.

Some banks also offer positive pay for ACH transactions, which works like check positive pay. You provide a list of authorized ACH originators, and the bank blocks any debits from accounts not on that list. This is more common for business accounts than personal accounts, but some banks offer it to consumers who request it.

The strongest protection is monitoring. Set up transaction alerts through your bank's app or website so you see every debit the moment it posts. Many banks let you set alerts for transactions over a certain amount, or for all transactions. Catching unauthorized activity within a day or two means you can dispute it when ready, before the funds are moved or spent.

What you should actually worry about

Do not give out your account number to people you do not trust, but do not panic if it leaks. The real threats are:

  • Your account number combined with your routing number and name, which can be used to create unauthorized ACH debits.
  • Your account number appearing in a data breach alongside your Social Security number, which opens the door to identity theft.
  • Sharing your account number with a business that turns out to be fraudulent and uses it to pull money repeatedly.

Sharing your account number with a legitimate business—your employer, your utility company, your mortgage lender—is safe. These organizations are regulated and have incentives to protect your information. Sharing it with someone you met online, or with a business you cannot verify, is where the risk lives.

Steps to take if you think someone misused your account number

If you see a transaction you did not authorize, contact your bank when ready. Do this by phone or in person, not by email. Have your account number, the transaction date, and the amount ready. Your bank will file a dispute and begin an investigation.

While the dispute is underway, request ACH debit filtering if your bank offers it. Ask specifically whether your bank blocks ACH debits from unknown originators by default, or whether you need to opt in. If you need to opt in, do it now.

Check your credit report through AnnualCreditReport.com to see whether anyone has opened accounts in your name. If you see fraudulent accounts, place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) or consider a credit freeze, which prevents new accounts from being opened without your explicit permission.

Frequently Asked Questions

Can someone use my account number to make online purchases?

No. Online purchases require a debit card number, expiration date, and CVV—not a bank account number. If someone has your debit card information, they can make purchases. If they have only your account number, they cannot.

What if someone sends me money to my account number by mistake?

The money will land in your account. You are not obligated to keep it, but you are also not required to return it unless the sender can prove it was sent in error and your bank agrees to reverse it. If the sender disputes the transaction with their bank, the money may be pulled back automatically. Do not spend money you know was sent by mistake.

Is it safe to give my account number to my employer for direct deposit?

Yes. Direct deposit is a standard, regulated process. Your employer needs your account number and routing number to set it up, and this is the intended use of that information. Employers do not have access to your account beyond depositing your paycheck.

Can someone open a bank account using just my account number?

No. Opening a bank account requires identity verification—a government ID, Social Security number, and proof of address. Your account number alone is not enough. However, if someone has your account number combined with your name, address, and Social Security number, they can attempt to open accounts in your name, which is identity theft.

How long does it take to get money back from an unauthorized ACH debit?

Your bank must provisionally credit your account within 10 business days of your dispute. The full investigation takes up to 45 days. In most cases, the money is back in your account within two weeks, though the dispute may still be ongoing.