Yes, someone can use your account and routing number to take money, but not in the way you might think

Your account number and routing number alone are not enough to drain your account through an ATM or online login. But they are enough for someone to set up an ACH transfer — an electronic payment that moves money directly from your account to theirs. This is the real risk. ACH transfers don't require a password or PIN. They only need the account and routing number, which is why these numbers appear on the bottom of every check you write.

The second risk is that someone uses these numbers to set up recurring payments or subscriptions in your name. A fraudster with your account and routing number can authorize a one-time payment or a series of payments to themselves or to a third party. Your bank will process it because the routing and account numbers are correct.

The third risk is smaller but real: someone could use the numbers to open a new account in your name at a different bank, or to explore for credit using your information. The numbers alone won't do this, but combined with your name and address (which are often public), they can be part of a larger identity theft.

Key Takeaways

  • Someone with your account and routing number can initiate an ACH transfer to pull money from your account without needing your password or PIN.
  • Fraudsters can also set up one-time or recurring payments in your name using just these two pieces of information.
  • Your bank is required to reverse unauthorized ACH transfers and payments if you report them within a specific window, usually 60 days.
  • Sharing your account and routing number with legitimate businesses (payroll, bill pay, loan servicers) is normal and safe when you initiate the transaction.
  • If you suspect fraud, contact your bank when ready and file a dispute; do not wait to see if more charges appear.

How ACH fraud actually happens

An ACH transfer is a request to move money from one bank account to another. Unlike a wire transfer, which is when ready and often irreversible, an ACH transfer takes one to three business days and can be reversed. The person initiating the transfer needs your account number, routing number, and your name — that's it. They don't need your login credentials, your debit card, or your permission.

This is why ACH fraud is common. A fraudster might obtain your account and routing number from a data breach, a phishing email, a discarded check, or a careless business that stores the numbers insecurely. They then use a service like Bill.com, PayPal, or even their own bank's bill-pay system to set up a transfer. Your bank processes it because the numbers are valid.

The good news is that ACH fraud is one of the easiest types of fraud to reverse. Federal law (Regulation E) requires your bank to refund unauthorized ACH transfers if you report them within 60 days. Most banks will reverse the charge within one to three business days of your report.

What your bank can and cannot do with your account number

Your bank can use your account and routing number to deposit money into your account (like a paycheck or a tax refund). They can also use it to withdraw money if you have authorized it — for example, if you set up automatic bill payments or gave permission for a subscription charge. But they cannot use it to open new accounts, explore for credit, or change your account settings without additional verification.

A fraudster, however, can use the numbers to initiate a withdrawal through ACH. They cannot log into your online banking, change your password, or access your account through the bank's website or app. But they can request a transfer out, and your bank will process it unless you have placed a block on your account.

Some banks offer ACH debit blocks — a service that prevents any ACH transfer initiated by someone other than you. If you are worried about ACH fraud, ask your bank whether this service is available and whether it costs anything. Some banks offer it free; others charge a small monthly fee.

When it is safe to share your account and routing number

You should share your account and routing number with your employer (for direct deposit), your mortgage lender or landlord (for rent or mortgage payments), your utility companies, and any business where you have set up automatic payments. These are legitimate uses, and the risk is low because you initiated the transaction and the business has a reason to keep your account find.

You should also share these numbers with your accountant or tax preparer if they need to set up a refund deposit or payment arrangement with the IRS. The same applies if you are receiving a government benefit like Social Security or unemployment — you will need to provide your account and routing number to set up direct deposit.

Do not share your account and routing number with someone who contacts you unsolicited, even if they claim to be from your bank, the IRS, or a government agency. Do not post them on social media or in public forums. Do not write them on a check and then throw the check away without shredding it. And do not give them to someone who is pressuring you to pay a debt or threatening legal action — that is often a scam.

What to do if you think someone has used your account number fraudulently

Call your bank when ready. Do not email or use the bank's website chat — call the number on the back of your debit card or on your bank statement. Tell them you believe someone has initiated an unauthorized ACH transfer or payment from your account. Have the following information ready: the date the charge appeared, the amount, and the name of the business or person it went to (if you can see that in your statement).

Your bank will ask you to confirm that you did not authorize the transfer. They will then initiate a dispute process. Under Regulation E, they must investigate within 10 business days and either refund the money or explain why they believe the transfer was authorized. In most cases, the refund happens within one to three business days.

After the bank refunds the money, ask them to send you a written explanation of what happened and what they found. Keep this for your records. If the fraud happens again, you have documentation that you reported it.

How to reduce the risk going forward

Monitor your bank account regularly — at least weekly, and daily if you can. Set up account alerts through your bank's app or website so you are notified of any transfer over a certain amount (many banks let you set this threshold). This way you will know about fraud quickly, which gives you more time to report it and increases the chance of a full refund.

Request an ACH debit block from your bank if it is available. This prevents anyone except you from initiating an ACH withdrawal from your account. You can still set up automatic payments yourself, but a fraudster cannot.

Do not use the same password for your bank account that you use for other websites. If one website is breached, a fraudster can try that password on your bank account. Use a password manager to create and store unique, strong passwords for each account.

Shred any checks you no longer use, and do not leave bank statements in the trash. If you receive paper statements, shred those too. Dumpster diving is still a real way fraudsters obtain account numbers.

The difference between ACH fraud and other types of account fraud

ACH fraud is different from debit card fraud, credit card fraud, and identity theft, though they can happen at the same time. If someone uses your debit card number without permission, that is debit card fraud, and your bank must refund it under Regulation E. If someone opens a credit card in your name, that is identity theft, and you will need to file a report with the Federal Trade Commission and place a fraud alert on your credit file.

ACH fraud is the easiest to reverse because the law is clear and the timeline is short. Debit card fraud is also reversible, but the process can take longer if the bank disputes your claim. Identity theft is the hardest to resolve because it can affect your credit score and take months or years to fully clean up.

If you discover that someone has opened accounts in your name or applied for credit using your information, that is identity theft, not just account fraud. You will need to take additional steps beyond disputing the ACH transfer: file a report with the Federal Trade Commission at IdentityTheft.gov, place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion), and consider freezing your credit.

Frequently Asked Questions

Can someone withdraw cash from an ATM using just my account and routing number?

No. An ATM requires a debit card and a PIN. Your account and routing number alone cannot be used at an ATM. However, someone with your account and routing number can initiate an ACH transfer to move money out of your account electronically.

If I give my account number to a business and they commit fraud, is my bank responsible?

Your bank is responsible for reversing the unauthorized transfer if you report it within 60 days. The business that committed the fraud may also be liable, but pursuing them is separate from getting your money back from the bank. Report the fraud to your bank first, then consider filing a complaint with the Federal Trade Commission.

How long does it take to get my money back after I report ACH fraud?

Most banks refund the money within one to three business days of your report. By law, the bank must complete its investigation and either refund you or explain why they believe the transfer was authorized within 10 business days. If the bank delays, follow up in writing and reference Regulation E.

Is my account number visible to other people if I pay someone by check?

Yes. Your account number and routing number appear on the bottom of every check. This is why you should only write checks to people and businesses you trust, and why you should shred checks you no longer use. Do not leave blank checks lying around, and do not give someone a check as a way to share your account information.

What if my bank says the ACH transfer was authorized and refuses to refund it?

Ask the bank in writing to explain how they determined the transfer was authorized. Request copies of any documentation they have. If you believe they are wrong, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can investigate and may require the bank to refund you.