Yes, someone can use your checking account number to take money from your account

If someone has your checking account number and your bank's routing number, they can set up an ACH transfer — an electronic movement of money from your account to theirs. They do not need your debit card, PIN, or online password. They do not need permission. The bank will process the transfer if the request comes from a source that looks legitimate to them.

This is different from a debit card theft, where someone needs the card itself plus a PIN or signature. An account number alone is enough because ACH transfers are designed to work between people and businesses who know each other — employers paying you, utilities billing you, you paying a friend. The system assumes that if someone has your account number, you gave it to them.

The risk is real but manageable. Banks have fraud detection systems, and you have legal protections if money leaves your account without your permission. But the faster you notice and report it, the better your chances of getting the money back.

Key Takeaways

  • Someone with your account number and routing number can start an ACH transfer from your account without your permission or knowledge.
  • You are protected by federal law: unauthorized transfers must be reported within 60 days, and the bank must investigate and refund you if fraud is confirmed.
  • The bank's fraud detection system may block suspicious transfers, but it does not catch everything, so you should monitor your account regularly.
  • Sharing your account number with trusted sources only — your employer, your landlord, people you are paying — reduces the risk significantly.

How ACH transfers work and why account numbers are enough

An ACH transfer is a request sent through the banking system to move money from one account to another. The request includes the account number, the routing number, the amount, and the date. The originating bank (the one sending the request) submits it to a clearing house, which matches it to your bank and your account.

Your bank checks a few things: Does the account number match the routing number? Is the account active? Is there enough money? But the bank does not call you to confirm. It does not require a password or a signature. It assumes that if someone is sending a request with your account details, they have a legitimate reason.

This design works well for payroll, bill payments, and transfers between people who know each other. It breaks down when someone obtains your account number without permission. They can pose as a business, a landlord, or a creditor and request a transfer. If the request looks routine, the bank processes it.

What fraudsters actually do with an account number

The most common scenario is a fraudulent ACH debit — someone sets up a transfer that pulls money out of your account. They might claim to be a utility company, a loan servicer, or a government agency. They might say you owe money, or they might straightforward request a transfer without explanation.

Less common but still possible: someone uses your account number to open a new account at a different bank and uses that account for fraud. Your account number alone is not enough to do this — they would also need your name, address, and Social Security number — but if they have all of that, your account number becomes one more piece of the puzzle.

Someone cannot use your account number to make purchases online or in stores. They cannot withdraw cash from an ATM. They cannot access your online banking. Those actions require a debit card, a PIN, or login credentials. An account number is specifically useful for ACH transfers and for setting up recurring payments.

How to know if unauthorized transfers have happened

The only reliable way to catch fraud is to check your account regularly — at least weekly, ideally more often. Log into your online banking or mobile app and look at the transaction history. Fraudulent ACH debits show up as transfers to accounts you do not recognize, often with vague descriptions like "ACH DEBIT" or a company name you do not do business with.

If you see a transfer you did not authorize, do not wait. Call your bank when ready. The phone number is on the back of your debit card or on your bank statement — not a number you find by searching online, because scammers sometimes create fake bank websites. Tell the bank representative that you want to report an unauthorized transfer and ask them to freeze your account temporarily while they investigate.

Write down the date you called, the name of the representative, and what they said they would do. If the bank says they will investigate but does not contact you within a few days, call back and ask for a status update. Keep records of every conversation.

Your legal protection against unauthorized ACH transfers

Federal law — specifically the Electronic Funds Transfer Act — protects you if someone uses your account number to take money without permission. The bank must investigate your claim and refund the money if they confirm it was fraud. The catch is timing: you must report the unauthorized transfer within 60 days of when your bank statement was sent to you.

If you report within 60 days, your liability is zero. The bank bears the loss. If you report after 60 days, you may be liable for some or all of the fraudulent transfer, depending on your bank's policies and the circumstances. This is why checking your account regularly matters — the sooner you notice, the sooner you can report, and the stronger your position.

The investigation itself takes time. The bank typically has 10 business days to complete it, though they can ask for more time if needed. During the investigation, the bank may provisionally credit your account so you have access to the money while they verify what happened. Once they confirm fraud, the credit becomes permanent.

Steps to take if your account number has been compromised

If you believe someone has your account number and may use it fraudulently, you have options. You can ask your bank to issue you a new account number. This is not the same as closing the account — your account stays open, but the old number no longer works. Any legitimate recurring payments (payroll, utilities, loan payments) will need to be updated with the new number, so this is a bigger hassle than fraud prevention alone, but it is available if you are concerned.

You can also place a fraud alert on your credit report by contacting one of the three major credit bureaus (Equifax, Experian, or TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts in your name. This does not prevent ACH fraud on your existing account, but it does reduce the risk that someone will open new credit accounts using your information.

If the fraudulent transfer has already happened, focus on reporting it to your bank first. Once that is underway, consider whether you need to file a report with the Federal Trade Commission (FTC) at reportfraud.ftc.gov. The FTC does not investigate individual cases, but the report becomes part of a database that helps law enforcement track fraud patterns.

How to protect your account number going forward

The safest approach is to share your account number only with people and organizations you trust and have a direct relationship with. Your employer needs it for payroll. Your landlord may need it for rent payments. Your utility company needs it if you set up automatic bill pay. These are legitimate reasons to share.

Do not share your account number in response to unsolicited calls, emails, or texts. If someone claims to be from your bank, your utility company, or a government agency and asks for your account number, hang up and call the organization directly using the number on your statement or bill. Scammers are skilled at sounding official.

Be cautious about where your account number appears. Checks have your account number printed on them, so do not leave blank checks lying around. Some businesses ask for your account number when you write a check, which is normal. But if a business asks for your account number in a context where it does not make sense — like a retail store asking for it at checkout — you can decline and use a different payment method.

Frequently Asked Questions

Can someone use my account number to get a loan in my name?

No, not with the account number alone. Opening a loan or credit account requires your name, address, date of birth, and Social Security number. Your account number is not part of that process. However, if someone has all of that information plus your account number, they have enough to commit identity theft, which is a broader problem than ACH fraud.

Will my bank catch a fraudulent ACH transfer before it goes through?

Maybe. Banks use fraud detection software that flags unusual transfers — large amounts, transfers to new accounts, transfers at odd times. But the system is not perfect, and routine-looking fraudulent transfers often slip through. This is why monitoring your account yourself is important.

How long does it take to get my money back after I report fraud?

The bank has 10 business days to investigate, though they can extend this to 45 days if needed. Many banks provisionally credit your account within one to three business days while the investigation is ongoing, so you may have access to the money before the investigation is complete. Once fraud is confirmed, the credit becomes permanent.

If I get a new account number, do I have to close my old account?

No. You can keep the account open and straightforward request a new account number. Your bank will deactivate the old number so it cannot be used for new transfers, but the account itself continues. You will need to update any recurring payments (payroll, bills, automatic transfers) with the new number.

What should I do if someone is making repeated fraudulent transfers?

Report each one to your bank and ask them to block the originating account or the business making the requests. You can also file a report with the FTC at reportfraud.ftc.gov. If the fraud is part of a larger pattern of identity theft, consider placing a credit freeze with the three credit bureaus to prevent new accounts from being opened in your name.