Yes, someone can use your checking account number to take money, but only in specific ways

Your checking account number alone is not enough to drain your account. A thief needs both your account number and your routing number to set up an unauthorized transfer or payment. Even with both numbers, they cannot straightforward log into your account — they can only initiate transfers from outside your bank's system, which takes time and leaves a paper trail. The real risk is not when ready theft but unauthorized ACH transfers, bill payments, or checks written against your account.

The danger varies by what information they have. If someone has only your account number (from a check you wrote them, for example), they can attempt an ACH debit — a transfer that pulls money from your account to theirs. If they also have your routing number, they have everything needed to set up that transfer. If they have your name, account number, and routing number, they can also order checks in your name or set up automatic bill payments to themselves.

Key Takeaways

  • An account number alone cannot be used to transfer money; a thief also needs your routing number to initiate an ACH debit or payment.
  • Unauthorized ACH transfers can take one to three business days to process, giving you time to catch and dispute them before the money leaves.
  • Your bank is required to refund unauthorized ACH debits if you report them within 60 days, though the process takes time.
  • Checks you write carry your account and routing number on the bottom, so only give checks to people you trust or use bill-pay instead.
  • Fraudulent checks written in your name are your bank's liability, not yours, but you must report them as soon as you discover them.

What an unauthorized ACH debit actually looks like

An ACH (Automated Clearing House) debit is the most common way someone misuses your account number. The person initiates a transfer from their bank, claiming it is coming from your account. Your bank receives the request, checks that the account number matches their records, and processes it. The money moves to the thief's account within one to three business days.

You will see this as a debit on your statement, usually labeled with the originating company's name or a generic description like "ACH Debit" or "Electronic Withdrawal." If your account does not have enough money to cover it, your bank may decline the transfer, or it may go through and overdraft your account. Either way, you will notice it when you check your balance or receive your statement.

The critical window is the first 60 days. Federal law (Regulation E) requires your bank to refund unauthorized ACH debits if you report them within that time. After 60 days, you lose that protection, though you can still dispute the charge — it just becomes harder and slower.

How checks create the biggest risk

A physical check is the most dangerous way to expose both your account number and routing number at once. The routing number is printed on the left side of the bottom line, and your account number follows it. Anyone who holds a check you wrote has both pieces of information needed to initiate transfers or payments in your name.

This is why you should never write checks to people you do not know or trust. If you pay a contractor, vendor, or service provider, consider using your bank's bill-pay feature instead, which does not expose your account number to the payee. If you must write a check, use a shredder when you receive cancelled checks back, and do not leave blank checks lying around.

A thief with your account and routing number can also order checks in your name from a check printing company. These checks will draw from your account, and you may not notice until they start clearing. This is why monitoring your account regularly — at least weekly — matters.

What happens if someone orders checks in your name

If fraudulent checks are written and cashed against your account, your bank is liable for the loss, not you. Banks are required to verify the signature on checks, and if the signature does not match your actual signature, the bank should have caught it. When you report forged checks, the bank must investigate and refund the amount within a set timeframe (usually 10 business days for an initial credit, with a full investigation following).

The catch is that you have to report it. Check your statements regularly — at least once a week — and report any checks you did not write when ready. Do not wait for your monthly statement. The sooner you report it, the sooner the bank can freeze the account, cancel the fraudulent checks, and begin the refund process.

If you discover that checks have been ordered in your name, contact your bank right away and ask them to flag your account for fraud. They can place a security alert that requires additional verification before any new checks are issued.

How to protect your account number on checks

The simplest protection is to use bill-pay instead of checks whenever possible. Your bank's bill-pay system does not expose your account number to the payee — the bank handles the payment on your behalf. For recurring bills (utilities, insurance, subscriptions), set up automatic payments directly with the company, which also keeps your account number private.

When you do write checks, write them only to people or organizations you know and trust. Do not pre-sign checks or leave blank checks accessible. When you receive cancelled checks back from your bank (or access them online), shred them before throwing them away. Do not leave them in the trash or recycling bin.

If you lose a checkbook or suspect checks have been stolen, contact your bank when ready and ask them to flag your account. They can cancel the missing checks and monitor for fraudulent activity. Some banks will also issue you a new account number if fraud has already occurred, though this is less common.

What to do if you discover unauthorized activity

The moment you notice a debit or check you did not authorize, contact your bank. Do this by phone, not email or online chat, so there is a record of the call. Tell them the specific transaction, the date, and the amount. Ask them to reverse the charge when ready and open a dispute.

Your bank will place a temporary credit to your account (usually within one to three business days) while they investigate. The investigation itself takes up to 10 business days. During that time, the bank will contact the originating bank or company and ask them to verify that the transaction was authorized. If the originating bank cannot prove authorization, the credit becomes permanent.

Keep records of everything: the date you called, the name of the person you spoke to, the confirmation number, and copies of the disputed transactions. If your bank denies your dispute, you can escalate it to your state's banking regulator or file a complaint with the Consumer Financial Protection Bureau (CFPB).

The difference between account number exposure and full identity theft

Exposure of your account number is not the same as identity theft. Identity theft involves someone using your name, Social Security number, or other personal information to open new accounts or take out loans in your name. Account number exposure is narrower — it allows someone to attempt transfers or payments from your existing account, but not to create new credit in your name.

That said, if someone has your account number, they may also have other information. If they have your name, address, and account number (all visible on a check), they have a starting point for broader fraud. This is why it matters to monitor your credit report and watch for accounts you did not open. You can request a free credit report from each of the three bureaus (Equifax, Experian, TransUnion) once per year at annualcreditreport.com.

Frequently Asked Questions

Can someone withdraw cash from my account with just my account number?

No. To withdraw cash, someone needs access to your debit card, PIN, or online banking login. An account number alone cannot be used at an ATM or in person at a bank branch. However, they can use your account number to initiate an ACH transfer to move money to another account.

How long does an unauthorized ACH transfer take to process?

One to three business days. This delay gives you time to notice the transaction and report it to your bank before the money actually leaves your account. Check your account balance regularly so you catch unauthorized activity quickly.

What if I gave my account number to someone and now I'm worried?

Contact your bank and ask them to monitor your account for suspicious activity. You do not need to close the account unless fraud has already occurred. If you are concerned, you can request a new account number, though this is not always necessary unless unauthorized transfers have already happened.

Am I responsible for paying back an unauthorized ACH debit?

No, as long as you report it within 60 days. Your bank is required to refund unauthorized ACH debits under federal law. If you report it after 60 days, you may still dispute it, but you lose the automatic protection and the process becomes slower.

Can I stop a check I wrote if I'm worried about the person I gave it to?

Yes. Contact your bank and ask them to place a stop payment on that check. There is usually a fee (typically $25 to $35), and you must provide the check number, date, payee name, and amount. The stop payment is effective when ready, but the bank needs time to process it, so call as soon as possible.