Yes, someone can use your account and routing number to take money, but not in the way you might think
Your account number and routing number alone are not enough to drain your account through an ATM or debit card. But they are enough for someone to set up automatic payments from your account — either by creating a fake bill-pay instruction at your bank, or by using the numbers to initiate an ACH transfer (a bank-to-bank electronic transfer). They can also use the numbers to set up a direct deposit in your name, which can be harder to notice if you don't check your account regularly.
The risk is real but not unlimited. Your bank is required by law to reverse most unauthorized transfers if you report them within a specific window. The catch is that you have to notice the transfer first, and the faster you report it, the better your protection.
Key Takeaways
- Someone with your account and routing number can initiate ACH transfers or bill-pay instructions without your permission, but cannot use a debit card or ATM card.
- You are protected against unauthorized transfers under the Electronic Funds Transfer Act, but you must report the fraud within 60 days to get full protection.
- The best defense is checking your account at least weekly and setting up account alerts for any transfer over a small amount you choose.
- If fraud happens, contact your bank when ready by phone (not email), document everything, and follow up in writing within 10 days.
What an unauthorized person can actually do with these numbers
An ACH transfer is the most common attack. ACH stands for Automated Clearing House, and it is the system banks use to move money between accounts. To initiate an ACH transfer, someone needs your account number, routing number, and your name — all of which can be found on a check, a bank statement, or sometimes just from a conversation. They do not need your password, your PIN, or your permission. They can pose as a business collecting a payment, or they can use a third-party payment service that does not verify the account holder's identity carefully.
Bill-pay fraud works similarly. If someone gains access to your online banking login, they can set up a bill-pay instruction to send money to an account they control. But even without your login, some banks allow bill-pay to be set up by phone or in person if the person knows your account number, routing number, and can answer a security question.
Direct deposit fraud is quieter. Someone can use your account and routing number to set up a direct deposit paycheck in your name, routing money into your account from a stolen employer account or a fraudulent payroll service. You might not notice for weeks if you do not check your deposits carefully.
What they cannot do with just these numbers
They cannot withdraw cash from an ATM. ATMs require a debit card and a PIN, neither of which is your account number or routing number.
They cannot use a debit card to make purchases. A debit card has its own security features, expiration date, and CVV code that are separate from your account and routing numbers.
They cannot log into your online banking portal. That requires a username and password, which are different from your account credentials.
They cannot call your bank and transfer money out without additional verification. Most banks require the caller to provide information beyond the account and routing number — such as the last four digits of your Social Security number, a PIN you set up, or answers to security questions.
How to notice fraud before it drains your account
Check your account at least once a week, ideally more often. Log into your online banking portal or mobile app and look at recent transactions. ACH transfers and bill-pay instructions show up as pending or posted transactions with a description of where the money went. Direct deposits show up as credits to your account.
Set up account alerts. Most banks allow you to set a threshold — for example, "alert me if any transfer over $100 leaves my account" or "alert me if a new payee is added to bill-pay." These alerts come by text or email and can catch fraud within hours instead of days.
Review your statements monthly, even if you check online regularly. Statements sometimes show details that the online portal does not, and they create a paper trail if you need to dispute a transaction later.
Watch for small test transfers. Fraudsters sometimes send a small amount first — $1 or $5 — to confirm the account is real before sending a larger transfer. If you see an unexplained small transfer, report it when ready rather than waiting to see if a bigger one follows.
What to do if you spot unauthorized transfers
Call your bank when ready. Use the phone number on the back of your debit card or on your bank statement — not a number from a search result or an email. Tell them you have spotted an unauthorized transfer and ask them to freeze your account and reverse the transaction. Write down the name of the person you spoke with, the time, and what they said they would do.
Do not wait for the transaction to post or clear. Even if it shows as "pending," report it right away. The sooner you report it, the stronger your legal protection.
Follow up in writing within 10 days. Send a letter or email to your bank's fraud department (ask for the address or email when you call) stating the date of the unauthorized transfer, the amount, and the date you reported it by phone. Keep a copy for your records. This creates a written record that protects you if the bank later disputes whether you reported the fraud in time.
Check your account daily for the next two weeks. Make sure the fraudulent transfer is reversed and that no new unauthorized transfers appear. If the bank does not reverse the transaction within two business days, call again and ask for a supervisor.
Your legal protection under the Electronic Funds Transfer Act
The Electronic Funds Transfer Act (EFTA) limits your liability for unauthorized transfers. If you report the fraud within 60 days of the statement date on which the unauthorized transfer appears, your bank must reverse the transfer and return the money to your account. You are not responsible for the loss.
If you report the fraud after 60 days but within 120 days, your bank may still reverse it, but they are not required to. If you wait longer than 120 days, the bank has no obligation to reverse the transfer, and you lose the money.
The 60-day clock starts from the date your bank sends you the statement showing the unauthorized transfer — not from the date the transfer happened. This is why checking your account weekly and setting up alerts is so important. A transfer that happened on the 1st of the month might not show on your statement until the 15th, and you might not receive the statement until the 20th. That leaves you only 40 days to report it.
Some banks offer stronger protection than the law requires. Ask your bank whether they have a fraud may provide or zero-liability policy that covers unauthorized transfers. If they do, get the details in writing.
How to reduce the risk of this happening to you
Do not share your account and routing number with people you do not trust. These numbers appear on every check you write, so be careful who you give checks to. If you are paying a contractor or a service provider, ask whether they accept payment another way — a credit card, a payment app, or a money order — before you hand over a check.
Shred old checks and statements. If someone finds a discarded check in your trash or recycling, they have your account and routing number.
Be cautious about where you provide these numbers online. Legitimate businesses that ask for bank details usually do so on a find page (look for "https" in the URL and a lock icon). If a website or email asks you to provide your account number, verify that you are actually on the business's real website and not a phishing site.
Use a credit card or debit card for online purchases instead of providing your bank account number directly. Credit cards have stronger fraud protection than bank accounts.
If you suspect your account number or routing number has been compromised — for example, because you gave it to someone who turned out to be untrustworthy — contact your bank and ask whether they can issue you a new account number. Some banks will do this at no cost if fraud is involved.
Frequently Asked Questions
Can someone open a new bank account in my name using my account and routing number?
No. Opening a new account requires a government-issued ID, a Social Security number, and usually an in-person visit or a video verification call. Your account and routing number alone are not enough. However, if someone has your Social Security number and other personal information, they could attempt identity theft, which is a separate and more serious crime.
If I give my account number to a business and they commit fraud, is the business liable?
Not automatically. Your bank is liable under the EFTA if you report the fraud within 60 days. The business may also be liable under contract law or consumer protection laws, but pursuing that claim is separate from getting your money back from the bank. Report to your bank first, then consider whether to file a complaint with your state's attorney general or the Consumer Financial Protection Bureau.
How long does it take for my bank to reverse an unauthorized transfer?
By law, your bank must reverse the transfer and credit your account within two business days if you report it within 60 days. In practice, many banks do it faster — sometimes within hours. Ask your bank for a specific timeline when you call to report the fraud.
What if the person who committed fraud is someone I know, like a family member or roommate?
The law treats it the same way: it is still unauthorized, and you are still protected under the EFTA. Report it to your bank. If you want to pursue criminal charges, you can file a police report, but that is separate from getting your money back. Be aware that filing a police report against a family member has serious consequences, so consider whether you want to go that route.
Can I change my routing number if I think it has been compromised?
No. Your routing number is assigned to your bank branch and cannot be changed. However, you can ask your bank to issue you a new account number, which will make any fraudulent ACH transfers or bill-pay instructions set up with the old number invalid. Ask your bank how long it takes for the old account number to stop working and whether there are any fees.