Yes, someone can take money from your account using only your account number and routing number

Your bank account number and routing number are enough for someone to set up a payment from your account — they do not need your debit card, PIN, or online password. This is by design: it is how employers set up direct deposit, how you pay bills by check, and how you authorize automatic payments to utilities or loan servicers. The same mechanism that makes these conveniences possible also means that if someone has both numbers, they can attempt to withdraw money without your permission.

The risk is real but manageable. Banks have fraud protections in place, and you have legal rights if unauthorized transfers happen. Understanding what is actually possible, what is not, and what to do if something goes wrong will help you decide how carefully to guard these numbers.

Key Takeaways

  • Someone with your account and routing number can set up an Automated Clearing House (ACH) transfer to pull money from your account, but the transaction takes one to three business days to process.
  • Your bank can reverse unauthorized ACH transfers if you report them within a specific window, usually 60 days from when you first see the transaction on your statement.
  • Sharing your account number with known businesses — your employer, your utility company, your mortgage lender — is standard and safe because these organizations are regulated and have their own liability if they misuse it.
  • Posting your account number publicly online, giving it to someone you do not know, or writing it on a check you mail to an unfamiliar recipient creates real risk of fraud.
  • If you suspect unauthorized activity, contact your bank when ready; waiting longer makes it harder to reverse the transaction and may cost you money.

How someone uses your account number to take money

The tool is called an ACH transfer — Automated Clearing House. It is a system that moves money between bank accounts electronically. When you set up direct deposit at a new job, you give your employer your account and routing number. Your employer then uses ACH to deposit your paycheck. The same process works in reverse: someone with your numbers can initiate an ACH debit — a pull of money out of your account instead of a deposit into it.

The person does not need to log into your online banking, does not need your debit card, and does not need your permission in advance. They straightforward submit the transfer request to their own bank, which then contacts your bank to pull the funds. The transfer takes one to three business days to complete, which means you might not see it disappear from your account right away.

This is why ACH fraud is a real concern. It is also why banks ask you to be cautious about sharing these numbers with people you do not know.

What someone cannot do with just your account number

Your account number alone does not let someone log into your online banking, make purchases with a debit card, or transfer money using your bank's website or app. Those actions require your username, password, or the physical card itself. Someone cannot drain your account by guessing your PIN or hacking your email.

Wire transfers — the fast, irreversible kind of money movement — also require more than just your account number. Your bank will ask for additional verification before sending a wire, and the person initiating it needs access to your account or a phone call with you directly.

The risk from sharing your account number is real, but it is narrower than the risk from sharing your password or debit card number. That distinction matters when you are deciding whether to give out these numbers.

When it is safe to share your account and routing number

Sharing these numbers with established, regulated organizations is standard practice and carries low risk. Your employer needs them for direct deposit. Your mortgage lender, utility company, and insurance company need them to collect payments. Your bank itself has these numbers on file. These organizations are regulated by federal agencies, have their own liability if they misuse your information, and have far more to lose by committing fraud than they could gain.

The same applies to established bill-payment services like PayPal, Venmo, or your bank's own bill-pay tool. These companies have security measures in place and legal obligations to protect your data. Millions of people use them without incident.

The key is that you initiated the relationship and you know who you are dealing with. You can verify the company is real by calling the phone number on your bill or visiting their official website directly — not by clicking a link in an email or text.

When sharing your account number is risky

Do not share your account number with someone you do not know, even if they claim to represent a company. Scammers often call or email pretending to be from your bank, the IRS, a utility company, or a government agency. They create urgency — "your account is frozen," "you owe money," "act now" — to pressure you into giving information before you think clearly.

Do not post your account number on social media, in online forums, or anywhere public. Do not write it on a check you mail to someone you have never dealt with before. Do not give it to someone who contacts you out of the blue, even if they sound official.

If someone asks for your account number and you did not contact them first, hang up or close the message and call the organization directly using a phone number from your bill or their official website. Legitimate companies will never pressure you to share banking information over the phone or email.

What to do if you see an unauthorized transfer

Check your bank statement regularly — at least once a week if you can. If you see a transfer you did not authorize, contact your bank when ready. Call the phone number on the back of your debit card or on your statement, not a number from an email or text message.

Tell the bank representative that you did not authorize the transfer and ask them to reverse it. Most banks will reverse an unauthorized ACH debit if you report it within 60 days of the transaction appearing on your statement. Some banks are faster and more generous, but 60 days is the legal minimum under federal rules.

The bank will likely ask you to file a dispute in writing as well. They will send you a form or let you file it through your online account. Keep records of all your communications — dates, times, names of representatives, confirmation numbers — in case you need to follow up.

While the dispute is being investigated, the bank should return the money to your account temporarily. The investigation itself usually takes 10 business days, though it can take longer if the bank needs more information from you or from the other bank involved.

Protecting your account number going forward

You do not need to keep your account number secret from everyone — you need to be selective about who you share it with. Treat it the way you would treat your home address: safe to give to your employer, your doctor, your utility company, but not to strangers or on public bulletin boards.

If you have given your account number to someone and now feel unsafe, contact your bank and ask about your options. Some banks will close your account and open a new one at no charge if you are concerned about fraud. Others can flag your account for extra monitoring. It is worth asking.

Use your bank's bill-pay service or a trusted third-party payment app for payments to people or businesses you do not have an ongoing relationship with. These tools let you make a one-time payment without giving out your account number directly.

Frequently Asked Questions

Can someone use my account number if they do not have my routing number?

Not easily. An ACH transfer requires both numbers — the routing number identifies your bank, and the account number identifies you within that bank. Without both, the transfer will fail. However, your routing number is not secret; it is printed on every check you write. So if someone has your account number, they can usually find your routing number with a quick search.

What if someone sets up a recurring ACH debit from my account?

Contact your bank right away and ask them to stop the recurring transfer. They can block future payments and reverse the ones that have already gone through if you report it within 60 days. You may also want to ask your bank about setting up a fraud alert or placing a freeze on your account while you investigate.

Is it safer to give my account number over the phone or in writing?

Neither is inherently safer — the risk depends on who you are giving it to. If you initiated the call to a company you trust, giving your number over the phone is fine. If someone called you out of the blue, do not give it over the phone or in writing. Hang up, look up the company's official phone number, and call them back to verify the request.

Can I change my account number if I think it has been compromised?

Yes. Contact your bank and ask to close your current account and open a new one. The bank can usually do this same-day or within one business day. You will need to update your account number with your employer, any companies that pull automatic payments, and any services where you have it on file. It is inconvenient, but it stops the bleeding if you believe your number is in the wrong hands.

Do I need to report this to the police or the FTC?

If money was actually taken from your account without your permission, you can report it to the Federal Trade Commission at ReportFraud.ftc.gov. You can also file a police report in your city, though police rarely investigate individual cases of ACH fraud. Your bank's fraud investigation is usually the most important step — that is where the money gets recovered.