Yes, but only certain things—and your bank has protections
Someone who has your checking account number and routing number can set up a direct deposit into your account or make a one-time transfer into it. They cannot withdraw money, make purchases, or drain the account with only those two pieces of information. To pull money out, they would need your PIN, online banking password, or physical debit card—none of which your account number provides.
The real risk is not theft but unwanted deposits or transfers. A person with your account number can initiate an ACH transfer (the system banks use to move money between accounts) to send you money, which means they could also reverse it later if they claim it was sent by mistake. They can also set up automatic deposits, which creates a mess to undo. The protection you have is that your bank can reverse unauthorized incoming transfers, though the process takes time.
Key Takeaways
- Your account number alone cannot be used to withdraw money, make purchases, or access your account online.
- Someone with your account number can initiate incoming ACH transfers or direct deposits, but your bank can reverse these if you report them as unauthorized.
- Outgoing transfers—money leaving your account—require additional verification like a password, PIN, or physical card.
- If you notice unexpected incoming transfers, contact your bank when ready; reversals are easier when reported quickly.
What incoming transfers actually require
To send money into your account via ACH, a person needs your account number, your routing number, and your name. That is the standard information printed on a check. They do not need your permission, your password, or any approval from you—the transfer initiates from their bank, not yours.
This is why ACH fraud often starts with a scammer sending a small deposit first. They are testing whether the account number is real and active. If the deposit goes through, they know the information is correct. Then they might attempt a larger transfer, or they might reverse the test deposit and claim it was sent by mistake, hoping you will refund it manually.
Your bank's job is to reverse the transfer if you report it as unauthorized. The timeline varies: some banks reverse within one business day, others take up to ten. The faster you report it, the faster the reversal happens. If you wait weeks, the bank may have already processed the reversal request and closed the case.
Why your debit card and password stay safe
Withdrawals and purchases require either your debit card (the physical object) or your online banking credentials. Your account number is printed on checks and statements; your debit card is not. Someone who knows your account number cannot order a new debit card, because the bank verifies the request through your registered phone number or email address.
Online banking works the same way. Logging into your account requires a username and password that you create and change. Your account number is not a password. Even if someone knows both your account number and routing number, they cannot log in without the credentials you set up.
The one exception is if you have given someone access—a spouse, a business partner, a parent you authorized. In that case, they have legitimate access to withdraw money. But that is permission you granted, not something your account number alone enables.
When you should worry about your account number being shared
Sharing your account number is normal and necessary. You give it to your employer for direct deposit. You give it to your utility company to pay bills automatically. You write it on checks. The risk is not that the number exists in the world—it is that it ends up with someone who wants to misuse it.
Be cautious if you share your account number with someone you do not know or trust. This includes online marketplaces where you are selling something and a buyer asks for your account number to send payment. Use a payment app or service instead. If a business you do not recognize asks for your account number, verify the request independently by calling the business directly using a phone number from their official website.
Phishing emails and texts often ask for account numbers. Your bank will never ask for your account number via email or text. If you receive a message claiming to be from your bank and asking for account details, do not respond. Call your bank using the number on the back of your debit card.
What to do if you think your account number has been misused
Contact your bank when ready. Tell them you want to report unauthorized ACH transfers or deposits. Your bank will review the transactions and determine whether to reverse them. Have the following information ready: the date of the transfer, the amount, and the name of the account or business it came from or went to.
Your bank may freeze your account while investigating, which means you cannot make new transfers until the review is complete. This is temporary and protects you. Once the bank confirms the transfer was unauthorized, they will reverse it and restore your money.
If the unauthorized transfer came from a business or individual you can identify, you can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB does not reverse transactions, but it documents patterns of fraud and can take action against repeat offenders.
How to reduce the risk
Monitor your account regularly. Check your bank's app or website at least weekly. Set up account alerts if your bank offers them—most banks let you receive a notification whenever a deposit or transfer occurs. This way you will know about unauthorized activity within hours, not weeks.
Use a separate account for online transactions if you can. Some people keep a checking account with a low balance for online purchases and bill payments, and a separate savings account where most of their money sits. This limits the damage if one account is compromised.
When you close an account, make sure any automatic payments or direct deposits are moved to your new account first. A forgotten automatic payment to an old account number can cause confusion and may be treated as unauthorized if the account is no longer active.
Frequently Asked Questions
Can someone open a credit card or loan in my name using my account number?
No. Opening a credit account requires a full process with your Social Security number, date of birth, address, and other identity information. Your account number alone is not enough. However, if someone has your Social Security number and other personal details, they can commit identity theft. Check your credit report annually at annualcreditreport.com to catch unauthorized accounts early.
What if someone sends me money and then claims they sent it by mistake?
You are not obligated to refund it. If they initiated the transfer, it is their responsibility to contact their bank and request a reversal. Do not send money back unless you are certain the transfer was genuinely accidental and you trust the person. Scammers often use this tactic: they send a large deposit, ask you to refund part of it, then reverse the original deposit after you have sent your refund.
Is it safe to write my account number on a check?
Yes. Checks are designed to be written with your account number visible. The risk is if a check is lost or stolen before you mail it, or if you mail it to the wrong address. Once a check is in the mail to a legitimate payee, the account number is no longer a secret—and that is normal. The payee needs it to deposit the check.
Can I change my account number if I am worried about fraud?
You can request a new account number from your bank, but it is disruptive. Any automatic payments or direct deposits using the old number will fail. You will need to update the new number with your employer, service providers, and anyone else who has it. Most banks only issue a new account number if there is evidence of fraud, not just as a precaution.
What is the difference between my account number and my routing number?
Your routing number identifies your bank and branch. Your account number identifies your specific account at that bank. Together they tell the banking system exactly where to send money. Neither one alone is enough to complete a transfer—you need both. Your routing number is the same for everyone at your bank; your account number is unique to you.