What a person can actually do with your account number alone

Someone with only your checking account number—without your routing number, PIN, or online password—can set up a direct deposit or automatic payment to your account, but cannot withdraw money from it. They cannot log in, cannot transfer funds out, and cannot make purchases. What they can do is receive money on your behalf or set up a payment arrangement where money flows into your account, not out of it.

The real risk is not what they can do when ready, but what they might do next. If they have your account number and know your name and address, they have two of the three pieces needed to initiate an ACH debit—a withdrawal instruction sent through the banking system. They would still need authorization from you or a court order, but fraudsters sometimes forge authorization or use social engineering to make it look legitimate.

Your account number alone is also not enough to commit identity theft in the traditional sense. Credit card fraud, loan applications, and tax refund theft require more information: your Social Security number, date of birth, and usually a credit file. An account number is a piece of the puzzle, not the whole picture.

Key Takeaways

  • Someone with only your account number cannot withdraw money, log into your account, or make purchases without additional information or authorization.
  • They can set up direct deposits or recurring payments into your account, which is why account numbers appear on paychecks and bills.
  • The real danger is if they combine your account number with other personal details to initiate unauthorized ACH debits or fraudulent transfers.
  • If you suspect unauthorized activity, contact your bank when ready—federal law limits your liability for unauthorized transfers if you report within 60 days.

How ACH debits work and why account number matters

An ACH debit is an electronic withdrawal instruction routed through the Automated Clearing House system. To initiate one, a person needs your account number, routing number, and authorization—either a signed form, a verbal recording, or a digital signature. Banks are supposed to verify authorization before processing, but verification standards vary and fraudsters sometimes exploit gaps.

Your account number is the identifier that tells the ACH system which account to pull from. Without it, the instruction goes nowhere. With it, a fraudster can attempt to create the appearance of a legitimate debit—forging a utility bill, a gym membership agreement, or a loan document that includes your account number and a signature they fabricated or obtained without your knowledge.

Banks have fraud detection systems that flag unusual debits, but these systems are not foolproof. A small, recurring charge—$9.99 a month for a subscription service, for example—may slip through longer than a large one-time withdrawal.

What information a fraudster actually needs to drain your account

To move money out of your checking account without your permission, someone needs one of these routes: your online banking password and username; your debit card number plus the three-digit security code on the back; authorization to initiate an ACH debit; or a forged check or counterfeit debit card bearing your account number.

Your account number alone does not open any of these doors. It is a necessary piece for some of them, but not sufficient by itself. A fraudster who has your account number but not your password cannot log in. They cannot use it to make an online purchase. They cannot call your bank and transfer money without passing identity verification—and if they cannot answer security questions or provide the last four digits of your Social Security number, the bank will refuse.

The scenario where account number becomes dangerous is narrow: they have your account number, they have or can forge authorization, and your bank's verification process fails to catch the fraud. This happens, but it is not automatic.

Steps to take if you shared your account number with someone you now distrust

If you gave your account number to someone—a landlord, an employer, a utility company—and now worry they might misuse it, contact your bank and explain the situation. Ask whether you can place a fraud alert on the account, which flags it for unusual activity. Some banks allow you to set transaction limits or require verbal confirmation before processing large transfers.

You do not need to close the account unless the bank recommends it. Closing creates its own problems: outstanding checks may bounce, direct deposits may fail, and the account number remains in the banking system for seven years. A new account number is better only if you have already changed your direct deposit and bill payments, which takes time.

Monitor your account regularly—weekly is reasonable if you are concerned. Set up account alerts through your bank's app or website so you receive a notification when a deposit or withdrawal occurs. Most banks offer this free. If you see an unauthorized transaction, report it when ready; the 60-day window for disputing unauthorized transfers starts from the date your statement is sent, not from the date the transaction occurred.

How to report unauthorized withdrawals or ACH debits

If money leaves your account without your permission, call your bank's fraud line when ready. Have your account number, a list of the unauthorized transactions with dates and amounts, and any documentation ready—emails, texts, or letters that show you did not authorize the transfer.

Your bank will file a dispute and typically issue a provisional credit within one to three business days while they investigate. The investigation itself takes up to 10 business days. If the bank determines the transaction was truly unauthorized, the credit becomes permanent and the fraudster's bank is notified to reverse the transfer on their end.

If the bank rules against you—if they determine you authorized the transaction or cannot prove you did not—you have the right to dispute that decision in writing. Send a letter to the bank's dispute department (the fraud line can provide the address) explaining why you believe the transaction was unauthorized. Keep a copy for your records.

Under the Electronic Funds Transfer Act, your liability for unauthorized transfers is limited to $50 if you report within two business days of discovering the fraud, and $500 if you report within 60 days. After 60 days, you may have no protection, depending on your bank's policy and state law.

Why your account number appears on checks and bills

Banks print your account number on every check you write and include it on billing statements because legitimate businesses need it to receive payments from you. Your employer needs it to set up direct deposit. Your landlord needs it to accept electronic rent payments. Your utility company needs it to process automatic bill pay.

This is why account numbers are not treated as secret in the way passwords are. They are meant to be shared with people and organizations you trust. The security model assumes that authorization—your signature, your verbal consent, your written instruction—is what prevents misuse, not the secrecy of the number itself.

This model has weaknesses. Forged authorization is possible. Social engineering works. But it also means you should not panic if your account number becomes known to someone. Panic is appropriate only if they also have authorization or the ability to forge it.

Protecting your account number going forward

You cannot prevent your account number from being seen by people you do business with, and you should not try—it would make paying bills and receiving paychecks impossible. What you can do is limit who has it and be cautious about how you share it.

Do not post your account number on social media or in public forums. Do not include it in emails unless you are certain the recipient is legitimate and the email is encrypted. Do not read it aloud over an unsecured phone line to someone who called you. If someone calls claiming to be from your bank and asks for your account number, hang up and call the bank's main number from your statement instead.

When you close a business relationship—you switch banks, you move out of an apartment, you cancel a subscription—ask the organization to confirm they have deleted your account information. Most will not, but asking creates a record that you requested deletion, which can be useful if fraud occurs later.

Frequently Asked Questions

Can someone use my account number to open a credit card in my name?

No. Credit card fraud requires your Social Security number, date of birth, and usually a credit report inquiry. An account number alone cannot open a credit card. However, if a fraudster has your account number and other personal information, they could use it as part of a larger identity theft scheme.

What if someone set up an automatic payment from my account without permission?

Contact your bank when ready and report the unauthorized ACH debit. The bank will reverse it and investigate. You are also may have access to to dispute the charge with the company that initiated it—call them and tell them you did not authorize the payment. Many companies will cancel the arrangement when ready when you report it.

Is my account number the same as my routing number?

No. Your routing number identifies your bank; your account number identifies your specific account at that bank. Both appear on the bottom left of your checks. You need both to set up direct deposit or bill pay, but having only one is not enough to withdraw money.

Should I close my account if someone has my account number?

Not unless your bank recommends it. Closing creates more problems than it solves—outstanding checks bounce, direct deposits fail, and the number stays in the system. Instead, monitor your account closely, set up alerts, and contact your bank if you see unauthorized activity.

How long do I have to report unauthorized transfers?

You have 60 days from the date your bank statement is sent to report an unauthorized transfer and receive full protection under federal law. After 60 days, your liability may increase or disappear entirely, depending on your bank and state law. Report fraud as soon as you discover it.