A thief with your routing and account number can drain your account, but only through specific methods

Yes, someone with your routing number and checking account number can take money from your account. They cannot walk into a bank and withdraw cash — they need your physical card or ID for that. But they can set up unauthorized transfers, create fake checks, or sign you up for automatic payments that pull money out. The good news is that federal law limits your liability if you report the fraud quickly, and banks have fraud detection systems that catch many of these attempts before the money leaves.

The risk is real enough that you should treat your routing and account number like sensitive information, but not so catastrophic that you should avoid using your checking account. Millions of people share these numbers intentionally every day — with employers for direct deposit, with billers for automatic payments, with the IRS for tax refunds. The key is knowing what to watch for and what to do if something goes wrong.

Key Takeaways

  • A thief can use your routing and account number to set up unauthorized ACH transfers, create counterfeit checks, or establish fake automatic payments.
  • Federal law (Regulation E) limits your liability to $50 if you report unauthorized transfers within two business days, and $500 if you report within 60 days.
  • Your bank's fraud detection system catches many unauthorized attempts before money leaves your account, but you should monitor your statements weekly.
  • You should report suspected fraud to your bank when ready by phone, not email, and follow up with a written statement within 10 days.

How thieves actually use routing and account numbers

The most common method is an ACH transfer — an electronic transfer between bank accounts. A thief can contact your bank (or a payment processor) and request a transfer from your account to theirs. They do not need your permission; they just need the routing number, account number, and your name. Banks are supposed to verify the request, but verification standards vary, and some processors are less careful than others.

A second method is creating counterfeit checks. With your routing number and account number printed on a check, a thief can write checks from your account and cash them at stores or deposit them elsewhere. This is slower than an ACH transfer but harder to trace when ready because it moves through the check-clearing system.

A third method is setting up automatic payments or subscriptions in your name. A thief might sign you up for recurring charges — gym memberships, streaming services, or fake utility bills — that pull money from your account each month. These are often small enough to avoid when ready notice.

What your bank's fraud detection catches

Banks run automated systems that flag unusual activity. A transfer to a new account, a large withdrawal, or a pattern that does not match your history will often trigger a hold or a call to you. If your account normally sees deposits and small purchases, a sudden $2,000 transfer to an unfamiliar account will likely be stopped before it clears.

However, these systems are not perfect. Small, frequent transfers might slip through. Transfers to accounts at the same bank might clear faster. And if a thief has your name and account number but not your phone number on file, the bank might not be able to reach you to verify. This is why monitoring your own statements is your most reliable defense.

Your legal protection if fraud happens

Regulation E is the federal rule that protects you from unauthorized electronic transfers. Your liability depends on how fast you report the fraud:

  • If you report within two business days of discovering the fraud, you are liable for no more than $50.
  • If you report between two and 60 days, you are liable for no more than $500.
  • If you wait more than 60 days, you could lose everything that was taken, though many banks offer additional protection beyond the legal minimum.

This protection applies to unauthorized electronic transfers — ACH transfers and automatic payments. It does not cover counterfeit checks in the same way. For checks, you have different protections under state law and the Uniform Commercial Code, but the process is slower and less certain.

The key word is unauthorized. If you gave someone permission to transfer money and then changed your mind, that is a contract dispute, not fraud, and Regulation E does not protect you.

What to do if you spot unauthorized activity

Call your bank when ready — do not email. Find the number on your bank statement or your debit card, not a number from a search result. Tell them you see unauthorized transfers or charges. They will freeze your account, cancel your debit card, and begin an investigation.

Follow up with a written statement within 10 days. Your bank will send you a form or accept a letter. Include the date you discovered the fraud, the dates and amounts of each unauthorized transaction, and a description of what happened. Keep a copy for your records.

Your bank will investigate and typically issue a provisional credit within 10 business days while they verify the fraud. Once they confirm it was unauthorized, the credit becomes permanent. If they find you were negligent — for example, you wrote your account number on a postcard and mailed it — they might not cover the full amount, but this is rare.

How to reduce the risk

Do not post your routing and account number on social media or in public forums. Do not write them on checks you mail unless necessary. Do not give them to anyone who calls you claiming to be from your bank — legitimate banks already have this information.

When you intentionally share your account number — for direct deposit, bill payments, or transfers — use only official channels. Verify the recipient's identity before sending the information. If you are setting up a payment with a company, go to their official website or call their main number, not a number from an email.

Monitor your account weekly, not monthly. Log into your bank's website or app and scan recent transactions. Many banks let you set up alerts for transfers over a certain amount or to new recipients. Use these if your bank offers them.

If your debit card is lost or stolen, report it when ready. If you suspect your account number has been compromised, ask your bank to close the account and open a new one with a new account number. This is free and takes a few days.

The difference between routing numbers and account numbers

Your routing number identifies your specific bank branch — it is the same for everyone at that branch. Your account number identifies your specific account. Together, they tell the banking system exactly where to send or pull money.

Routing numbers are semi-public. They appear on checks, and you can find any bank's routing number online. Giving out your routing number alone is low-risk. Your account number is more sensitive because it is unique to you. A thief needs both to move money, but they also need to know your name and sometimes other details to make the transfer look legitimate.

Frequently Asked Questions

Can someone withdraw cash from my account with just my routing and account number?

No. To withdraw cash, a thief would need your debit card or to go to a teller with your ID. With just the routing and account number, they can only move money electronically or create checks. This is why debit card fraud is often faster and more damaging than account number fraud.

If I give my account number to my employer for direct deposit, am I at risk?

Your employer needs your routing and account number to deposit your paycheck, and this is a standard, safe practice. Employers process thousands of direct deposits and have no incentive to commit fraud. The risk is much lower than giving your account number to an unknown person or posting it online.

How long does it take for an unauthorized transfer to clear?

ACH transfers typically take one to three business days to clear. If your bank's fraud detection catches it, the transfer may be stopped before it completes. If it does clear, your bank can still reverse it during the investigation, though this takes longer. Counterfeit checks can take five to ten business days to clear because they move through the check-clearing system.

What if my bank says the fraud was my fault?

Banks sometimes claim you were negligent — for example, if you wrote your account number on an unsecured document or shared it with someone you should have known was suspicious. If you disagree, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. Document everything: your communications with the bank, the dates of the fraud, and any evidence that you took reasonable precautions.

Should I close my account if someone has my routing and account number?

Not necessarily. If you caught the fraud early and your bank has already investigated, you may not need to close the account. However, if multiple unauthorized transfers occurred or if you are uncomfortable, closing the account and opening a new one is free and takes a few days. Your bank can help you set this up.