What a scammer or thief can actually do with your account number

A scammer with your bank account number and routing number can set up unauthorized transfers out of your account, create fraudulent checks in your name, or establish fake ACH (automated clearing house) payments. They cannot log into your online banking or withdraw cash directly from an ATM—those require your PIN or login credentials. But they can drain your account through methods that look like legitimate transactions to your bank's system, at least initially.

The real damage depends on how quickly you notice and report it. If you catch it within days, your bank can often reverse the transfers. If weeks pass, you may lose the money permanently, though federal protections exist that can help you recover some or all of it.

Key Takeaways

  • Your account number alone allows someone to initiate ACH transfers and create fraudulent checks, but not to access your online account or withdraw cash at an ATM.
  • Report unauthorized activity to your bank within two business days to limit your liability under federal law to $50 per transaction.
  • If you report after two business days but within 60 days, you may be liable for up to $500; after 60 days, you lose federal protection and may lose all the money.
  • Your bank must investigate and either reverse the transaction or prove it was authorized; this process typically takes 10 business days.
  • Freezing your account when ready stops new transfers, but does not reverse ones already posted.

How unauthorized ACH transfers work with just your account number

An ACH transfer is a bank-to-bank electronic payment. To initiate one, a scammer needs your account number, routing number, and the name on the account—all of which can be gathered from a check, a bill, or a data breach. They do not need your password or PIN. They contact their own bank or use a third-party payment service and request a transfer from your account to theirs.

Your bank's system processes the transfer because the routing and account numbers are correct. The transaction appears to go through. You may not notice for days or weeks if you do not check your balance regularly. By the time you report it, the scammer's bank may have already sent the money onward or the scammer may have withdrawn it in cash.

This is why ACH fraud is one of the most common forms of account theft. It requires minimal information and leaves a paper trail only after the damage is done.

Fraudulent checks and what happens when they clear

A scammer with your account number can write checks against your account without your knowledge. They may use a check printing service or create counterfeit checks using your account details. When the check is deposited into their account and clears, the funds leave your account.

Check fraud is slower than ACH fraud—it takes several days for a check to clear—but it is also harder to trace initially. Your bank may not flag it as suspicious because the routing and account numbers are legitimate. You discover it when you reconcile your account or when your bank sends a statement.

The good news: check fraud is easier to dispute than ACH fraud because banks have clearer procedures for handling forged checks. You report it as a forged item, and your bank must investigate and typically reverse it within 10 business days.

What they cannot do without additional information

A scammer cannot log into your online banking account with just your account number. They need your username and password, or your login credentials plus a second authentication factor (a code sent to your phone, for example). If you use strong passwords and enable two-factor authentication, your online account is protected even if your account number is compromised.

They also cannot withdraw cash from an ATM or make a purchase with a debit card using only your account number. Both require the physical card or the card number plus a PIN or CVV. Your account number is not the same as your debit card number.

They cannot open a new account in your name using only your account number, though they might use it as part of a larger identity theft scheme if they also have your Social Security number or other personal information.

Your liability timeline and federal protections

Federal law (Regulation E) limits your liability for unauthorized electronic transfers, but the amount depends on when you report the fraud. This is a hard important date, not a guideline.

Within two business days of discovering the fraud: Your liability is limited to $50 per unauthorized transaction. Your bank must reverse the transfer or prove it was authorized.

Between two and 60 days: Your liability increases to $500. Your bank still must investigate, but you are responsible for a larger portion of the loss.

After 60 days: You lose federal protection entirely. If your bank cannot prove the transaction was authorized, you may still recover the money through a civil lawsuit or negotiation with your bank, but you have no legal may provide. Many people lose the full amount at this stage.

The clock starts the moment you discover the unauthorized activity, not when it occurred. If a scammer drains your account on a Monday but you do not check your balance until Friday, your two-day window starts on Friday.

Steps to take when ready if you suspect fraud

Call your bank's fraud line right away—do not use the number on your debit card or the main customer service line. Look up the fraud number on your bank's website or your most recent statement. Tell them you have unauthorized transfers or checks and ask them to freeze your account when ready. Freezing stops new transactions from posting, though it does not reverse ones already cleared.

Ask your bank to issue you a new account number and debit card. This is standard after fraud and usually happens within one to three business days. Request written confirmation of the fraud report and the date you reported it; you will need this if you have to dispute the charges later.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and may help if the scammer targets you again or if you need to dispute the charges with a credit bureau. You do not need a police report to file with the FTC, though you can file one with your local police if you want an additional record.

Check your credit report for new accounts or inquiries you did not authorize. You can request a free report from each of the three major bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com. If you see fraudulent accounts, contact the bureau and the creditor to dispute them.

How your bank investigates and what happens next

Once you report unauthorized activity, your bank must begin an investigation within one business day. They will contact the other bank (the one that received the fraudulent transfer) and ask for documentation of who initiated the transfer and where the money went. This process typically takes 10 business days, though it can extend to 45 days if the other bank is slow to respond.

Your bank will either reverse the transaction (credit your account) or send you a written explanation of why they believe it was authorized. If they reverse it, the money returns to your account, usually within one to three business days. If they deny your claim, you can dispute it further, but at that point you are fighting an uphill battle.

While the investigation is ongoing, your bank may provisionally credit your account—meaning they give you the money back temporarily while they investigate. This is not may provide, but many banks do it to keep customers from losing access to their funds during the process.

How to prevent this from happening

Do not share your account number or routing number with anyone you do not trust completely. These numbers appear on every check you write, so be careful with physical checks. Do not leave them in your mailbox or throw them in the trash unshredded.

Use a shredder for any mail with your account information. If you receive a data breach notice from a company you do business with, assume your account number may be compromised and contact your bank to discuss whether you should change your account number preemptively.

Set up account alerts with your bank so you are notified of large transfers or unusual activity. Many banks offer free alerts via text or email. Check your account balance at least weekly, more often if you are concerned about fraud.

If you are paying a bill by check or ACH, use your bank's bill pay service rather than mailing a check or giving your account number directly to a vendor. Your bank's bill pay adds a layer of protection and creates a record of authorized payments.

Frequently Asked Questions

Can someone open a credit card or loan in my name with just my account number?

Not with your account number alone. They would need your Social Security number, date of birth, and other personal information to open a credit account. However, if they have your account number and other details from a data breach, they may have enough to commit identity theft. Monitor your credit report for new accounts you did not open.

What if my bank says the transfer was authorized and refuses to reverse it?

Ask them in writing to explain how they determined it was authorized. Request documentation of the authorization (an email, a phone recording, a signed form). If they cannot produce it, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can pressure your bank to reconsider.

How long does it take to get my money back after I report fraud?

If your bank reverses the transaction, the credit usually appears in your account within one to three business days. The full investigation can take up to 10 business days, sometimes longer. If the other bank is uncooperative, it can stretch to 45 days. Ask your bank for a timeline when you report the fraud.

Should I close my account after fraud?

Not necessarily. Your bank will issue you a new account number and debit card, which is usually enough. Closing the account can hurt your credit history and may complicate the fraud investigation. Keep the account open unless your bank recommends closing it or you have other reasons to switch banks.

Can I recover money if I report the fraud after 60 days?

You lose federal protection, but you may still recover the money through negotiation with your bank or by filing a civil lawsuit. Some banks will reverse fraud even after 60 days if you can show you were not negligent. Contact your bank's dispute department and explain your situation. If they refuse, consult a lawyer about whether a lawsuit is worth the cost.