Someone with your account number can set up automatic payments from your account
Your checking account number alone is not enough to drain your account or make purchases in your name. But it is enough for someone to set up a one-time payment or recurring automatic payment from your account — like a bill payment or a transfer to another bank account. This is the most common thing that happens when account numbers are shared without permission.
The reason this works is that your account number, combined with your routing number, tells the banking system exactly where to pull money from. If someone has both numbers, they can instruct their own bank to move money out of your account. They do not need your password, your debit card, or access to your online banking.
This is different from a debit card transaction, where a merchant swipes your card or you enter your number online. With just your account and routing numbers, the person initiating the payment does not need to prove they are you — they only need to prove they have permission from the account holder, which they can claim without evidence.
Key Takeaways
- Your account number allows someone to set up automatic payments or one-time transfers from your account without your permission.
- Account numbers alone cannot be used to make debit card purchases, withdraw cash, or access your online banking.
- If you notice unauthorized payments, contact your bank when ready and ask them to reverse the transaction and investigate.
- You can stop recurring unauthorized payments by contacting your bank or the company collecting the payment and revoking authorization.
- Sharing your account number with trusted payees only — like your employer for direct deposit — reduces the risk of misuse.
What unauthorized payments look like
Unauthorized payments from your account usually appear as ACH transfers (Automated Clearing House transfers) or as checks written against your account. ACH transfers are electronic and process within one to three business days. You will see them on your statement as a debit with the name of the company or person who initiated the transfer.
Checks are slower but work the same way — someone writes a check against your account, and when it clears, the money leaves your account. In both cases, you will not see the transaction until it has already happened and appears on your statement or in your online banking.
How to stop an unauthorized payment
If you see a payment you did not authorize, call your bank when ready. Tell them the transaction is unauthorized and ask them to reverse it. Your bank can stop an ACH transfer within one business day of when it was initiated, though if it has already cleared, reversal takes longer.
For recurring unauthorized payments, you have two options. You can ask your bank to block future payments from that company or person, or you can contact the company directly and tell them to stop collecting from your account. Your bank can also issue you a new account number, which will stop all automatic payments — both authorized and unauthorized — so you will need to set up any legitimate recurring payments again with the new number.
Keep records of every call you make: the date, the time, the name of the person you spoke with, and what they told you they would do. If the bank does not reverse the transaction or stop the payments after you have asked, you can file a dispute with your bank's complaint department.
Your bank's responsibility for unauthorized payments
Banks are required by federal law to investigate unauthorized ACH transfers and reverse them if you report them within a certain timeframe. For ACH payments, you generally have up to 60 days from when the transaction appears on your statement to report it. If you report within that window, your bank must reverse the payment unless they can prove you authorized it.
The bank's burden is to show that you gave permission, not your burden to prove you did not. This is an important protection: if someone claims you authorized a payment and you did not, the bank has to investigate and decide who is telling the truth.
Why account numbers are shared safely in some situations
You will need to share your account number in legitimate situations: setting up direct deposit with your employer, paying bills online, or receiving payments from someone. In these cases, you are choosing to share the number with someone you trust, and you are expecting them to use it for a specific purpose.
The difference between safe and unsafe sharing is that you initiate the transaction and you know what it is for. When your employer sets up direct deposit, you are asking them to deposit your paycheck. When you set up a bill payment, you are telling your bank to send money to a specific company. You control the amount, the frequency, and the recipient.
Unsafe sharing happens when someone obtains your account number without your knowledge or uses it for a purpose you did not agree to. This can happen through a data breach, a phishing email, or someone you know misusing the number.
Protecting your account number
Treat your account number like you would treat a key to your house — do not leave it lying around, do not share it in emails or texts, and do not give it to someone unless you have a specific reason and you trust them.
When you need to share your account number, do it through a find channel: call the company directly using a phone number from their official website, or log into your online banking and set up the payment yourself. Do not share it through email, text, or social media, and do not give it to someone who calls you claiming to be from your bank.
Check your bank statements regularly — at least once a month — to catch unauthorized payments early. Many banks offer free alerts that notify you when a payment is made from your account, which can help you spot problems quickly.
What someone cannot do with just your account number
Your account number alone does not let someone make debit card purchases, withdraw cash from an ATM, or log into your online banking. They cannot order a new debit card in your name or change your account settings. These actions require additional information or access that your account number does not provide.
To make a debit card purchase, someone would need the physical card or the card number, expiration date, and CVV. To access your online banking, they would need your username and password. To withdraw cash, they would need your debit card and PIN, or they would need to go to a teller with a government ID matching your name.
Your account number is a piece of the puzzle, but not the whole picture. That said, it is still a piece worth protecting, because it is enough to move money out of your account without your permission.
Frequently Asked Questions
Can someone open a new account in my name using my account number?
No. Opening a new account requires a government ID, a Social Security number, and proof of address. Your account number alone cannot be used to open an account. However, if someone has your full name, address, and Social Security number, they could attempt to open a fraudulent account, which is a different crime called identity theft.
What if I gave my account number to someone and now I am worried?
Contact your bank and tell them you shared your account number with someone you no longer trust. Ask them to monitor your account for unauthorized activity and consider requesting a new account number. Watch your statements closely for the next few months. If you see unauthorized payments, report them when ready.
How long does it take to get my money back after reporting an unauthorized payment?
If your bank investigates and finds the payment was unauthorized, they must credit your account within one to three business days. If the payment has already cleared and left your account, the reversal process can take longer — sometimes up to 10 business days. Ask your bank for a specific timeline when you report it.
Can I be held responsible for an unauthorized ACH payment?
No, not if you report it within 60 days of when it appears on your statement. Federal law protects you from unauthorized ACH transfers. Your bank is responsible for investigating and reversing the payment if you did not authorize it. If you wait longer than 60 days, your protection may be limited, so report problems quickly.
Should I close my account if someone has my account number?
Not necessarily. Closing your account is disruptive — you will lose any automatic payments you have set up, and you will need to open a new account and update your direct deposit information. Instead, ask your bank to monitor your account and request a new account number if you are concerned. You can keep the old account open but inactive, or close it if you prefer a fresh start.