What a bank account number alone can and cannot do
A bank account number by itself—without your routing number—cannot move money out of your account. It also cannot open new accounts, explore for credit, or change your account settings. What it can do is narrower and less dramatic than most people fear, but worth understanding because the risk depends on what else someone has.
Your account number is one piece of information. On its own, it is like having someone's street address but not their name—useful only if you already know who you are looking for. The real danger arrives when someone combines your account number with your routing number, your name, or other identifying details. That combination is what enables actual harm.
Key Takeaways
- An account number alone cannot initiate transfers or withdrawals because banks need your routing number to know which bank to contact.
- Someone with your account number and routing number together can set up ACH transfers from your account, which is the primary risk.
- Your name paired with your account number creates enough information for someone to attempt fraudulent ACH payments or direct deposits in your name.
- Checks, payment apps, and online bill pay all require additional verification steps that make account number alone insufficient for most transactions.
- If you discover unauthorized activity, contact your bank when ready and file a dispute; federal law limits your liability if you report within 60 days.
Why routing number matters more than account number
Banks use your routing number to identify which institution holds your account. Without it, someone with only your account number cannot tell your bank to do anything—they do not know which bank to contact. This is why your routing number is printed on every check alongside your account number, and why both are needed for legitimate transfers.
A fraudster with your account number but no routing number could theoretically guess your bank if you have mentioned it in conversation, or they could try common routing numbers for large banks. But this is inefficient and unlikely. The real vulnerability opens when someone has both pieces, or when they have your account number plus your name.
ACH transfers: the main risk with your account number
ACH (Automated Clearing House) transfers are the mechanism that moves money between accounts electronically. If someone has your account number, routing number, and name, they can attempt to initiate an ACH transfer from your account to theirs. This is the most common form of fraud involving bank account numbers.
The ACH system does not require a password or PIN to initiate a transfer from your account. It relies on the originating bank to verify that the person requesting the transfer has authority to do so. If a fraudster submits an ACH debit request with your account number, routing number, and name, your bank may process it if their verification procedures are weak or if the request appears to come from a legitimate business.
Your bank is required to investigate disputes within a specific timeframe. If you report the unauthorized transfer within 60 days of the statement date, federal law (Regulation E) limits your liability to $50, and many banks waive even that. If you wait longer than 60 days, your liability can be much higher.
What checks and payment apps require
Writing a check requires your account number and routing number, but also requires a physical check with your name and address printed on it. Someone with only your account number cannot write a check in your name without also having access to your checks or the ability to print them.
Payment apps like Venmo, PayPal, and Cash App do not work with account numbers directly. They require you to log into your account or to authorize a connection between the app and your bank. An account number alone cannot initiate a payment through these platforms.
Online bill pay through your bank's website also requires login credentials. Your account number is part of the information your bank uses to identify you, but it is not sufficient to access your account or authorize payments without a password.
Direct deposit and fraudulent deposits in your name
Someone with your account number and routing number can attempt to set up a direct deposit in your name—for example, by claiming to be your employer and submitting a direct deposit authorization form to their own payroll processor. The fraudster would then have that processor send money to your account, which they would withdraw when ready.
This is less common than ACH debit fraud because it requires the fraudster to have access to a payroll system or to convince a business to process a fraudulent direct deposit. But it is possible, and it is why some people monitor their accounts for unexpected deposits.
If you see a deposit you did not authorize, do not withdraw it. Contact your bank and report it as potentially fraudulent. The originating employer or processor may reverse it, and if you spend the money before that happens, you could be liable for the reversal.
Information that makes account number more dangerous
Your account number becomes a real risk when combined with other details. The most dangerous combination is account number plus routing number plus your name—this is enough for ACH fraud. Your Social Security number paired with your account number is also dangerous because it can be used to verify your identity in phone calls or online interactions.
Your account number plus your email address or phone number allows someone to attempt account recovery if your password is weak or if they can intercept a password reset link. Your account number plus your address allows someone to order checks in your name.
The least dangerous scenario is your account number alone, with no other identifying information. In that case, a fraudster would need to either guess your routing number and name, or find another way to connect the account number to you.
Steps to take if your account number is compromised
If you believe your account number has been shared with someone who may misuse it, contact your bank when ready. You do not need to wait for fraudulent activity to appear. Your bank can flag your account for monitoring, can place a fraud alert, or in some cases can issue you a new account number.
Review your statements weekly for the next several months. Look for small test charges (fraudsters often make a small transaction first to confirm the account works), ACH debits you do not recognize, or unexpected deposits. If you see anything suspicious, report it to your bank within 60 days.
If unauthorized transactions do appear, file a dispute with your bank in writing. Keep copies of all correspondence. Your bank is required to investigate and to provide you with a written explanation of their findings. If they determine the transaction was unauthorized, they must reverse it and restore your funds.
Frequently Asked Questions
Can someone open a credit card with just my account number?
No. Opening a credit card requires a full process with your name, address, Social Security number, and income information. Your account number alone is not enough. However, if someone has your account number along with other personal information, they could potentially use it as part of a larger identity theft.
What if I gave my account number to a legitimate business and they misused it?
Contact your bank and report the unauthorized transaction as a dispute. If the business was supposed to charge you a specific amount and charged more, or charged you after you cancelled, your bank can investigate. You have 60 days from the statement date to report it and receive protection under federal law.
Is my account number visible to other people when I use online banking?
No. When you log into your bank's website or app, the connection is encrypted. Other people on the same Wi-Fi network cannot see your account number. However, if your device is compromised by malware, someone with access to your device could see it.
Do I need to change my account number if someone got it?
Not necessarily. If your account number alone was compromised and you have no reason to believe the person has your routing number or other identifying information, monitoring your account is usually sufficient. If your account number was compromised along with your routing number or name, ask your bank whether they recommend a new account number.
What is the difference between my liability for debit card fraud and ACH fraud?
Debit card fraud (someone uses your card number) is limited to $50 if you report it within 60 days. ACH fraud (unauthorized transfers from your account) is also limited to $50 under federal law if you report within 60 days. However, if you wait longer than 60 days, your liability for ACH fraud can be much higher, sometimes the full amount of the unauthorized transfer.