A bank account number alone is not enough to drain your account, but you should still act

Someone having your account number does not automatically mean they can withdraw money. A bank account number is one piece of information; to move money out, a person typically needs either your routing number paired with your account number, your debit card details, or direct access to your online banking login. That said, the risk is real enough that you should treat it as a security incident and move through the steps below in order.

The first thing to do is call your bank's fraud line directly—use the number on the back of your debit card or on your bank statement, not a number you search for online. Tell them someone may have your account number and ask them to flag your account for suspicious activity. Many banks will place a temporary hold on transfers or unusual transactions while you sort this out. Then change your online banking password when ready, from a different device if possible, and enable two-factor authentication if your bank offers it.

Key Takeaways

  • An account number alone cannot be used to withdraw money, but paired with a routing number it can be used to set up unauthorized transfers or payments.
  • Call your bank's fraud line using the number on your card or statement, not a number from a search result, and ask them to monitor your account.
  • Change your online banking password and enable two-factor authentication on the same day you discover the breach.
  • Check your account for unauthorized transactions daily for at least two weeks, and report anything suspicious to your bank when ready.
  • If unauthorized transfers do occur, your bank is required to investigate and typically refunds the money while the investigation runs.

How someone might use your account number if they also have your routing number

Your routing number and account number together form the information printed on the bottom left of your checks. If someone has both, they can attempt to set up an ACH transfer (an electronic bank-to-bank transfer) out of your account, or they can try to create a bill payment through your bank's bill pay system if they also have access to your online login. They can also use the pair to set up a recurring payment or subscription in your name.

The key word is "attempt." Your bank has fraud detection systems in place. Most banks will flag a transfer request that looks unusual—a large amount, a transfer to a new account, or a transfer at an odd time of day. If the transfer does go through, you have protections under federal law. The Electronic Funds Transfer Act requires your bank to investigate unauthorized transfers and return the money to you while the investigation is underway, as long as you report it within 60 days of the statement date on which the unauthorized transfer appears.

Steps to take right now

Step 1: Call your bank's fraud department. Use the number on your debit card or a recent statement. Do not use a number from a search result. Tell them your account number may be compromised and ask them to place a fraud alert on your account. This is free and takes a few minutes. Ask them specifically whether they see any pending transfers, bill payments, or subscription sign-ups that you did not authorize.

Step 2: Change your online banking password. Do this from a computer or phone you trust, not a shared device. Make the password at least 12 characters long and use a mix of uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used elsewhere. If you use the same password for your email, change that too—your email is the master key to resetting passwords on other accounts.

Step 3: Enable two-factor authentication. Log into your bank's website and look for security settings or account settings. Most banks now offer two-factor authentication, which means anyone trying to log in will need both your password and a code sent to your phone or generated by an authenticator app. This stops someone from accessing your account even if they have your password.

Step 4: Check your account daily for two weeks. Log in to your online banking and review recent transactions. Look for transfers you do not recognize, bill payments you did not set up, or pending transactions. If you see anything suspicious, call your bank's fraud line when ready and report it. Do not wait for the transaction to post.

What happens if unauthorized transfers actually occur

If money does leave your account without your permission, your bank is required by the Electronic Funds Transfer Act to investigate the transaction and return your money while the investigation runs. You do not have to wait for the investigation to finish to get your money back—most banks credit your account within one to three business days of your report, pending the outcome of their investigation.

To start the process, call your bank's fraud line and report the unauthorized transfer. They will ask you to describe the transaction, confirm that you did not authorize it, and provide any details you have about where the money went. They will also ask you to confirm your password and recent login activity to rule out the possibility that someone accessed your account directly. Write down the name of the person you spoke to, the date and time of the call, and any reference number they give you.

The bank will then send you a written notice of their investigation within 10 business days. The investigation itself can take up to 45 days, though most are resolved faster. If the bank determines the transfer was unauthorized, they will return the full amount. If they determine you authorized it or if the money went to another account you own, they will tell you why and what your options are.

How to know if your account number came from a data breach

If you learned that someone has your account number because of a data breach at a company you do business with—a retailer, a healthcare provider, a utility company—check whether that company has posted a breach notice on their website or sent you a letter. The notice should tell you what information was exposed, when the breach occurred, and what steps the company is taking to prevent future breaches.

You can also check whether your information appears in known breaches by visiting Have I Been Pwned (haveibeenpwned.com), a free service that aggregates publicly disclosed data breaches. Enter your email address and the site will tell you which breaches your email appears in. This does not tell you specifically what information was exposed, but it tells you whether to expect breach notifications.

If your account number was exposed in a breach, the company may offer free credit monitoring or identity theft protection for a set period. Read the offer carefully—some are genuinely useful, others are marketing. At minimum, you should monitor your credit reports for accounts opened in your name. You can request a free credit report from each of the three major bureaus (Equifax, Experian, and TransUnion) once per year at annualcreditreport.com.

Whether to close the account or keep it open

You do not have to close your account if your account number is compromised. Closing the account can actually create problems—any automatic payments or direct deposits tied to that account will fail, and you will have to update them with your new account number. If you do decide to close it, do so only after you have set up a new account and updated all your automatic payments and direct deposits.

The better approach is to keep the account open, monitor it closely for the next 30 days, and let your bank's fraud detection systems do their job. If no unauthorized activity appears within 30 days, the risk has likely passed. If you are genuinely concerned about the account or if unauthorized activity does occur, you can close it then and move your money to a new account.

Protecting your account number going forward

Your account number is printed on every check you write and appears on your bank statements. Treat both as sensitive documents. Shred old statements and canceled checks rather than throwing them in the trash. Do not write your account number on envelopes or in emails. If a company asks for your account number over the phone, verify that you called them—do not use a phone number they provided, because that number might belong to a scammer.

Be cautious about where you enter your account number online. Only enter it on websites that use HTTPS (you will see a lock icon in the address bar) and that you trust. Do not enter your account number into a link sent to you in an email or text message, even if the message appears to come from your bank. Scammers often send fake emails that look like they come from banks, asking you to "verify" your account information. Your bank will never ask you to verify sensitive information via email or text.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

No. Opening a new account requires a government-issued ID, proof of address, and a Social Security number. An account number alone is not enough. However, someone with your account number and routing number could potentially set up unauthorized transfers or bill payments from your existing account.

What if I gave my account number to a company I thought was legitimate and now I think it was a scam?

Call your bank's fraud line when ready and describe what happened. Tell them the name of the company, when you gave them the information, and what they said they would do with it. Your bank can monitor your account for suspicious activity and may be able to block transfers to specific accounts if the scammer tries to move money.

How long does a bank investigation into unauthorized transfers take?

Most investigations take two to four weeks, though the law allows up to 45 days. Your bank must return your money within one to three business days of your report, pending the outcome of the investigation. You do not have to wait for the investigation to finish to get your money back.

If my account number was in a data breach, do I need to close my account?

Not necessarily. A data breach of your account number alone is lower risk than a breach that includes your password or debit card number. Monitor your account closely for 30 days, and close it only if unauthorized activity appears or if you feel genuinely unsafe keeping it open.

Should I put a fraud alert on my credit report if someone has my account number?

A fraud alert on your credit report is useful if you are concerned about someone opening new accounts in your name, but it does not protect your existing bank account. You can place a free fraud alert by calling any of the three credit bureaus (Equifax, Experian, or TransUnion). The alert lasts one year and tells creditors to verify your identity before opening new accounts.