Yes, a check gives a criminal access to your account number and routing number, but not your password or PIN

A check is printed with your account number and your bank's routing number in machine-readable form at the bottom. Someone who has a check—or a photo of one—can use those numbers to set up unauthorized transfers, create fraudulent checks in your name, or open accounts that appear to be linked to yours. They cannot log into your online banking or withdraw cash at an ATM without your PIN. The damage depends on what they do with the information and how quickly you notice.

The real risk is not that they will forge your signature perfectly. It is that they will use your account details to move money out of your account through methods that do not require a signature at all—ACH transfers, bill pay, or creating counterfeit checks that they deposit into their own account.

Key Takeaways

  • A check exposes your account number and routing number, which is enough for someone to initiate transfers or create fake checks in your name.
  • The person does not need your password, PIN, or online banking login to cause damage—they only need those two numbers.
  • You are protected by federal law if you report unauthorized transactions within 60 days, but the window closes quickly.
  • Stopping the damage means calling your bank when ready, not waiting for a statement to arrive.
  • Checks left in unsecured places—mailboxes, trash, car glove compartments—are the most common source of account compromise.

What a criminal can do with your account and routing numbers

Once someone has your account number and routing number, they can initiate an ACH (Automated Clearing House) transfer from your account to theirs. ACH transfers do not require a signature and are processed by the banking system based on account details alone. They can also set up bill pay through your bank's system if they can guess or reset your password, or they can create counterfeit checks and deposit them into an account they control.

Creating counterfeit checks is slower but often more effective because it does not trigger the same fraud alerts as a direct transfer. A criminal prints checks with your account information, forges your signature, and deposits them at their own bank or a check-cashing service. Your bank does not discover the fraud until the check clears and the receiving bank requests the funds back—sometimes weeks later.

They can also use your account number to open new accounts at other banks, claiming to be you. This is less common but creates a longer-term problem because the fraudulent account may be used for other crimes.

How to know if someone has used your check information

The first sign is usually a transaction you do not recognize on your statement or a notice from your bank about a returned check. You might also see a decline on a check you actually wrote, which means a counterfeit check cleared before yours did. Some banks send alerts for large transfers or unusual activity, but not all do, and not all alerts arrive in time.

The problem is that you may not see your statement for weeks. If someone deposits a counterfeit check on the 5th of the month, your bank may not discover it until the 20th or later, and by then the criminal has already withdrawn the money from their account. Your bank will reverse the transaction, but the damage to your account is already done.

Check your account online at least weekly if you have written checks recently or if you know a check is in circulation. Do not wait for the paper statement. If you see a transaction you did not make, call your bank when ready—do not email or use the app.

Your legal protection if someone uses your account information

Federal law (Regulation E) protects you if you report unauthorized transfers within 60 days of the statement date on which the transaction appears. If you report within two business days, your liability is limited to $50. If you report between two and 60 days, your liability can be up to $500. If you wait longer than 60 days, you may be liable for the full amount.

This protection applies to ACH transfers and electronic transactions. Counterfeit checks are treated differently under the Uniform Commercial Code, and your protection depends on whether your bank or the receiving bank bears responsibility for the forgery. In most cases, the receiving bank is liable because they should have verified the signature, but this is not automatic—you may have to dispute it.

The key is the 60-day window. Once it closes, your bank has no obligation to reverse the transaction, even if you can prove it was fraudulent. Mark your calendar for 60 days after each statement date if you have written checks.

Steps to take if you suspect check fraud

Call your bank's fraud line when ready. Do not use the number on the back of your card if you are calling about a specific transaction—ask for the fraud department directly. Tell them which transaction is unauthorized and ask them to freeze your account pending investigation. They will issue you a new debit card and new checks.

Request a copy of the fraudulent check or transaction record. You will need this to file a dispute and to report the fraud to the police if the amount is large enough. Some banks will email this to you; others require you to visit a branch.

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and gives you a recovery plan. You do not need a police report to file with the FTC, but if the amount stolen is over $500, filing a police report strengthens your case with your bank.

Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) by calling one of them and asking them to notify the others. This makes it harder for someone to open new accounts in your name. The alert lasts one year and is free.

Where checks are most vulnerable to theft

Checks left in your mailbox—especially if the flag is up—are straightforward targets. A criminal can take the entire stack and have account numbers for multiple transactions. Checks in your car glove compartment, purse, or desk drawer are also common sources. Checks thrown in the trash without being shredded can be retrieved and used.

Checks mailed to a business or government agency are at lower risk because they are processed quickly, but they are still exposed while in transit. If you are mailing a check, drop it in a USPS mailbox rather than leaving it in your home mailbox for pickup.

The safest approach is to use online bill pay through your bank instead of mailing checks. If you must write checks, order them in small quantities and store them in a locked drawer. Shred checks you do not use.

How to reduce the risk of check-related fraud

Use checks only when necessary. For recurring bills, set up automatic payments through your bank's bill pay system or the company's website. For one-time payments, use a debit card, credit card, or ACH transfer if the recipient accepts it.

If you must write checks, use a pen that cannot be altered (gel pens work better than ballpoint). Write the amount in both numbers and words so it cannot be changed. Do not leave the payee line blank or use vague language like "cash" or "to the order of."

Monitor your account weekly, not monthly. Set up alerts through your bank's app for transactions over a certain amount—$100 or $200, depending on your spending. These alerts are not perfect, but they catch most fraud quickly.

Consider a separate checking account for bill pay with a lower balance. If it is compromised, the damage is limited. Keep your primary account for direct deposit and transfers only.

Frequently Asked Questions

Can someone open a bank account using just my account number and routing number?

Yes, though it is less common than using the information to create counterfeit checks or initiate transfers. They would need additional information like your name and address, which they may already have if they have a check. The new account would be fraudulent, but it could be used to receive stolen funds or commit other crimes in your name.

What if I discover the fraud after 60 days?

You lose the automatic protection under Regulation E, but you can still dispute the transaction. Contact your bank and explain the fraud. They may reverse it as a courtesy, especially if you have been a customer for a long time, but they are not required to. If the fraud involved a counterfeit check, the receiving bank may be liable instead of your bank.

Do I need to close my account if someone has my account number?

Not necessarily. Closing the account stops new fraud, but it does not undo existing fraud. Ask your bank whether closing or freezing the account is the better option. If you close it, make sure all pending transactions have cleared first, or they may bounce.

Will my bank refund the money while they investigate?

Most banks will provisionally credit your account within one to three business days while they investigate, but this is not may provide. Ask your bank about their provisional credit policy when you report the fraud. The investigation itself usually takes 10 business days.

Can I be held responsible if someone forges my signature on a check?

Your bank is responsible for verifying the signature on checks presented for payment. However, if your signature is very similar to the forged one, or if you were negligent in protecting your checks, your bank may argue you share responsibility. This is rare, but it is why storing checks securely matters.