Yes, someone can use a check to access your bank account — but not in the way most people think

A hacker cannot straightforward steal a blank check and drain your account. But they can use a check you've written, a check made out to you, or information from a check to commit fraud that empties your account or opens new accounts in your name. The risk comes from the information printed on your check — your name, account number, routing number, and signature — not from the check itself being "hacked" in a digital sense.

The most common attack is check washing: someone intercepts a check you've mailed, uses chemicals to erase the payee name and amount, then rewrites it to themselves for a larger sum. Your bank may pay it if the signature looks close enough. Another route is account takeover: a criminal uses your routing and account number (both visible on every check) to set up unauthorized transfers or open new accounts.

Key Takeaways

  • Check washing — erasing and rewriting a mailed check — is the most common check-related fraud, and your bank may cover the loss if you report it quickly.
  • Your routing number and account number are printed on every check and can be used to set up wire transfers or ACH payments without your permission.
  • Mailing checks is riskier than paying online because mail theft is easier to execute than digital hacking, and mail delays mean you won't notice fraud for days or weeks.
  • If you notice unauthorized transactions tied to a check, contact your bank when ready and file a dispute; federal law limits your liability if you report within 60 days.
  • Stopping payment on a check costs money but prevents it from clearing if you suspect it's been compromised before it reaches the bank.

How check washing works and why banks sometimes pay it

Check washing is straightforward and requires no digital skill. A criminal intercepts a check from your mailbox or a postal worker's bag, uses acetone or another solvent to remove the ink, and rewrites the payee name and amount. If your signature is hard to forge, they may leave it alone — many bank tellers don't compare signatures closely, especially on smaller checks.

Your bank may pay a washed check because the signature appears to match and the check passes basic fraud filters. You won't know it happened until your statement arrives or you check your account online. By then the money is gone and the criminal has cashed it or deposited it into an account they control.

If you report the fraud within 60 days of your statement, federal law (Regulation E) requires your bank to investigate and refund you. But if you wait longer, the bank can deny your claim. This is why monitoring your account weekly matters — the faster you report, the faster you get your money back.

Using your routing and account number to drain your account

Every check you write displays your routing number (which identifies your bank) and account number (which identifies you within that bank). A criminal who has these numbers can set up ACH transfers — electronic payments that pull money directly from your account — without ever touching a physical check.

They can also authorize bill payments in your name, set up recurring transfers to accounts they control, or use the numbers to open a new account at a different bank and transfer your funds there. None of this requires your password or online login. The routing and account number alone are enough.

This is why you should never write checks to strangers, never leave blank checks in your car or bag, and never throw away old checks without shredding them. If you suspect someone has your routing and account number, contact your bank when ready. They can flag your account, watch for suspicious activity, and in some cases issue you a new account number.

Why mailed checks are a bigger risk than online payments

Mail theft is common and straightforward. A criminal can watch a mailbox, steal outgoing mail, or intercept mail at a postal facility. Once they have your check, they have time to work — mail takes days to arrive, and you won't notice the fraud until you reconcile your account or review your statement.

Online payments and bank transfers, by contrast, are encrypted and require authentication (usually a password or two-factor code). A hacker would need to break into your online banking account, which is harder than stealing mail. And if they do, your bank's fraud detection systems are more likely to catch unusual activity because it happens when ready and from an unfamiliar device or location.

This doesn't mean online payments are risk-free — they're not. But statistically, mailing a check exposes you to more fraud risk than paying through your bank's website or app.

What to do if you think a check has been compromised

If you suspect a check you've written has been stolen, lost, or intercepted, contact your bank and ask to stop payment on that check. This tells the bank to reject it if it arrives for deposit. You'll usually pay a fee (typically $25 to $35) for each check, but it prevents the check from clearing.

Stop payment works only if you request it before the check is deposited. Once it's been cashed, stopping payment won't help. You'll need to file a dispute instead, which takes longer but may still result in a refund if you report it within 60 days.

If you notice unauthorized transactions on your account that you believe are tied to a check, report them to your bank when ready. Write down the date you noticed the fraud, the amount, and which check (if you know) was compromised. Your bank will investigate and, if the fraud is confirmed, refund you under federal law.

Protecting yourself when you do use checks

If you must write checks, follow these steps to reduce risk. Mail checks from a post office mailbox rather than your home mailbox — postal workers collect from find boxes, not from curbside boxes that anyone can open. Never leave blank checks in your car, bag, or anywhere accessible. Shred old checks and statements instead of throwing them away.

Use checks only for payments you trust — utility companies, landlords, established businesses. Never write a check to someone you've just met or to a business you haven't verified. If someone asks you to mail a check to an unusual address or to a person's name rather than a business name, that's a red flag.

Monitor your account at least weekly, either through your bank's app or website. The sooner you spot fraud, the sooner you can report it and the more likely you are to get your money back. Set up account alerts if your bank offers them — many will notify you by text or email when a large transaction occurs.

When your bank won't refund check fraud

Your bank may deny a refund if you wait more than 60 days to report the fraud. They may also deny it if they can prove you were negligent — for example, if you left blank checks lying around or gave your account number to someone you didn't know.

If your bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. You can also dispute the transaction with your credit card company if you paid the check with a credit card (though this is rare). Consulting a lawyer may be necessary if the amount is large, but many banks will reconsider if you push back with documentation.

Frequently Asked Questions

Can someone use just my routing number and account number to steal money?

Yes. With those two numbers, someone can set up ACH transfers, bill payments, or even open a new account in your name. You don't need to give them your password or sign anything. This is why you should treat your routing and account number as sensitive information, even though they're printed on every check you write.

What's the difference between check washing and check fraud?

Check washing is one type of check fraud. It specifically means erasing and rewriting a check. Check fraud is a broader term that includes any illegal use of a check — forging a signature, depositing a check twice, writing a check on a closed account, or using someone else's check without permission.

If my check is stolen from the mail, is the bank responsible?

Not automatically. But if you report the fraud within 60 days of your statement, federal law requires the bank to investigate and refund you if the fraud is confirmed. If you wait longer than 60 days, the bank can deny your claim. This is why monitoring your account regularly is critical.

Should I stop using checks altogether?

If you can pay online or with a debit card instead, that's generally safer. But checks are sometimes necessary — for rent, security deposits, or payments to people who don't accept digital payments. If you do use checks, mail them from a post office, monitor your account weekly, and use stop payment if you suspect a check has been compromised.

Can I get my money back if the check was cashed weeks ago?

You can still file a dispute with your bank, but you have 60 days from the date your statement was issued to report it. If you're within that window, your bank must investigate. If you're outside it, the bank can refuse — though some banks will make exceptions if you have a good history with them.