Yes, but not as much as you might think
A scammer with only your bank account number and routing number can set up automatic withdrawals from your account without your permission. They cannot log into your online banking, change your password, or see your balance. What they can do is initiate an ACH transfer (the system banks use to move money between accounts) or set up a recurring debit, which is why your account number alone is genuinely risky—but in a specific, limited way.
The real danger is not that they have unlimited access to your money. The danger is that they can pull money out faster than you can stop them, and the burden of proving the withdrawal was unauthorized falls on you at first.
Key Takeaways
- Someone with your account and routing number can initiate ACH transfers or recurring debits from your account without your permission.
- They cannot access your online banking, see your balance, or change your account settings with just these numbers.
- Your bank is required to investigate unauthorized withdrawals, but you may have to dispute the charge first and wait for a refund.
- The fastest way to stop unauthorized activity is to call your bank directly and request a new account number, not to wait for the dispute process.
- Sharing your full account number with unknown people or unverified websites is the main way this happens—not from data breaches alone.
What an ACH transfer actually requires
An ACH (Automated Clearing House) transfer is how most bill payments and direct deposits move between accounts. To initiate one, a scammer needs your account number, routing number, and your name. They do not need your password, your PIN, or access to your online banking.
The system assumes that if someone has these three pieces of information, they have permission to move money. Banks verify the account exists and the routing number is real, but they do not verify that the person requesting the transfer is actually you. This is by design—the system was built for speed and volume, not for stopping fraud at the entry point.
A scammer can use this to pull money out in a single transfer or set up a recurring withdrawal that repeats weekly or monthly. The withdrawal will show up in your account as a debit, usually with a vague description like "ACH DEBIT" or a business name you do not recognize.
Why your bank account number is on checks and invoices
Your account number and routing number appear on every check you write. They are also printed on bank statements, invoices you send to customers, and direct deposit forms. This is why these numbers are not considered secret in the way a password is—they are designed to be shared with employers, creditors, and businesses you pay.
The assumption built into the system is that you control who receives these numbers. You give them to your employer for direct deposit. You give them to your utility company to set up automatic bill pay. You write them on checks to people you trust. The system breaks down when you give them to someone you should not have trusted, or when a business you trusted has a data breach.
This is also why your bank will ask you, during a fraud investigation, whether you authorized the business or person who initiated the transfer. If you did—even if you later regretted it—the bank may not refund the money.
What happens when you report an unauthorized withdrawal
Call your bank as soon as you notice a withdrawal you did not authorize. Do not wait for a statement to arrive. Most banks have a fraud line that operates 24 hours, and the sooner you report it, the sooner they can investigate and potentially stop a recurring withdrawal before the next one hits.
Your bank is required by federal law (Regulation E) to investigate the claim within 10 business days. During that time, they will contact the business or person who initiated the withdrawal and ask whether you authorized it. If the business cannot prove you did, the bank must refund your money—usually within 5 to 10 business days after the investigation closes.
While the investigation is happening, the money is still out of your account. Some banks will issue a provisional credit (a temporary refund) while they investigate, but this is not may provide. Ask your bank whether they offer provisional credits and how long they take to process.
Stopping the withdrawal and preventing the next one
If the withdrawal is recurring, ask your bank to revoke the authorization when ready. This stops future withdrawals from the same source. Your bank can do this while the investigation is still open.
The fastest way to protect yourself is to request a new account number. Your bank can issue a new number the same day you call, and your old account number will no longer work for ACH transfers. This is more effective than disputing individual charges because it stops the scammer from pulling money again. Your employer, utility companies, and anyone else with your old account number will need to be updated, but this is a one-time inconvenience.
If the scammer is still actively pulling money and your bank is slow to investigate, a new account number is the nuclear option that actually works. Ask whether there is a fee—most banks do not charge for a new number when fraud is involved.
How scammers get your account number in the first place
The most common routes are: you gave it to them (a fake invoice, a fake job offer, a romance scam where they ask for your banking details); a business you use had a data breach; or you wrote a check to someone who photographed it or kept a copy.
Data breaches at retailers, healthcare providers, and other businesses do expose account numbers, but these breaches are usually discovered and reported. Your bank monitors for unusual activity on your account and can flag suspicious transfers. The real vulnerability is when you voluntarily hand over your account number to someone you have not verified.
Scammers often pose as employers, landlords, or loan officers and ask for your account number to "verify your identity" or "process a payment." They may send a fake invoice or a fake job offer that includes a request for banking details. If you did not initiate contact with this person, and you cannot verify they work for the organization they claim to represent, do not give them your account number.
What your bank account number alone cannot do
A scammer with your account number cannot log into your online banking account. They cannot see your balance, your transaction history, or your personal information. They cannot change your password, add a new authorized user, or link a new external account to yours. They cannot explore for a credit card or loan in your name using just this number.
To do any of those things, they would need additional information: your online banking password, answers to your security questions, your Social Security number, or access to your email or phone number. Account number alone is a limited but real threat—not a total compromise of your financial identity.
Frequently Asked Questions
Can someone withdraw cash from an ATM with just my account number?
No. An ATM requires a debit card and a PIN. Your account number alone cannot be used at an ATM. However, a scammer could use your account number to set up an online transfer to their own account, and then withdraw the money as cash.
Is my bank responsible if someone steals money using my account number?
Your bank is required to investigate and refund unauthorized ACH transfers under federal law. However, if you authorized the transfer (even if you later regretted it or were tricked), the bank may not refund it. The investigation determines whether you authorized it.
Should I close my account if my number was in a data breach?
Not necessarily. A data breach exposes your number, but it does not automatically mean money will be stolen. Monitor your account for unauthorized withdrawals. If you see suspicious activity, report it when ready and request a new account number. Closing the account is an option if the fraud is ongoing and your bank cannot stop it.
What if the scammer is in another country?
Report the fraud to your bank and to the Federal Trade Commission at reportfraud.ftc.gov. Your bank will still investigate and refund the money if the transfer was unauthorized. Recovering money from a scammer in another country is difficult, but your bank's job is to protect your account, not to pursue the scammer.
Can I be scammed if I only give out my routing number, not my account number?
A routing number alone is not enough to pull money from your account. A scammer needs both the routing number and the account number. However, routing numbers are public information (they are tied to specific banks), so there is no harm in sharing one if you need to.