Yes, scammers can cause real damage with just your account number, but not in the way most people fear

A scammer with your bank account number can set up unauthorized transfers out of your account, create fake checks in your name, or convince your bank to change your contact information so you don't notice fraud happening. They cannot log into your online banking or drain your account when ready—that requires your password or PIN. But they can cause enough trouble that you need to act fast once you realize your number is compromised.

The risk depends partly on what else they have. Your account number alone is less dangerous than your account number plus your routing number, which is less dangerous than both plus your name and address. A scammer with all four pieces can impersonate you to your bank in ways that are harder to reverse than a straightforward unauthorized transaction.

Key Takeaways

  • Scammers can set up ACH transfers (electronic money movements) out of your account using just your account number and routing number, which they can find from a check or bank statement.
  • Your bank is required to reverse unauthorized ACH transfers if you report them within a specific window—usually 60 days—but the process takes time and you may be without that money temporarily.
  • Scammers can also use your account number to create counterfeit checks or to call your bank pretending to be you and request a new debit card or change your phone number on file.
  • Freezing your credit does not stop ACH fraud, but contacting your bank when ready and filing a dispute does; the sooner you report it, the stronger your case.
  • If you gave your account number to someone you now distrust, contact your bank the same day rather than waiting to see if fraud occurs.

What scammers can do with your account number

ACH transfers are the most common attack. ACH stands for Automated Clearing House—it is the system banks use to move money electronically between accounts. A scammer with your account number, routing number, and name can initiate an ACH transfer out of your account without your password. Your bank processes it, the money leaves, and you may not notice for days. This is why ACH fraud is the leading type of bank account fraud reported to the Federal Trade Commission.

Counterfeit checks are another route. If a scammer has your account number, they can print fake checks using that number and deposit them into their own account or use them to pay for things. The checks will bounce once the bank catches on, but by then the scammer has already received goods or services. You may face overdraft fees or a negative balance while the bank investigates.

Account takeover attempts happen when a scammer calls your bank pretending to be you. They may request a replacement debit card be mailed to a new address, ask the bank to change your phone number on file, or request a password reset. If they succeed, they can lock you out of your own account while they move money or change settings. This is harder to pull off than ACH fraud because banks ask security questions, but it happens when scammers have additional information like your Social Security number or mother's maiden name.

How your account number gets to scammers in the first place

Your account number appears on every check you write, so anyone who handles your checks—mail carriers, store employees, people you pay in person—can see it. It also appears on bank statements, which can be stolen from your mailbox or found in trash. Some scammers buy lists of account numbers from data breaches or from people who work in banking, retail, or healthcare.

You may also give it out yourself without realizing the risk. Paying a bill by phone, setting up a direct deposit, or authorizing a one-time payment to a business all require your account number. If you give it to a business that turns out to be a scam, or if a legitimate business gets hacked, your number is now in the wrong hands.

The routing number—which identifies your specific bank—is public information printed on every check and available online. So if a scammer has your account number, they likely have or can easily find your routing number too.

What happens if you report it quickly

If you notice an unauthorized ACH transfer and report it to your bank within 60 days, the bank is required by federal law (Regulation E) to investigate and reverse the transfer. You will not lose money permanently, though the reversal can take 10 business days or longer. During that time, the money is gone from your account, so you may face overdraft fees if you do not have a buffer.

Report the fraud in writing as well as by phone. Call your bank's fraud line when ready, but follow up with a written dispute letter that includes the date of the unauthorized transfer, the amount, and the date you discovered it. Keep a copy. This creates a paper trail that protects you if the bank initially denies your claim.

If you reported it after 60 days, your protection is weaker. The bank may still reverse it, but they are not legally required to. This is why speed matters—the moment you realize your account number is compromised or you see a transaction you did not authorize, contact your bank.

Steps to take if your account number is compromised

Contact your bank when ready. Call the number on the back of your debit card or on your most recent statement—not a number you find online, which could be fake. Tell them your account number may be compromised and ask them to watch for suspicious activity. Some banks will flag your account for extra monitoring or issue you a new account number and debit card.

Check your recent transactions. Review your bank statement and online banking history for the past 30 to 60 days. Look for ACH transfers you did not authorize, checks you did not write, or debit card charges you do not recognize. Write down the date, amount, and description of anything suspicious.

File a dispute for any unauthorized transactions. Do this in writing through your bank's dispute process. Include the transaction details and a statement that you did not authorize it. Keep copies of everything you send.

Monitor your account for the next 90 days. Scammers sometimes wait weeks before using a compromised account number, hoping you will not connect the fraud to the original compromise. Check your account at least weekly.

Do not close the account when ready. You might think closing the account stops the fraud, but it can actually make disputes harder to file. Keep the account open while you work with the bank to resolve the fraud, then close it once everything is resolved and you have a new account number.

Why freezing your credit does not stop this type of fraud

A credit freeze prevents someone from opening new credit accounts in your name, which is useful against identity theft. But ACH fraud and counterfeit checks do not require opening new credit. They use your existing bank account. So freezing your credit will not stop a scammer who already has your account number from moving money out of your account.

What does help is monitoring your bank account closely and setting up account alerts. Many banks let you set a threshold—for example, alert me if any single transaction exceeds $500—so you catch fraud faster. Some banks also offer zero-liability protection for unauthorized debit card transactions, though ACH transfers are sometimes treated differently. Ask your bank what alerts and protections are available on your specific account.

What you cannot do, and what you can

You cannot prevent a scammer from attempting an ACH transfer if they have your account and routing numbers. You also cannot force your bank to reverse fraud when ready—the process takes time by law. What you can do is report it as soon as you notice it, which gives you the strongest legal protection and the best chance of getting your money back.

You can also reduce the risk going forward by being selective about who you give your account number to. If a business asks for it over the phone and you did not initiate the call, hang up and call the business back using a number you know is legitimate. If you pay bills online, use your bank's bill pay service rather than giving your account number directly to the business. If you write checks, do not leave them in your mailbox for the postal carrier to pick up—take them to the post office or bank yourself.

Frequently Asked Questions

Can a scammer withdraw cash from an ATM with just my account number?

No. An ATM withdrawal requires a debit card and PIN. A scammer with only your account number cannot access an ATM. However, they can request a replacement debit card be mailed to a different address if they also have enough personal information to pass your bank's security questions, or they can use your account number to set up an ACH transfer to move money to their own account.

If I give my account number to pay a bill, am I at risk?

You are at some risk, but it is manageable. Legitimate businesses that collect account numbers for bill payments are required to follow security standards. The real risk is if you give your account number to a business that turns out to be a scam, or if a legitimate business gets hacked. To reduce risk, use your bank's bill pay service when possible, or pay by credit card instead of bank account. If you must give your account number, do it only to businesses you have verified are real.

How long does it take to get my money back after I report unauthorized ACH transfers?

The bank must investigate within 10 business days and resolve the dispute within 45 days, though many resolve faster. During the investigation, the money may remain out of your account. Once the bank confirms the transfer was unauthorized, they will reverse it, but you may see a delay of several business days before the money reappears. Ask your bank for a timeline specific to your case.

Should I open a new bank account if my account number is compromised?

Not necessarily right away. Keep your current account open while you dispute any fraudulent transactions, because closing it can complicate the dispute process. Once the fraud is resolved and you have confirmed no new unauthorized transactions in 30 to 60 days, you can close the old account and move to a new one. Ask your bank to issue you a new account number in the meantime if they offer that option.

What if the scammer used my account number to write counterfeit checks?

Contact your bank and report the counterfeit checks. The bank will investigate and reverse any deposits made from those checks. You may also want to contact the businesses or people who received the counterfeit checks and let them know they are fraudulent. If the checks were used to commit a crime, you can file a police report, though police response to check fraud varies by jurisdiction.