Yes, scammers can cause real damage with just your account number

A scammer with your bank account number can set up unauthorized withdrawals, create fake checks in your name, or trick your bank into sending money out. They cannot drain your account when ready or steal your identity with the number alone — but they can cause enough trouble that you need to act fast once you realize it happened. The damage depends on what else they have: your routing number, your name, your Social Security number, or your trust that they are legitimate.

The risk is real enough that you should treat your account number like a password. But it is also not the same as handing someone your debit card or your online banking login. Understanding what is actually possible helps you know what to watch for and what steps to take.

Key Takeaways

  • Scammers can set up automatic withdrawals or create counterfeit checks using your account number and routing number together.
  • Your bank account number alone cannot be used to drain your account when ready, but combined with other information it becomes much more dangerous.
  • If you suspect unauthorized activity, contact your bank when ready — federal law limits your liability if you report within two business days.
  • The fastest way to stop ongoing fraud is to close the compromised account and open a new one, rather than waiting for the bank to investigate.
  • Scammers often get your account number through phishing emails, fake payment requests, or by posing as a business collecting a payment.

How scammers use your account number to pull money out

The most common attack is called an ACH debit — ACH stands for Automated Clearing House, the system that moves money between bank accounts electronically. A scammer with your account number and routing number can submit a request to their own bank to pull money directly from your account. Your bank will process it unless you have set up a block, because the system assumes the request is legitimate.

The second method is check fraud. A scammer can print counterfeit checks using your account number and routing number, then cash them or deposit them into their own account. This takes longer to discover because checks move slowly through the banking system, but by the time your bank catches it, the money is often gone.

A third, less common method is phone-based fraud, where a scammer calls your bank posing as you and requests a wire transfer or a change to your account. This requires them to know more than just your account number — they need your name, address, and often the last four digits of your Social Security number — but it happens frequently enough that banks now require additional verification.

What scammers cannot do with your account number alone

Your account number by itself does not give a scammer access to your online banking login or your debit card. They cannot log into your account, change your password, or see your balance. They cannot use it to make purchases at a store or online. Those actions require either your debit card itself or your online banking credentials, which are different from your account number.

A scammer also cannot steal your identity with your account number alone. Identity theft requires your Social Security number, date of birth, and often your driver's license number or other government ID. Your account number is one piece of a larger puzzle, but it is not the whole picture.

This distinction matters because it tells you what to watch for. If someone has only your account number, the damage will show up as unexpected withdrawals or checks you did not write. It will not show up as fraudulent credit card charges or new accounts opened in your name.

Where scammers get your account number

Phishing emails are the most common source. A scammer sends an email that looks like it is from your bank, PayPal, a utility company, or another business you trust. The email says your account is locked, a payment failed, or you need to verify information. The link takes you to a fake website that looks identical to the real one, and when you enter your account number, the scammer captures it.

Payment requests are another common vector. A scammer poses as a landlord, a contractor, or a business you owe money to and asks you to pay by bank transfer. They provide their own account number, but in the process they may ask for yours — or they may already have it from a data breach at a company where you have done business.

Data breaches at retailers, healthcare providers, and other businesses expose millions of account numbers every year. If you have given your account number to a business that was later breached, a scammer may have obtained it that way. You have no control over this, but you can monitor your account for unauthorized activity.

Signs that your account number has been compromised

The first sign is usually a withdrawal you did not authorize. Check your bank statement weekly, not just monthly. Look for small charges first — scammers often test with a small amount before attempting a larger one. Look for charges from companies you do not recognize or do business with.

The second sign is a notice from your bank about a check you did not write. Banks often catch counterfeit checks before they clear, but not always. If your bank contacts you about a suspicious check, treat it as a sign that your account number is compromised.

The third sign is a call from your bank asking you to confirm a transaction or a change to your account. Legitimate banks do this sometimes, but scammers also call pretending to be your bank. If you receive such a call, hang up and call your bank directly using the number on your debit card or statement — do not use a number the caller provided.

What to do when ready if you suspect fraud

Call your bank right away. Do not wait until business hours if the fraud happened on a weekend — most banks have a fraud line that operates 24 hours. Tell them which transactions are unauthorized and ask them to freeze your account or block further ACH debits.

Federal law limits your liability for unauthorized electronic transfers. If you report the fraud within two business days of discovering it, you are liable for no more than $50. If you wait longer than two business days but report within 60 days, you may be liable for up to $500. If you wait more than 60 days, you may lose all protection. This is why speed matters.

Ask your bank whether they will reverse the unauthorized transactions. Most banks do this automatically for ACH fraud, but the process takes time — usually five to ten business days. For counterfeit checks, the process is slower because the checks have to move through the banking system first.

Closing your account and opening a new one

If the fraud is ongoing or if you are not confident the bank has stopped it, close the compromised account entirely. This is faster and more reliable than waiting for the bank to investigate. When you close the account, any pending ACH debits will be rejected because the account no longer exists.

Open a new account at the same bank or a different one. Your new account will have a new account number and routing number, so the scammer cannot use the old information. Transfer your direct deposits and automatic payments to the new account. This process usually takes a few days.

Keep the old account open for at least 30 days after closing it, if your bank allows. This gives time for any pending transactions to be rejected and for you to catch any you missed. After 30 days, you can request that the bank close it permanently.

How to reduce the risk going forward

Do not give your account number to anyone who calls you, even if they claim to be from your bank. Legitimate businesses already have your account number if they need it. If someone calls asking for it, hang up and call the organization directly using a number you know is real.

Be cautious with payment requests from people you do not know well. If a landlord, contractor, or business asks you to pay by bank transfer, verify the request through a phone number or website you know is legitimate. Scammers often intercept emails and insert their own account number, so do not rely on email alone.

Check your bank statement every week, not monthly. The sooner you catch unauthorized activity, the sooner you can report it and the more protection you have under federal law. Set up account alerts if your bank offers them — many banks can notify you by text or email when a withdrawal above a certain amount occurs.

Use your debit card for everyday purchases instead of giving out your account number. Debit card fraud is easier to dispute and your liability is lower. Reserve bank transfers for payments to people and organizations you trust completely.

Frequently Asked Questions

Can someone drain my entire bank account with just my account number?

Not when ready, but they can set up withdrawals that drain it over time. ACH transfers are limited to a certain amount per day by most banks, usually between $1,000 and $10,000. Counterfeit checks take longer because they move through the banking system. The faster you report it, the faster your bank can stop the withdrawals.

Do I need to close my account if my account number was exposed in a data breach?

Not necessarily. A data breach exposes your information, but it does not mean someone is actively using it. Monitor your account closely for the next few months. If you see unauthorized activity, close the account. If you do not, you can leave it open. Many people are exposed in breaches but never experience fraud.

What if my bank says the fraud is my fault because I gave out my account number?

Push back. Federal law protects you from unauthorized electronic transfers regardless of how the scammer obtained your account number. If your bank refuses to reverse the charges, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. Document everything in writing.

Can a scammer use my account number to open a new account in my name?

Not with just your account number. Opening a new account requires your Social Security number, date of birth, and government ID. Your account number alone is not enough. If someone has opened accounts in your name, that is identity theft, which is a separate problem from account number fraud.

Should I give my account number to my employer for direct deposit?

Yes. Your employer needs your account number and routing number to set up direct deposit, and this is a legitimate use. Employers are trusted with this information routinely. The risk is much lower than giving your account number to someone you do not know.