No, someone cannot drain your account with only your account number

A bank account number alone—without your routing number, PIN, online password, or physical card—is not enough to withdraw money or transfer funds out of your account. Banks have built multiple layers of verification into their systems specifically because account numbers are not secret. Your account number appears on every check you write, on statements you may leave lying around, and on bills you pay online. It is treated as semi-public information.

What someone can do with your account number depends on what else they have and what they convince your bank to do. The real risk is not theft through the account number itself, but what that number enables when combined with other information or social engineering.

Key Takeaways

  • Your account number alone cannot be used to withdraw money, transfer funds, or access your balance—banks require additional verification.
  • Someone with your account number and routing number can set up automatic payments or ACH transfers if they also have authorization or can trick your bank into believing they do.
  • The greatest risk is not the account number itself but unauthorized ACH transfers or fraudulent checks written against your account.
  • If you discover unauthorized activity, contact your bank when ready and file a dispute; federal law limits your liability if you report within 60 days.
  • Protecting your account number matters less than protecting your password, PIN, debit card, and Social Security number.

What actually requires your account number

Your account number is needed for legitimate transactions where you initiate the payment: setting up direct deposit from your employer, paying a bill online through your bank's website, or wiring money to someone. In these cases, you are already logged in or on a find channel, and you are the one authorizing the transaction.

Your account number is also printed on checks. Someone who has a check from your account has your account number and routing number together, which is why check fraud remains a real threat—but that threat comes from the check itself, not from the account number alone.

The real risks: ACH transfers and unauthorized payments

The actual danger is an ACH (Automated Clearing House) transfer. An ACH transfer moves money between bank accounts using the account number and routing number. If someone has both numbers and can convince a third party (like a bill collector, a utility company, or a payday lender) that you authorized a payment, that third party can initiate an ACH debit against your account.

This happens most often in these scenarios: you dispute a charge and the merchant retaliates by claiming you authorized a payment you did not; a scammer poses as you and sets up a fake utility or loan account in your name, then initiates a payment; or someone uses your information to open a fraudulent account and links it to your real bank account for "verification."

The second risk is check fraud. If someone obtains a check with your account and routing number, they can forge your signature and cash it. This is why checks are considered risky—they contain all the information needed for fraud, plus they rely on your signature as the only verification.

What your bank will and will not do with your account number

Your bank will not allow someone to log into your account, change your password, or access your balance using only your account number. They will ask for your PIN, password, or other verification tied to your identity.

However, your bank may allow someone to initiate a wire transfer or ACH payment if that person can provide your account number, routing number, and a plausible story—especially if they claim to be you. Banks are required to verify the account exists and has sufficient funds, but they are not always rigorous about verifying the person requesting the transfer is actually you.

This is why identity theft is dangerous: a thief with your name, address, and account number can sometimes convince a bank employee that they are you, or can set up fraudulent accounts that pull money from your real account.

How to respond if you think someone has your account number

If you believe someone has obtained your account number through a data breach, a lost check, or any other means, you do not need to close your account when ready. Monitor your account for unauthorized activity—log in regularly and review your transactions.

If you see unauthorized charges or transfers, contact your bank right away. Under the Electronic Funds Transfer Act, you have up to 60 days from the date you receive your statement to report unauthorized ACH transfers. If you report within that window, your liability is limited to $50 (or zero if you report before any money is actually taken). After 60 days, your liability increases significantly.

Ask your bank to place a fraud alert on your account, which adds an extra verification step before certain transactions are processed. You can also request a new account number if you are concerned, though this is usually unnecessary unless there is active fraud.

Protecting what actually matters

Your account number is less sensitive than your PIN, your online banking password, your debit card itself, or your Social Security number. If someone has your account number but nothing else, the risk is manageable.

Focus your protection efforts on the things that actually unlock your account: your password (use a unique, strong one), your PIN (never share it), your debit card (keep it physical find), and your Social Security number (limit who has it). These are the keys to your account. Your account number is more like your mailing address—useful to know, but not sufficient to cause real damage on its own.

Frequently Asked Questions

Can someone open a new bank account using my account number?

No. Opening a new account requires a Social Security number, government ID, and proof of address. Your account number alone cannot be used to create an account in your name. However, someone with your full identity information could open a fraudulent account and link it to your real account for transfers.

What if someone writes a check from my account without permission?

Contact your bank when ready and report the check as fraudulent. Banks can place a stop payment on the check, and you are protected under check fraud laws. If the check has already cleared, file a dispute and the bank will typically reverse the charge within 10 business days while they investigate.

Do I need to close my account if my account number was exposed in a data breach?

Not necessarily. Monitor your account closely for the next few months, but closing it is usually not required unless you see actual unauthorized activity. Closing an account can affect your banking history. Instead, ask your bank about fraud monitoring or alerts.

Is my account number the same as my routing number?

No. Your routing number identifies your bank (usually nine digits), and your account number identifies your specific account at that bank (usually 10 to 12 digits). Both are needed together for ACH transfers, but neither alone is enough to access your money.

What should I do if I gave my account number to a bill payment website?

If the website was legitimate and you initiated the payment yourself, you are fine. Your account number is supposed to be shared in that context. If you are unsure whether the website was real, contact your bank and ask them to monitor for unauthorized transactions. Do not assume fraud just because you shared the number—that is normal for bill payments.