Your account number alone is not enough to drain your account, but it is part of what a criminal needs

A hacker or scammer cannot transfer money out of your account using only your account number. They also need your routing number, and more importantly, they need to initiate a transaction through a method your bank recognizes—which usually means they need access to your online login, a stolen debit card, or the ability to set up an unauthorized ACH transfer. Your account number by itself is like having someone's street address; it tells them where to look, but not how to get inside.

That said, your account number is valuable to criminals because it is one of the two pieces required for certain types of fraud. The risk is real, but it is specific. Understanding what actually happens when your account number leaks—and what does not—helps you know whether you need to act when ready or straightforward monitor your account.

Key Takeaways

  • Your account number alone cannot be used to withdraw or transfer money; a criminal also needs your routing number and a way to initiate a transaction your bank will process.
  • The main risk from a leaked account number is unauthorized ACH transfers (bill payments or direct debits), which require both numbers but not your password.
  • Debit card fraud and online account takeover are separate risks that depend on stolen card details or login credentials, not just your account number.
  • If your account number is compromised, contact your bank to place a fraud alert and monitor your account for unauthorized activity; closing the account is an option but not always necessary.
  • Your bank's fraud protection covers most unauthorized transfers, though the process to recover funds can take weeks.

What a criminal can do with your account number and routing number

With both your account number and routing number, a criminal can attempt to set up an ACH transfer (Automated Clearing House transfer) in your name. This is how bill payments and direct deposits work. They could try to create a one-time transfer to their own account, or set up recurring debits that pull money out regularly. They do not need your password or online login to do this—they only need the two numbers.

This is why your routing number and account number together are sometimes called your "banking details" and why you should treat them with some care. However, most banks now require additional verification before an ACH transfer can be initiated, especially if it is going to a new recipient. Your bank may send you a confirmation email, text, or call before processing the transfer. If you see an unauthorized ACH attempt, you can usually stop it before the money leaves.

The second risk is that someone uses your account number to set up a false billing relationship—for example, posing as a utility company or subscription service and claiming you authorized a charge. This is less common but does happen. Again, your bank's fraud protections typically cover this.

What a criminal cannot do with only your account number

A criminal cannot log into your online banking account with just your account number. They cannot use it to request a debit card in your name. They cannot withdraw cash from an ATM. They cannot make purchases online or in stores. All of these require either your password, your physical card, or your identity information (like your Social Security number).

If your account number appears on a check you wrote and someone deposits it into their own account, that is a different problem—they are committing check fraud, not using your account number to access your funds. The bank's check clearing process is separate from your account security.

How your account number might leak in the first place

Your account number can be exposed through a data breach at a company where you have set up automatic payments—a utility, insurance company, or subscription service. It can also appear on a check if you lose one or if someone intercepts your mail. In rare cases, a dishonest employee at your bank or a business you work with might sell account numbers to criminals.

Phishing emails and fake websites sometimes ask for your account number as part of a scam. If you receive an unsolicited email asking for banking details, do not provide them. Your bank will never ask for your account number via email or text.

What to do if you think your account number is compromised

Contact your bank when ready. Tell them that your account number may have been exposed and ask them to monitor your account for suspicious activity. Many banks will place a fraud alert on your account, which means they will call you or send you a notification before processing any large or unusual transfers.

You do not have to close your account unless you want to. Closing it is one option, but it is disruptive—you will need to update any automatic payments, direct deposits, and bill payments to a new account number. Most people choose to keep the account open and monitor it closely instead. Your bank can also issue you a new debit card if you are concerned about card-based fraud.

Check your account statements and transaction history for the next 30 to 60 days. Look for any ACH transfers you did not authorize, any new payees you did not set up, or any charges from unfamiliar companies. If you see something suspicious, report it to your bank right away. Do not wait to see if it resolves itself.

How your bank protects you from unauthorized transfers

Federal law (Regulation E) limits your liability for unauthorized electronic transfers. If you report an unauthorized ACH transfer within 60 days of your statement date, your bank must investigate and return the money to you. If you report it after 60 days, your liability may increase, though many banks will still help you.

The investigation process usually takes 10 to 30 days. During that time, the money may remain out of your account. Your bank will contact the receiving bank and ask them to reverse the transfer. If the receiving account is still open and has funds, the money comes back quickly. If the criminal has already spent it, the process takes longer and may involve law enforcement.

For ACH fraud specifically, you are generally not responsible for the unauthorized transfer as long as you report it promptly. This is different from debit card fraud, where your liability depends on how quickly you report the card as stolen.

Steps to reduce the risk going forward

Do not share your account number and routing number together unless you are setting up a legitimate payment or deposit. If a company asks for both numbers over the phone or email, verify that they are who they claim to be by calling the company's official number (not one they provided).

Use strong, unique passwords for your online banking account. Enable two-factor authentication if your bank offers it. This adds a second step (usually a code sent to your phone) before anyone can log in, even if they have your password.

Monitor your bank statements regularly—at least weekly if possible. Many banks offer real-time alerts for transfers over a certain amount. Set up these alerts if they are available. The faster you spot fraud, the faster you can report it and the faster your bank can reverse it.

Shred checks you no longer need and do not throw them away whole. If you are moving, ask your bank to hold your mail or update your address when ready so checks do not sit in an old mailbox.

Frequently Asked Questions

Can someone open a new bank account using my account number?

No. Opening a new account requires identity verification—a government ID, Social Security number, and usually an in-person visit or video call. Your account number alone cannot be used to open an account in your name. However, if someone has your Social Security number and other identity information, they could attempt account fraud, which is a separate and more serious problem.

What if I see an unauthorized ACH transfer that already went through?

Contact your bank when ready and report it as fraud. Provide the date, amount, and the name of the receiving account or company. Your bank will begin an investigation and can usually reverse the transfer within 10 to 30 days. You are protected by federal law as long as you report it within 60 days of your statement date.

Should I close my account if my account number leaked?

Not necessarily. Closing your account is disruptive because you will need to update automatic payments and direct deposits. Most people monitor their account closely instead and ask their bank to place a fraud alert. Close the account only if you are very concerned or if your bank recommends it after investigating suspicious activity.

Can I get my money back if a criminal uses my account number for an unauthorized transfer?

Yes, in most cases. Federal law requires your bank to return unauthorized electronic transfers if you report them within 60 days. The process takes 10 to 30 days, and you may not have access to the money during the investigation, but you will get it back as long as you report it promptly.

Is my account number safe to put on a check?

Your account number appears on every check you write, so it is not a secret. However, only give checks to people you trust. If a check is lost or stolen, contact your bank and ask them to watch for fraudulent deposits. You can also ask your bank to stop payment on a specific check if you are concerned it was intercepted.