Your account number alone is not enough to drain your account, but it is part of what a criminal needs
A hacker cannot transfer money out of your account using only your account number. Banks require additional verification—usually a password, PIN, or one-time code sent to your phone—before any transaction goes through. Your account number is similar to your mailing address: it identifies where money should go, but it does not unlock access to move money out.
That said, your account number is valuable to criminals, and they often pair it with other information to cause real damage. The risk depends on what else they have and what they do with it.
Key Takeaways
- Your account number alone cannot be used to withdraw or transfer money because banks require a password or authentication code.
- A criminal with your account number and routing number can set up unauthorized ACH transfers or bill payments if they also have your online banking password.
- Your account number can be used to receive payments, which means scammers may use it to collect money fraudulently in your name.
- If you believe your account number has been compromised, contact your bank when ready to monitor for unauthorized activity and change your password.
- Checking accounts are protected under federal law, so unauthorized transfers can usually be reversed if you report them within 60 days.
What a criminal can do with your account number and routing number
If someone has both your account number and your routing number, they can attempt to set up an Automated Clearing House (ACH) transfer—a bank-to-bank transfer that moves money electronically. Many ACH transfers do not require when ready verification, which means a criminal could theoretically initiate a transfer to their own account. However, most banks now flag unusual ACH requests and contact you before processing them.
A criminal could also use your account number to set up bill payments through your bank's bill pay system, but this requires logging into your online banking account first. Without your password, they cannot access this feature.
The more common risk is that a criminal uses your account number to receive payments. They may pose as a seller on a marketplace, provide your account number as their own, and collect money from buyers. You would not lose money directly, but you could face disputes, chargebacks, or investigations into fraudulent activity tied to your account.
How your account number gets stolen
Your account number appears on every check you write, on bank statements, and in emails from your bank. It can be exposed through data breaches at retailers, healthcare providers, or financial institutions. Criminals also harvest account numbers from phishing emails that trick you into entering banking details on a fake website.
Account numbers are sometimes sold in bulk on dark web forums, often bundled with other personal information like names and addresses. If your number is part of a larger data breach, criminals may have additional details that make fraud easier.
Less commonly, someone you know—a roommate, family member, or employee—may write down your account number from a check or statement and misuse it.
Signs that your account number has been misused
Check your bank statements regularly for unauthorized ACH transfers, bill payments you did not authorize, or unexpected debits. Many banks allow you to see pending transactions in your online account, so log in at least weekly if you suspect compromise.
You may also notice that your account is locked or that your bank has frozen a transaction. This is actually a good sign—it means the bank's fraud detection caught something before money left your account. Contact your bank when ready to confirm the transaction was not yours.
If you receive notices of chargebacks or disputes from people claiming they sent you money fraudulently, your account number may have been used to receive stolen funds. Report this to your bank and keep copies of all correspondence.
What to do if you think your account number is compromised
Call your bank when ready using the number on the back of your debit card or on your statement—not a number from an email or text message. Tell them you believe your account number has been compromised and ask them to monitor your account for suspicious activity.
Change your online banking password to something long and unique that you have not used elsewhere. If you use the same password on other financial accounts, change those too.
Ask your bank whether they can issue you a new account number and debit card. Some banks do this automatically after a reported compromise; others require you to request it. A new account number will stop most ACH fraud, since the old number will no longer be connected to your account.
Place a fraud alert with the three major credit bureaus—Equifax, Experian, and TransUnion—by contacting any one of them. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can do this for free at annualcreditreport.com or by calling the bureaus directly.
Your legal protection if money is stolen
Checking accounts are protected under the Electronic Funds Transfer Act (EFTA), a federal law that limits your liability for unauthorized transfers. If you report the fraud within 60 days of the unauthorized transaction appearing on your statement, your bank must return the money and investigate at no cost to you.
If you wait longer than 60 days, your liability increases. After 60 days, you may be responsible for the full amount of the fraud. This is why monitoring your statements closely matters—the 60-day window is your protection.
Some banks offer additional fraud protection beyond what the law requires. Check your account agreement or call your bank to understand what coverage you have.
How to reduce the risk going forward
Do not write your full account number on checks unless absolutely necessary. Many banks allow you to use just the last four digits. Shred or burn old statements and cancelled checks rather than throwing them in the trash.
Be cautious about where you provide your account number. Legitimate businesses rarely ask for it via email or phone. If someone calls claiming to be from your bank and asks for your account number, hang up and call your bank directly using the number on your card.
Use strong, unique passwords for your online banking account. Enable two-factor authentication if your bank offers it—this requires a code from your phone or email in addition to your password, making it much harder for a criminal to log in even if they have your password.
Monitor your credit report for signs that someone has opened accounts in your name. You can check your report for free once per year at annualcreditreport.com. If you see accounts you did not open, contact the credit bureau and the creditor when ready.
Frequently Asked Questions
Can someone withdraw money from my account if they have my account number?
No, not without your password or PIN. Withdrawals require authentication. However, they may be able to set up ACH transfers or bill payments if they also have access to your online banking account, which requires your password.
Is my account number the same as my routing number?
No. Your routing number identifies your bank; your account number identifies your specific account at that bank. Together, they form the information needed for ACH transfers, but neither one alone is enough to move money.
What if I gave my account number to someone and now I am worried?
Contact your bank when ready and ask them to monitor your account and consider issuing a new account number. Change your online banking password. Check your statements weekly for the next few months. Most unauthorized activity is caught and reversed by the bank before you lose money.
How long does it take to get a new account number?
This varies by bank. Some issue a new number when ready and mail a new debit card within 5 to 10 business days. Others may take longer. Ask your bank for a timeline when you request the change.
Do I need to close my account if my account number is compromised?
Usually not. A new account number and debit card are sufficient. Closing the account may cause problems with automatic bill payments or direct deposits, so ask your bank whether a new number is an option first.