A scammer with only your account number can do less damage than you might fear, but not zero

A scammer who has your bank account number alone cannot log into your account or move money out without additional information. They cannot change your password, set up bill pay, or link your account to their own. What they can do is limited but real: they can attempt to set up automatic payments from your account, they can try to open a new account in your name using that number as part of a larger identity theft, or they can use it to make a fraudulent ACH transfer if they also have your routing number.

The risk depends on what else they have. Your account number alone is like having your street address — it identifies where you are, but it does not open your door. Combined with your routing number (which is often public), they have enough to attempt an ACH transfer. Combined with your name, address, and Social Security number, they have enough to open accounts in your name. The key is understanding what each piece of information unlocks, so you know what to watch for and what steps actually protect you.

Key Takeaways

  • A scammer with only your account number cannot log in or transfer money directly, but can attempt ACH transfers if they also have your routing number.
  • Your routing number is public information printed on every check, so assume a scammer who has your account number may also have your routing number.
  • Watch your bank statements for unauthorized ACH debits and contact your bank when ready if you see them — you have rights to dispute them.
  • Sharing your account number with a legitimate business (like your employer for direct deposit) is safe because they have no reason to misuse it.
  • If a scammer uses your account number as part of identity theft, the damage comes from the new accounts they open, not from the account number itself.

What scammers can do with your account number and routing number

If a scammer has both your account number and your routing number, they can attempt an ACH transfer — an electronic transfer between bank accounts. ACH stands for Automated Clearing House, and it is the system banks use for direct deposits, bill payments, and transfers between accounts. A scammer can try to pull money out of your account by setting up an ACH debit in your name, which means they are instructing the banking system to move money from your account to theirs.

This is why your routing number matters: it is printed on every check you write, so if you have given your account number to someone (even legitimately), assume they may also have your routing number. The two together are enough to attempt a transfer. However, this is also why banks have fraud protections. When an unusual ACH debit hits your account, your bank may flag it, delay it, or block it outright. Even if the transfer goes through, you have the right to dispute it — more on that below.

Why your account number alone is not enough to drain your account

Your account number does not grant access to your online banking. A scammer cannot use it to log in, change your password, or set up bill pay. They cannot link your account to a payment app or transfer money through your bank's website. They would need your username and password for that, which is different information entirely.

This is an important distinction because it means that if you accidentally share your account number with someone — say, a business asking for it to set up a payment — you have not handed them the keys to your account. They have one piece of a much larger puzzle. The real danger is not that they will log in and steal from you, but that they will use that number as part of a larger fraud scheme, like setting up an ACH debit or using it in identity theft.

How to spot unauthorized ACH transfers on your statement

Check your bank statement regularly — weekly is better than monthly if you are concerned. Look for debits you do not recognize, especially small ones. Scammers sometimes test with a small amount first ($1 to $5) to see if the transfer goes through before attempting a larger one. The debit will show up as an ACH transaction, often with a company name or reference number that may or may not be recognizable.

If you see a debit you did not authorize, contact your bank when ready. Do not wait for the next statement. Call the number on the back of your card or the number on your bank's official website — do not use a number from an email or text, because that could be a scammer pretending to be your bank. Tell them the transaction is unauthorized and ask them to reverse it and investigate.

Your rights when an unauthorized ACH transfer happens

Federal law gives you protection against unauthorized ACH transfers. Under Regulation E, you have the right to dispute an ACH debit that you did not authorize. Your bank must investigate and, in most cases, return the money to your account while they look into it. The process usually takes 10 business days for a provisional credit and up to 45 days for a full investigation.

To start a dispute, contact your bank in writing (email or a letter to the address on your statement) and include the date of the transaction, the amount, and the reason you believe it is unauthorized. Keep a copy for your records. Your bank will send you a form to sign; some banks call this a Regulation E dispute form or unauthorized transaction claim. Once you submit it, the clock starts and your bank has a legal obligation to act.

When account number sharing is actually safe

Sharing your account number with a legitimate business is generally safe. Your employer needs it for direct deposit. Your utility company needs it to set up automatic bill pay. Your mortgage lender needs it to collect payments. These organizations have no incentive to steal from you — they want your money to arrive on time and in the right amount. They also have their own fraud prevention systems and are regulated by law.

The risk is not in sharing your account number with a business you trust and that has a legitimate reason to have it. The risk is in sharing it with someone who contacts you unexpectedly, claims to be from your bank or a government agency, or asks you to keep it secret. If someone is pressuring you to share your account number or threatening consequences if you do not, that is a scam.

What to do if you think a scammer has your account number

First, do not panic. Having your account number does not mean your account will be drained. Take these steps in order: monitor your statement for unauthorized transactions, contact your bank to report the concern, and ask them to watch for suspicious activity. Some banks will flag your account for extra monitoring or issue you a new account number if you ask.

You do not need to close your account unless your bank recommends it or you see actual fraud. Closing an account can create problems of its own — direct deposits may fail, automatic payments may bounce, and the old account number may still be used fraudulently for a while. If fraud does occur, dispute it through your bank rather than closing the account. If you are concerned about identity theft (meaning a scammer might be using your information to open new accounts), place a fraud alert with the credit bureaus: Equifax, Experian, and TransUnion. You can do this for free by calling 1-888-397-3742 or visiting IdentityTheft.gov.

Frequently Asked Questions

Can someone open a bank account using just my account number?

No, not with your account number alone. To open an account in your name, a scammer would need your name, address, date of birth, and Social Security number — not your account number. Your account number is one piece of information; identity theft requires multiple pieces. If you are concerned about this, monitor your credit report for new accounts you did not open.

What is the difference between my account number and my routing number?

Your routing number identifies your bank (it is the same for all customers at that bank), while your account number identifies your specific account. Together, they form the information needed for ACH transfers. Your routing number is public — it is printed on every check. Your account number is more sensitive, but only because it is paired with the routing number.

If I dispute an unauthorized ACH transfer, will I get my money back?

In most cases, yes. Your bank must return the money while they investigate, usually within 10 business days. The full investigation takes up to 45 days. If the bank determines the transfer was truly unauthorized, you keep the money. If they determine you authorized it (which is rare if you actually did not), they may take it back, but you have the right to appeal their decision.

Should I change my account number if a scammer has it?

Only if your bank recommends it or if you see actual fraud. Changing your account number creates temporary problems — direct deposits and automatic payments may fail until you update them everywhere. Monitor your statement instead. If unauthorized transactions appear, dispute them. If nothing happens after 30 to 60 days, the scammer likely will not use it.

Is it safe to give my account number to my employer for direct deposit?

Yes. Your employer needs your account number and routing number to deposit your paycheck. This is a standard, safe practice. Your employer has no reason to misuse this information and is bound by employment law and banking regulations. The same applies to legitimate businesses you choose to pay automatically.