A scammer with only your account number cannot withdraw money or open new accounts, but they can use it to set up recurring charges and make it harder to prove fraud

Your bank account number alone—without your routing number, PIN, or online login credentials—is not enough for a scammer to drain your account or impersonate you completely. But it is enough to cause real damage. A scammer who has your account number can set up unauthorized automatic payments, request ACH transfers in your name, or use it to collect money from other people who believe they are paying you legitimately. The harm is real, but it is also containable if you act quickly.

The risk depends partly on what else they have. If they also have your routing number (which is often public), they can attempt ACH transfers. If they have your name, address, and account number together, they can pose as you to creditors or other businesses. If they have your online banking password, the account number becomes almost irrelevant—they can do anything. But the account number by itself is a partial tool, not a master key.

Key Takeaways

  • A scammer with only your account number cannot withdraw cash or transfer money out directly, but can set up recurring charges and ACH requests in your name.
  • The damage is worse if they also have your routing number, name, and address, because then they can pose as you to other banks and businesses.
  • Contact your bank when ready if you believe your account number has been compromised, and ask them to flag your account for fraud monitoring.
  • File a report with the Federal Trade Commission at ReportFraud.ftc.gov if unauthorized charges appear, because this creates an official record that helps dispute them.
  • You are not liable for unauthorized ACH transfers or charges if you report them within 60 days of your statement, but waiting longer weakens your case.

What a scammer can do with your account number and routing number

If a scammer has both your account number and your routing number, they can attempt to initiate an ACH transfer (Automated Clearing House transfer) from your account to theirs. ACH transfers are the system banks use for direct deposits, bill payments, and transfers between accounts. Unlike a wire transfer, which requires real-time authorization, an ACH transfer can be initiated by anyone who has the account and routing numbers—the receiving bank does not verify the sender's identity before accepting it.

This is why scammers sometimes ask for your account number under the guise of sending you a refund or a payment. They are not planning to send money in; they are planning to pull money out. The transfer may take one to two business days to process, which gives you a window to catch it if you monitor your account regularly. Once the transfer completes, the money is in the scammer's account, but it is still recoverable if you report it quickly.

Scammers can also use your account number to set up recurring automatic payments in your name—subscriptions, gym memberships, or utility payments that draft from your account monthly. These charges are harder to notice if you do not review your statements carefully, and they can accumulate before you realize what is happening.

How scammers use your account number to impersonate you

If a scammer has your account number along with your name, address, and possibly your phone number or email, they can contact other businesses and claim to be you. They might call a credit card company and say they want to set up a payment plan, or contact a utility company and request a service change. They can use your account number as proof of identity—many customer service representatives will accept it as verification, especially if the scammer also has your name and address.

This is particularly dangerous if the scammer uses your account number to open a new account somewhere else in your name. Some businesses will accept a bank account number as part of a verification process for opening a credit card, a loan, or a utility account. The scammer does not need to access your actual bank account to do this; they just need to convince another company that the account belongs to them.

The damage here is not direct theft from your bank account, but rather fraudulent accounts opened in your name, which can hurt your credit score and create a mess that takes months to untangle.

What happens if unauthorized charges appear on your statement

If you see charges you did not authorize, your first step is to contact your bank by phone—not by email or through the app. Use the number on the back of your card or on your bank's official website, never a number from an email or text message. Tell them you see unauthorized charges and ask them to freeze your account temporarily while they investigate.

Your bank will likely issue you a new debit card and account number. They may also reverse the unauthorized charges when ready as a courtesy while they investigate, or they may tell you the reversal will take 10 business days. Under the Electronic Funds Transfer Act, your bank must investigate within 10 business days and resolve the dispute within 45 days. If the charges were ACH transfers, you have 60 days from the date your statement was issued to report them; after 60 days, your liability protection weakens significantly.

Keep records of every conversation: the date, the time, the name of the representative, and what they said they would do. Ask them to send you a written confirmation of the dispute by mail or through your online account.

Filing a fraud report with the Federal Trade Commission

After you contact your bank, file a report with the Federal Trade Commission at ReportFraud.ftc.gov. This creates an official record of the fraud and gives you a case number. You do not need to have already recovered the money to file; the report documents what happened and helps establish a timeline if you need to dispute charges later.

The FTC does not investigate individual cases, but your report goes into a database that law enforcement agencies use to identify patterns and track down organized fraud rings. If multiple people report the same scammer or the same scheme, the FTC can alert banks and other agencies.

You should also consider filing a report with your state's attorney general office if the fraud involved a specific business or service. Some states have their own fraud hotlines or online reporting systems.

Steps to take if you think your account number has been compromised

Contact your bank when ready and ask them to place a fraud alert on your account. This flag tells the bank to verify any unusual activity before processing it. Some banks will also offer to monitor your account for suspicious patterns and alert you if they see something odd.

Request a new account number and debit card. Your bank can usually do this over the phone, and the new card will arrive within 5 to 7 business days. Ask them to cancel any automatic payments linked to your old account number and help you set them up again with the new number.

Check your credit report at AnnualCreditReport.com (the only free, official source) to see if anyone has opened accounts in your name. You are may have access to to one free report per year from each of the three major bureaus: Equifax, Experian, and TransUnion. If you see fraudulent accounts, contact the credit bureau and ask them to place a fraud alert on your credit file. This makes it harder for a scammer to open new accounts in your name.

Consider placing a credit freeze with all three bureaus if you are concerned about identity theft. A freeze prevents anyone—including you—from opening new accounts in your name without unfreezing first. It is free and can be done online in minutes.

How to protect your account number going forward

Your account number is not as sensitive as your PIN or online password, but it is still worth protecting. Do not share it over the phone unless you initiated the call to a business you trust. Do not write it on checks unless absolutely necessary. Do not post it on social media or in public forums.

Be skeptical of requests for your account number. Legitimate businesses—your employer, your bank, the IRS—will not ask for your account number via email or unsolicited phone call. If someone calls claiming to be from your bank and asks for your account number, hang up and call your bank directly using the number on your card.

Monitor your bank statements weekly, not just monthly. Set up account alerts through your bank's app or website so you are notified of large transactions or transfers. Many banks allow you to set a threshold—for example, alert you if any single transaction exceeds $100. This gives you the best chance of catching fraud early, when it is easiest to reverse.

Frequently Asked Questions

Can someone open a bank account with just my account number?

Not directly—they cannot access your existing account. But they can use your account number as part of a larger identity theft scheme to open a new account somewhere else in your name. If they also have your name, address, and Social Security number, the risk is much higher. Monitor your credit report regularly to catch this.

How long does it take to get my money back after reporting unauthorized charges?

Your bank must investigate within 10 business days and resolve the dispute within 45 days. Many banks reverse the charges when ready as a courtesy while they investigate, so you may see the money back within a few days. But the official timeline is 45 days, and you should follow up if you have not heard back by then.

What if the scammer used my account number to set up a subscription I did not notice for months?

You can still dispute it, but your case is stronger if you report it within 60 days of the statement showing the charge. After 60 days, your bank may argue that you should have noticed sooner. Contact your bank and the company running the subscription when ready, and ask both to reverse all charges going back to when the subscription started.

Do I need to close my bank account if my account number was compromised?

Not necessarily. A new account number and debit card are usually enough. Closing the account can actually make things harder because you will need to update automatic payments and direct deposits. Ask your bank to issue a new account number first, and only close the old account if fraud continues after that.

Will my bank hold me responsible for the unauthorized charges?

No, as long as you report them within 60 days of your statement. Under federal law, you are not liable for unauthorized ACH transfers or debit card charges if you report them promptly. Your bank must reverse them. If you wait longer than 60 days, your protection weakens, and the bank may argue you were negligent in monitoring your account.