Yes, but not as much as you might fear

Someone with only your bank account number can initiate a payment out of your account, but they cannot drain it without additional information or access. The real risk depends on what else they have: your routing number, your name, your address, or access to your online banking login. A bank account number alone is not enough to transfer money to themselves or make a purchase. It is enough to set up a recurring payment that pulls money from your account — which is how most account-draining fraud actually happens.

The confusion comes from the fact that your account number is printed on every check you write. Anyone who has ever received a check from you has your account number and routing number. That is by design — the system assumes the person holding the check is someone you intended to pay. The fraud risk is not that they have the number. It is that they use it to create a payment arrangement you did not authorize.

Key Takeaways

  • Someone with your account number and routing number can set up an ACH debit (a recurring or one-time pull from your account) without your permission, which is the most common way this fraud happens.
  • They cannot transfer money to their own account or make a purchase using only your account number — they would need your online banking password or physical card.
  • The damage is usually caught within days because the transaction appears on your statement, but stopping it requires you to contact your bank and file a dispute.
  • Your bank is required to refund unauthorized ACH debits if you report them within 60 days, though the process takes time.
  • Protecting your account number is less critical than protecting your password, PIN, and physical card.

How the fraud actually works: the ACH debit route

The most common fraud using a bank account number is an ACH debit — an electronic pull from your account. ACH stands for Automated Clearing House, and it is the system that handles direct deposits, bill payments, and recurring subscriptions. To set up an ACH debit, someone needs your account number, routing number, and your name. They do not need your password or permission.

A fraudster with this information can contact a utility company, a payday lender, a gym, or any business that accepts ACH payments and claim to be you. They say they want to set up automatic payments. The business sends the ACH debit to your bank. Your bank checks that the account number and routing number match an account in that name — and if they do, the money moves. You see it on your statement days later.

This is why ACH fraud is so common and so damaging: the system is built on trust, not verification. Your bank does not call you to confirm. The business does not verify your identity beyond the name on the account. The money is already gone by the time you notice.

What they cannot do with only your account number

Someone cannot use your account number alone to transfer money to their own bank account. Wire transfers and external transfers require you to log into your online banking, authorize the transfer, and often provide additional verification. Your account number is not enough.

They cannot make a purchase at a store or online. Debit card transactions require the card itself, the CVV, and often a PIN or signature. A check requires physical access to your checkbook and your signature. A credit card transaction requires the card number, expiration date, and CVV — none of which are your bank account number.

They cannot log into your account. Online banking requires a username or email address, a password, and often a second factor like a code sent to your phone. Your account number is not a login credential.

The damage timeline: when you notice and what happens next

An unauthorized ACH debit usually appears on your statement within one to three business days. If you check your account regularly, you catch it quickly. If you do not, you might not notice for weeks.

Once you see it, contact your bank when ready. Tell them the debit was not authorized. Your bank is required by federal law (Regulation E) to investigate and refund the money if you report it within 60 days. The refund itself takes five to ten business days, though your bank may credit your account temporarily while they investigate.

The investigation involves your bank contacting the receiving bank and asking them to reverse the transaction. If the receiving bank cooperates — which they usually do for obvious fraud — the money comes back. If the fraudster has already withdrawn the money, the receiving bank may not be able to recover it, but your bank still refunds you.

How to reduce the risk if your account number is exposed

If you know your account number has been compromised — because you lost a check, received a phishing email, or saw suspicious activity — you have options short of closing the account.

Contact your bank and ask them to flag your account for ACH fraud. Many banks allow you to set a restriction that requires you to call and authorize any new ACH debits before they process. This slows down legitimate payments you set up yourself, but it stops a fraudster from creating new ones.

You can also monitor your account more closely. Set up account alerts through your bank's app so you get a notification every time money leaves your account. This does not prevent fraud, but it means you catch it within hours instead of weeks.

Do not close your account unless the fraud is ongoing and your bank cannot stop it. Closing an account does not erase the account number from the system — it just makes the account inactive. A fraudster who tries to use it will get a rejection, but that does not help you if they have already drained it.

Why your account number is less sensitive than other information

Your account number is printed on every check. It is visible to anyone who handles your mail, anyone you pay by check, and anyone who works at a business where you write a check. Banks treat it as semi-public information for this reason.

Your password, PIN, and debit card are different. These are secrets that only you should have. If someone has your password, they can log into your account and move money however they want. If they have your card, they can spend money directly. If they have your PIN, they can withdraw cash.

This is why banks are much more careful about protecting passwords than account numbers. It is also why you should be more worried about a data breach that exposes your password than one that exposes your account number.

What to do if you see an unauthorized ACH debit

Call your bank's fraud line when ready. Do not use the number on the back of your card if you are calling about a fraudulent ACH debit — use the number on your statement or the bank's website. Fraudsters sometimes intercept calls by spoofing the bank's number.

Tell the bank the specific transaction: the date, the amount, and the company that initiated it. The bank will ask if you authorized it. Say no. They will start an investigation and usually issue a temporary credit while they work on it.

Keep records of every communication. Write down the date you called, the name of the person you spoke to, and what they said they would do. If the refund does not appear within the timeframe they gave you, call back and reference that conversation.

If the same fraudster tries again, tell your bank. They can block that company from pulling from your account in the future.

Frequently Asked Questions

Can someone open a new bank account using my account number?

No. Opening an account requires government-issued ID, a Social Security number, and proof of address. Your account number alone cannot be used for this. However, if a fraudster has your name, address, and Social Security number along with your account number, they could attempt identity theft, which is a different and more serious crime.

If I give my account number to a legitimate business, can they take more money than I authorized?

They can attempt to, but your bank is required to stop it. If you authorize a gym membership for $50 a month and they try to debit $500, you can dispute it and get your money back. The business is liable for the overcharge, not you.

Does my bank need my account number to send me a direct deposit?

Yes. Your employer or the organization sending you money needs your account number and routing number to deposit it. This is safe — they can only push money in, not pull it out. Your account number is designed to be shared for deposits.

What if the fraudster used my account number to set up a subscription I cannot cancel?

Contact the company directly and tell them you did not authorize the subscription. Ask them to cancel it and stop the ACH debits. If they refuse or you cannot reach them, tell your bank. Your bank can block that company from pulling from your account, which stops the payments when ready while you dispute them.

Should I get a new bank account if my account number is compromised?

Only if the fraud is ongoing and your bank cannot stop it. Changing accounts is disruptive — you have to update direct deposits, bill payments, and any automatic transfers. Start by asking your bank to restrict ACH debits and monitor your account closely. If fraud happens again after that, then consider moving accounts.