Yes, but only certain things—and your bank account number alone is less dangerous than your routing number plus a check

Someone with your bank account number can attempt to set up unauthorized transfers out of your account, but they cannot straightforward drain it. They need additional information: your routing number (which is often public), your name as it appears on the account, or access to your online banking login. A bank account number by itself is like having someone's street address—useful for sending mail, but not enough to break in.

The real risk depends on what else they have and what they do with it. If they have your account number and routing number together, they can try to set up ACH transfers (electronic money movements between accounts) or create fraudulent checks. If they have your account number and your online banking password, the threat is when ready. If they have only the account number, the damage is usually limited to what your bank's fraud detection catches before it clears.

Key Takeaways

  • A bank account number alone cannot be used to withdraw cash or make purchases, but combined with a routing number it can be used to create unauthorized ACH transfers or checks.
  • Your online banking password is far more dangerous than your account number; if someone has both, contact your bank when ready and change your password before doing anything else.
  • Fraudulent ACH transfers typically take one to two business days to process, giving you a window to dispute them if you catch them quickly.
  • Your bank is required to refund unauthorized transfers within specific timeframes, though the speed depends on whether you report it before or after the money leaves.
  • Monitoring your account weekly for unfamiliar transactions is more effective than trying to keep your account number secret, since it is often visible on checks and billing statements.

What scammers can actually do with your account number

The most common attack is an ACH debit—an electronic transfer that pulls money from your account to theirs. To set this up, a scammer needs your account number, routing number, and your name. They do not need your password or permission. They can create the transfer through their own bank or through a third-party payment processor, and it will appear as a pending transaction in your account within hours, though it may not fully clear for one to two business days.

A second method is creating a fraudulent check using your account number. They print a check with your account number, their name as payee, and forge your signature. They deposit it at their bank, and if their bank does not verify the signature carefully, the check clears. This is slower than ACH but harder to trace because it involves a physical document.

A third method is bill pay fraud. If they have access to your online banking account (which requires your password, not just your account number), they can set up bill payments to themselves or redirect legitimate payments to accounts they control. This is why your password is far more valuable to a scammer than your account number alone.

Why your routing number matters more than your account number

Your routing number identifies your bank. Your account number identifies your specific account within that bank. Together, they form the complete address for an ACH transfer. Your routing number is not secret—it appears on every check you write, on your bank's website, and in public databases. Many people give out their routing number without hesitation.

A scammer with only your account number cannot do much. A scammer with your account number and routing number can attempt ACH transfers. A scammer with your account number, routing number, and name can attempt ACH transfers with a higher success rate because the information matches what your bank expects to see. A scammer with your account number, routing number, name, and your online banking password can do almost anything your account allows.

How banks detect and stop unauthorized transfers

Most banks run fraud detection software that flags unusual patterns: transfers to new recipients, transfers larger than your normal activity, transfers at odd hours, or transfers to high-risk destinations. If a transfer triggers a flag, the bank may freeze it, call you to confirm, or let it through but monitor it closely. The software is not perfect—some fraudulent transfers clear, and some legitimate transfers get blocked—but it catches the majority of ACH fraud before money leaves your account.

The speed of detection depends on your bank. Some banks scan transactions in real time. Others scan them in batches at the end of the business day. If a fraudulent ACH transfer is flagged before it settles (usually by end of business the next day), your bank can stop it. If it settles, you will need to dispute it, and your bank will have to reverse it and recover the money from the receiving bank.

What to do if you see an unauthorized transfer

Call your bank when ready—not the number on the back of your card, but the number on your statement or the bank's official website. Tell them you see a transaction you did not authorize. Do this before end of business that day if possible. Your bank will ask you to confirm your identity, then they will either freeze the transaction (if it has not settled) or begin a dispute process (if it has).

If the transfer has not yet settled, your bank can usually stop it within hours. If it has settled, your bank will file a dispute with the receiving bank and typically refund your money within three to five business days while they investigate. Federal law requires banks to refund unauthorized ACH transfers, though the timeline varies depending on whether you reported it before or after the money left your account.

Do not wait to see if the transaction reverses on its own. Do not assume your bank will catch it. Call when ready. The sooner you report it, the more options your bank has to stop the transfer before it clears.

How to reduce the risk if your account number is compromised

Change your online banking password when ready. Use a password that is at least 12 characters long and includes uppercase, lowercase, numbers, and symbols. Do not reuse passwords across accounts. If you use the same password for your bank and other websites, and one of those websites is breached, a scammer can try that password on your bank account.

Enable two-factor authentication on your online banking account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authenticator app. Most banks offer this as an option in account settings.

Monitor your account at least weekly. Log in to your online banking portal and review recent transactions. Look for transfers you do not recognize, even small ones—scammers sometimes test with small amounts first. Set up account alerts if your bank offers them; many banks can send you a text or email whenever a transaction over a certain amount clears.

If your account number has been compromised in a data breach or you suspect ongoing fraud, ask your bank about closing the account and opening a new one. Your bank can transfer your direct deposits and automatic payments to the new account. This is more disruptive than changing your password, but it completely eliminates the risk from the old account number.

The difference between account number theft and identity theft

Account number theft is limited to your bank account. A scammer with your account number can only attempt to move money out of that specific account. They cannot open new accounts in your name, explore for credit, or commit fraud in other areas.

Identity theft is broader. It happens when someone has enough of your personal information—name, Social Security number, date of birth, address—to impersonate you. They can open credit cards, take out loans, file tax returns, or commit crimes in your name. Account number theft is a subset of what they can do, but it is not identity theft by itself.

If you suspect identity theft (not just account fraud), place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. You can do this for free by calling one bureau and asking them to alert the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name.

Frequently Asked Questions

Can someone withdraw cash from an ATM with just my account number?

No. An ATM requires a debit card and a PIN. Your account number alone cannot be used at an ATM. If someone has your debit card number and CVV, they can make online purchases, but they still cannot withdraw cash without the physical card or PIN.

What if I gave my account number to someone I thought was my bank?

Call your bank when ready using the number on your statement or their official website. Tell them you may have given your account number to someone impersonating the bank. Your bank can monitor your account for suspicious activity and may recommend changing your password or opening a new account. Do not assume nothing will happen—scammers often wait days or weeks before attempting fraud.

How long does it take for an unauthorized ACH transfer to clear?

ACH transfers typically take one to two business days to settle. If you catch the transaction while it is pending (before it settles), your bank can usually stop it. Once it settles, your bank must file a dispute and recover the money from the receiving bank, which takes three to five business days.

Will my bank refund me if someone uses my account number to commit fraud?

Yes. Federal law requires banks to refund unauthorized ACH transfers. The timeline depends on when you report it: if you report it before the money leaves, your bank can stop it when ready; if you report it after, they must refund you within three to five business days while they investigate.

Is it safe to write checks if my account number is on them?

Your account number is on every check you write, and checks have been used for decades without widespread account number theft. The real risk is if someone has both your account number and routing number and knows how to create an ACH transfer or fraudulent check. For most people, the risk from writing checks is low, but if you are concerned, you can request checks without your account number printed on them, though this is uncommon.