A bank account number alone is not enough to drain your account, but it is a starting point for fraud

Your bank account number can be used to commit fraud, but not in the way most people fear. A thief cannot walk into a bank with your account number and withdraw cash. They cannot log into your online banking. What they can do is set up unauthorized transfers, create fake checks, or convince your bank they are you through social engineering. The real risk is not the number itself—it is what someone does with it once they have it.

The damage depends on what else the thief has. Account number alone: limited. Account number plus your name and routing number: they can attempt ACH transfers or bill payments. Account number plus your Social Security number, address, and phone number: they can call your bank, claim to be you, and request changes to your account. The more pieces they have, the more convincing they can be.

Key Takeaways

  • Your account number by itself cannot be used to log in or withdraw money in person, but it can be used for unauthorized transfers or bill payments.
  • Thieves need additional information—your name, routing number, Social Security number, or phone number—to do serious damage through your bank.
  • ACH transfers and fraudulent checks are the most common attacks using account numbers, and both leave a paper trail your bank can reverse.
  • Contact your bank when ready if you know your account number has been compromised, and ask them to flag your account for fraud monitoring.
  • Freezing your credit with the three major bureaus prevents someone from opening new accounts in your name, even if they have your account number.

How thieves use a bank account number

The most common attack is an ACH transfer—an electronic transfer between bank accounts. If a thief has your account number and routing number, they can attempt to pull money out of your account by posing as a business or creditor. They set up a fake company, claim you owe them money, and request a transfer. Your bank processes it if the routing and account numbers match. This is why ACH fraud is so common: it requires no password, no login, and no physical access to your account.

The second method is check fraud. With your account number and routing number, a thief can print counterfeit checks or order checks online in your name. They write checks to themselves or sell the checks to others. The checks clear if the numbers are correct, and the money leaves your account. You discover it when you reconcile your statement or when checks you wrote bounce.

A third method is bill payment fraud. Some bill payment systems allow a payer to set up a payment using only an account number and routing number. A thief can log into a utility company's website, claim to be you, and set up a payment from your account to pay their own bill or redirect it elsewhere.

What your bank can and cannot do with just an account number

Your bank cannot use your account number to verify your identity. They can use it to locate your account, but they cannot grant access, change your password, or authorize transfers based on the number alone. This is why banks ask for additional verification—your Social Security number, date of birth, or answers to security questions—before making changes.

However, if a thief calls your bank and has your account number, name, address, and Social Security number, they can often convince a bank employee that they are you. This is called social engineering, and it works because the employee is trained to help customers, not to assume the caller is lying. The thief may request a password reset, add a new phone number to the account, or authorize a transfer. Once they have done this, they have access to your account.

This is why your account number is dangerous in combination with other information. The account number is the key that opens the door; the other information is what convinces the bank to let them through.

Signs your account number has been compromised

Watch for unauthorized ACH transfers on your statement—these appear as debits to your account with a company name you do not recognize. They are often small amounts ($25 to $100) to avoid triggering fraud alerts. Check your statement weekly, not monthly, because the sooner you report fraud, the sooner your bank can reverse it.

You may also see checks you did not write clearing against your account, or bills you did not authorize being paid from your account. If you receive a call from a debt collector about a debt you do not recognize, it may mean someone has opened a credit account in your name using your account number and other personal information.

Another warning sign is a letter from your bank about suspicious activity or a temporary freeze on your account. Banks monitor for unusual patterns—large transfers, transfers to new recipients, or transfers at odd hours—and may freeze your account to protect it. This is inconvenient but protective.

What to do if your account number is compromised

Call your bank when ready. Do not email, do not use the bank's website chat, and do not wait. Use the phone number on the back of your debit card or on your bank statement—not a number from a search result, which might be fraudulent. Tell them your account number may have been compromised and ask them to flag your account for fraud monitoring.

Your bank will likely offer you a new account number and a new debit card. Accept both. The new account number breaks the link between the thief and your account. The new card prevents them from using any card number they may have obtained. This takes a few business days, but it is the fastest way to stop ongoing fraud.

Ask your bank about Regulation E protection. Under federal law, if you report unauthorized ACH transfers or debit card fraud within 60 days of the transaction appearing on your statement, your bank must reverse the charge and return your money. If you report it after 60 days, they may still reverse it, but they are not required to. Report fraud as soon as you see it.

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and gives you a recovery plan. You will receive an Identity Theft Report, which you can use to dispute fraudulent accounts with creditors and credit bureaus. This is free and takes about 10 minutes.

Protecting your account number going forward

Do not share your account number with anyone unless you initiated the contact and you are certain they are legitimate. If a company calls you asking for your account number, hang up and call them back using the number on your bill or their official website. Scammers often pose as banks or utilities to collect account numbers.

Do not write your account number on checks, and do not include it in emails or text messages. If you need to give it to someone, do so over the phone to a number you know is legitimate, or in person.

Use strong, unique passwords for your online banking account. Your password is what actually protects your account; your account number is just an identifier. If your password is weak, a thief does not need your account number—they can log in directly.

Consider placing a fraud alert or credit freeze with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. A credit freeze prevents anyone from accessing your credit report without your permission, which stops most identity theft cold. Both are free, and you can set them up online in about 15 minutes total.

How long it takes to recover from account number fraud

If the fraud is limited to unauthorized ACH transfers or checks, your bank should reverse the charges within 10 business days. You will have your money back, though you may see a temporary debit while the bank investigates. Keep copies of all correspondence with your bank.

If the thief used your account number to open new accounts in your name—credit cards, loans, utilities—recovery takes longer. You will need to dispute each account with the creditor and with the credit bureaus. This can take weeks to months. The Identity Theft Report you filed with the FTC helps speed this up, because creditors are required to accept it as proof of fraud.

If your Social Security number was also compromised, consider monitoring your credit report for the next few years. You are may have access to to one free credit report per year from each bureau at AnnualCreditReport.com. Check them for accounts you do not recognize.

Frequently Asked Questions

Can someone withdraw cash from my account if they only have my account number?

No. They cannot walk into a bank or use an ATM with just your account number. They would need your debit card and PIN, or they would need to call your bank and convince them they are you. The account number is a piece of the puzzle, not the whole thing.

What is the difference between a fraud alert and a credit freeze?

A fraud alert tells creditors to call you before opening new accounts in your name. A credit freeze blocks creditors from seeing your credit report at all, which stops most new account fraud completely. A freeze is stronger but may slow down your own credit applications. Both are free and can be set up online.

If my bank reverses fraudulent charges, will the thief's bank know who I am?

No. The reversal goes back through the ACH network to the account the money was sent to. The thief's bank will see a reversal, but they will not have your personal information unless the thief provided it. Your bank protects your identity in the reversal process.

How do I know if someone is using my account number right now?

Check your bank statement weekly for transactions you do not recognize. Set up account alerts through your bank's app or website to notify you of large transfers or transfers to new recipients. Most banks offer this free. You cannot know for certain until you see unauthorized activity, but monitoring catches it quickly.

Should I close my account if my account number is compromised?

Not necessarily. Your bank can issue you a new account number and new debit card, which breaks the link to the thief. Closing the account and opening a new one takes longer and may affect your banking history. Ask your bank whether they recommend a new number or a new account—most recommend just a new number.