Your account number alone is not enough to drain your bank account, but it is enough to cause real problems

A hacker who has only your account number cannot log into your account or transfer money out directly. Banks require additional verification—usually a password, PIN, or multi-factor authentication—before any transaction happens. However, your account number is still sensitive information. Combined with other details (your name, address, or routing number), it can be used to set up unauthorized transfers, create fraudulent checks, or establish accounts in your name.

The risk depends on what else the person has and what they do with it. Someone with your account number and routing number can attempt ACH transfers (electronic transfers between accounts). Someone with your account number, name, and address might be able to order checks or set up bill pay. The damage is real, but it is also containable if you act quickly.

Key Takeaways

  • Your account number by itself cannot be used to log in or withdraw money, because banks require passwords or other verification first.
  • Combined with your routing number, name, or address, your account number can be used to set up unauthorized ACH transfers or fraudulent checks.
  • Contact your bank when ready if you believe your account number has been compromised, before any fraudulent activity appears on your statement.
  • Your bank can place a fraud alert on your account, monitor for suspicious activity, and reverse unauthorized transfers if they occur within the dispute window.
  • You can also place a credit freeze with the three major credit bureaus to prevent someone from opening new accounts in your name.

What a hacker can do with your account number

If someone has your account number and routing number together, they can attempt to initiate an ACH transfer—a bank-to-bank electronic transfer. This is the most common way account numbers are misused. The person sets up a transfer from your account to theirs, often using a fake business name or shell account. Your bank may or may not catch it before it goes through, depending on how obvious the transfer looks and whether you have fraud monitoring turned on.

If someone has your account number, name, and address, they can order checks in your name and use them to pay for things or deposit them into their own account. This is slower than an electronic transfer but harder for banks to catch in real time, because check fraud is often discovered days or weeks later when the check clears.

Your account number alone—without a routing number or other details—is much less useful. A hacker cannot do much with it without knowing which bank it belongs to. However, if your account number was exposed in a data breach, it was likely exposed alongside other information, so assume the worst.

Steps to take if your account number has been compromised

Call your bank when ready. Do not wait for fraudulent activity to appear. Tell them your account number may have been exposed and ask them to flag your account for fraud monitoring. Most banks can place an alert that requires them to verify any large or unusual transaction before it processes. Some banks will issue you a new account number on the spot; others will wait to see if fraud occurs first.

Ask your bank what specific protections they have in place. Some banks offer zero-liability policies for unauthorized transfers, meaning you will not be held responsible for fraudulent ACH transfers or checks. Others require you to report fraud within a certain window (usually 30 to 60 days) to avoid liability. Get the name of the person you spoke to and the date, in case you need to reference the conversation later.

Review your account statements carefully for the next 30 to 90 days. Look for small test transfers (fraudsters often send $1 or $2 first to see if the transfer goes through), unusual ACH debits, or checks you did not write. If you see anything suspicious, report it to your bank when ready and ask them to reverse it. Banks have different timelines for disputing unauthorized transfers—ACH transfers usually have a longer dispute window than debit card transactions.

Protecting yourself from ACH fraud and check fraud

Set up account alerts with your bank. Most banks allow you to receive a text or email notification whenever a transfer over a certain amount is initiated. This gives you a chance to stop a fraudulent transfer before it clears. Set the threshold low enough that you will notice it—$100 or $500, depending on your normal transaction patterns.

Consider placing a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place a fraud alert for free by contacting any one of the three bureaus; they are required to notify the other two. The alert lasts one year and can be renewed.

If you are concerned about identity theft beyond just your bank account, consider a credit freeze. A credit freeze prevents anyone—including you—from opening new accounts in your name without unfreezing your credit first. It is free in most states and takes about 15 minutes to set up online with each bureau. A freeze is stronger protection than an alert but requires you to unfreeze temporarily if you want to explore for credit yourself.

How banks handle unauthorized transfers and your liability

Your liability for unauthorized transfers depends on your bank's policy and how quickly you report the fraud. Under the Electronic Funds Transfer Act, if you report an unauthorized ACH transfer within two business days, you are liable for no more than $50. If you report it between three and 60 days, you may be liable for up to $500. If you wait more than 60 days, you could lose the entire amount.

However, many banks offer stronger protections than the law requires. Some offer zero-liability policies for all unauthorized transfers, meaning you pay nothing regardless of when you report it. Check your account agreement or call your bank to find out what their specific policy is. If your bank does not offer zero liability, ask if they will make an exception given the circumstances.

If your bank reverses a fraudulent transfer, the money usually goes back into your account within 5 to 10 business days. If the fraudster already spent the money or moved it to another account, recovery becomes much harder and may require law enforcement involvement.

When to report the fraud to law enforcement

If the unauthorized transfer is large or if multiple transfers occur, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and gives you a recovery plan. You can also file a police report with your local police department, though many will not investigate bank fraud unless the amount is very large. The police report and FTC report together create documentation that can help if you need to dispute charges or prove the fraud to your bank.

If you believe your account number was exposed in a data breach, check HaveIBeenPwned.com to see if your email address appears in any known breaches. If it does, that breach report may tell you what information was exposed. This helps you understand what else a hacker might have and what additional steps you should take.

Frequently Asked Questions

Can someone open a new bank account using just my account number?

Not with just your account number. Banks require a Social Security number, government ID, and proof of address to open a new account. However, if a hacker has your account number along with your name, address, and Social Security number (from a data breach), they may be able to open an account in your name. This is why a credit freeze is useful—it prevents new accounts from being opened without your permission.

What is the difference between an ACH transfer and a wire transfer?

An ACH transfer is an electronic transfer between bank accounts that takes one to three business days to process. A wire transfer is faster (usually same-day) but requires more information and is harder to reverse. If someone has your account number, they are more likely to attempt an ACH transfer because it is easier to set up. Wire transfers typically require additional verification.

If my bank reverses a fraudulent transfer, does the money come back when ready?

No. Once your bank confirms the transfer was unauthorized, they will reverse it, but the money takes 5 to 10 business days to reappear in your account. During that time, you may see a temporary credit or a pending reversal on your statement. If the fraudster already withdrew the money from their account, recovery becomes much harder.

Should I close my bank account if my account number was compromised?

Not necessarily. Closing the account does not erase the account number from existence, and it may actually make fraud harder to detect if you are not monitoring it. Instead, ask your bank for a new account number and have your direct deposits and automatic payments switched to the new account. Keep the old account open for 30 to 60 days so you can monitor it for fraudulent activity, then close it.

Can I get my money back if a fraudster uses my account number to write checks?

Yes, but it takes longer. Check fraud is usually discovered when the check clears, which can be days or weeks after it was written. Once you report it, your bank will reverse the check and credit your account, but this process can take 10 to 30 days. In the meantime, you may overdraft if the fraudulent check is large. Ask your bank to waive any overdraft fees related to the fraudulent check.