Yes, but only under specific conditions—and your bank's fraud protections limit the damage

A checking account number alone is not enough to drain your account. Someone would need either your routing number paired with your account number, or access to your online banking login, or a forged check with your signature. The checking account number by itself is essentially a routing address—it tells a bank where to send money, but not how to pull it out. That said, the combination of your account number and routing number (both printed on every check you write) is enough for someone to set up unauthorized transfers or recurring payments, which is why you need to act quickly if you suspect compromise.

Key Takeaways

  • Your checking account number alone cannot be used to withdraw money, but paired with your routing number it can be used to set up ACH transfers or bill payments without your permission.
  • Forged checks written against your account are the most common theft method using account information, and they can take weeks to reverse.
  • Your bank's fraud liability limits your personal loss to $50 if you report unauthorized activity within two business days, and $500 if you report within 60 days.
  • Freezing your account when ready stops new transfers and checks, but does not reverse ones already processed—you will need to dispute those separately.
  • Unauthorized ACH transfers and bill payments are easier to reverse than forged checks because they leave a digital trail that banks can track.

What thieves can actually do with your account and routing number

If someone has both your checking account number and your routing number, they can initiate an ACH (Automated Clearing House) transfer to move money out of your account, or set up a bill payment in your name. They can also write forged checks against your account. None of these require your password or online banking access—they only require the account information that appears on the bottom of every check you write.

ACH transfers are the fastest method because they process within one to three business days and often go through before your bank's fraud detection catches them. Bill payments set up through a biller's website are similar—the thief creates an account at a utility company or credit card issuer, links your checking account as the payment method, and initiates a payment. Forged checks are slower but harder to trace because they require physical mail and manual processing at the receiving bank.

How to stop new unauthorized activity when ready

Call your bank's fraud line right now—not the main customer service number, but the specific fraud or security line listed on the back of your debit card or on your bank's website. Tell them you suspect your account number has been compromised and ask them to freeze your account. A freeze stops new ACH transfers, bill payments, and debit card transactions from going through. It does not reverse transactions already posted, but it prevents the bleeding from continuing.

After the freeze, ask your bank to issue you a new account number and new debit card. This is standard and usually happens within three to five business days. Your old account number becomes inactive, so even if the thief tries to use it again, the transfer will fail. Do not close the old account yet—you may need it open to dispute fraudulent transactions and receive credits.

Disputing unauthorized transfers and forged checks

Unauthorized ACH transfers and bill payments are disputes, not fraud claims. File a dispute with your bank within 60 days of the transaction appearing on your statement. The bank will contact the receiving institution and request a reversal. Most ACH disputes resolve within 10 business days because the receiving bank can see the transfer came from an account that did not authorize it. If the thief sent money to another bank account they control, that receiving bank is usually required to freeze the funds pending investigation.

Forged checks are more complicated. When you report a forged check, your bank will investigate whether the check was processed through their system or through another bank. If another bank cashed it, your bank has to contact that bank and request a chargeback. This can take 30 to 60 days. During that time, the check amount remains deducted from your account. Once the chargeback is approved, the funds return to you, but you may see a temporary credit first while the investigation continues.

Your fraud liability limits under federal law

The Electronic Funds Transfer Act limits your personal liability for unauthorized transfers. If you report the unauthorized activity within two business days of discovering it, your liability is capped at $50. If you report within 60 days, your liability is capped at $500. If you wait longer than 60 days, you may be liable for the full amount, though many banks extend this window as a courtesy.

This protection applies to ACH transfers, bill payments, and debit card transactions. Forged checks are handled under different rules—the Uniform Commercial Code—and your bank is generally liable for the full amount if they failed to catch the forgery, though the process of getting that money back takes longer. Report any suspicious activity as soon as you see it on your statement, even if you are not certain whether it is fraud. The 60-day clock starts from when the transaction appears on your statement, not from when it was processed.

Checking your account for unauthorized activity you may have missed

Log into your online banking and review your last 90 days of transactions. Look for ACH transfers to unfamiliar bank accounts, bill payments to companies you do not use, and checks that cleared but you did not write. Many people discover unauthorized activity weeks after it happens because they do not check their statements regularly. Set up transaction alerts through your bank's app if you have not already—most banks let you receive a text or email whenever a transaction over a certain amount posts to your account.

If you find unauthorized activity, take screenshots of each transaction and note the date, amount, and receiving institution. This documentation speeds up the dispute process. Do not delete emails or statements. Your bank will ask for proof of the unauthorized nature of the transaction, and the clearer your record, the faster the dispute resolves.

Preventing future compromise of your account information

Stop writing checks if you can. Checks contain all the information a thief needs to drain your account, and they sit in mailboxes for days. If you must write checks, use a locked mailbox for outgoing mail and collect incoming mail promptly. Do not leave blank checks in your car or bag.

Be cautious about where you provide your account number. Legitimate billers (utilities, insurance companies, mortgage lenders) need it to set up automatic payments, but you should initiate those payments yourself through your bank's bill pay system rather than giving the number directly to the company. If a company calls asking for your account number, hang up and call them back using the number on your bill or their official website. Phishing emails and calls that appear to come from your bank are common—your real bank will never ask for your account number or password via email or phone.

What to do if your bank denies your dispute

If your bank denies a dispute and you believe the transaction was genuinely unauthorized, you have the right to escalate. Ask to speak with the disputes department supervisor and provide any additional documentation—emails showing you did not authorize the transaction, proof that you reported it promptly, or evidence that the receiving institution has frozen the funds. If the bank still denies it, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints and can pressure banks to reconsider.

Some banks also have a second appeal process. Ask whether your bank allows you to request a second review of the dispute decision. This is less common but worth asking about, especially if new evidence has come to light or if you believe the bank made an error in their investigation.

Frequently Asked Questions

Can someone withdraw cash from an ATM using just my account number?

No. ATM withdrawals require a debit card and PIN, or a mobile wallet linked to your phone. Your account number alone cannot access an ATM. However, if someone has your account number and routing number, they can transfer money to their own account and then withdraw it from an ATM they control.

How long does it take to get my money back after I report fraud?

ACH transfers and bill payments usually reverse within 10 business days. Forged checks take 30 to 60 days because they require investigation by two banks. Your bank may issue a provisional credit within a few days while the investigation continues, but the final credit depends on the outcome of the dispute.

Will my bank close my account if I report fraud?

Banks rarely close accounts because of fraud reported by the customer. They may close accounts if they detect a pattern of fraud that suggests you are not protecting your information, or if you are involved in suspicious activity yourself. Reporting fraud promptly actually protects your account standing because it shows you are monitoring it responsibly.

Do I need to file a police report for unauthorized transfers?

You do not need a police report to dispute the transactions with your bank, but filing one creates an official record that can help if the dispute is denied or if the amount is large. Contact your local police non-emergency line and ask whether they take reports for online fraud. Many departments now handle these reports online or by phone rather than in person.

What if the thief set up a bill payment to a company I actually use?

Dispute it with your bank the same way you would any other unauthorized transaction. The fact that the company is legitimate does not make the payment authorized. Your bank will contact the company and request a reversal. The company will see that the payment came from an account that did not authorize it and will cooperate with the reversal, though this sometimes takes longer than a transfer to a personal account.