What Can Someone Do With Your Bank Account Number?

TL;DR: With your account and routing numbers, a fraudster can try to set up ACH debits, print fake checks or pay some online merchants, but the account number alone usually isn't enough to withdraw cash. US law caps your losses on unauthorised electronic transfers if you report quickly: $50 within two business days, generally up to $500 after that, and you must report anything on a statement within 60 days or risk losing more. Watch statements and set up alerts.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

Why your account number isn't really secret

Your bank's routing number is public; it just identifies the bank. Your account number is printed on every check you write and shared with every employer, landlord and utility that pays you or debits you. So the question isn't how to keep it secret, it's what someone can do with it and how you're protected.

What a fraudster can do with it

SoFi's overview lists the main risks:

ACH debits: set up payments from your account to a service or merchant, or pull money out using an electronic transfer.
Fake checks: print counterfeit checks with your details, or copy a real one and deposit it elsewhere. Mailed checks are often stolen and "washed" to change the payee and amount.
Online purchases: some merchants accept account and routing numbers for payment.
Using your account to move money: unexpected deposits followed by a request to "send it back" are a classic overpayment or money-mule scam.

The account number alone usually isn't enough to withdraw cash at a branch or log into online banking. The danger grows when it's combined with your name, date of birth, address and online banking password, which is exactly what breaches and phishing collect. See how to recover a hacked bank account if someone already has your login.

Your protection under US law

Regulation E covers unauthorised electronic transfers, including debit card and ACH. The FTC explains the limits:

$0 if you report before any unauthorised transactions.
Up to $50 if you report within two business days of learning about it.
Up to $500 if you report after two business days but within 60 days of your statement.
Potentially unlimited for transfers after that 60-day window, under 12 CFR 1005.6.

Paper check fraud is handled differently, under state law and your account agreement, so report forged checks to your bank immediately too.

What to do if someone has your account number

Call your bank's fraud line using the number on your card or statement, not one from a text or email.
Ask about blocks on ACH debits you haven't authorised, and whether to close the account and open a new one with a new number.
Dispute unauthorised transactions in writing and keep copies.
Report identity theft at IdentityTheft.gov if your other details were used; see how to report identity theft to the FTC.
Freeze your credit so new accounts can't be opened in your name: how to freeze your credit.

How to protect your account

Turn on transaction alerts for every debit and deposit.
Read statements monthly, not just the balance.
Use a credit card or a payment app online rather than typing in account and routing numbers.
Write fewer paper checks, and drop any you do send inside the post office rather than in a street mailbox.
Never "return" an unexpected deposit by wire or gift card. Call the bank.
Be wary of callers claiming to be your bank's fraud team; see US bank impersonation scams.

In the UK

Your sort code and account number are also widely shared. If a Direct Debit is taken in error, the Direct Debit Guarantee entitles you to a full and immediate refund from your bank. Report anything you don't recognise straight away.

Banking details leak alongside your email in many breaches. A free email exposure check shows which breaches include your email.

Frequently Asked Questions

Can someone take money with just my bank account number?

Usually not on its own, but combined with your routing number they can attempt ACH debits, fake checks or some online payments. Report any unauthorised transaction to your bank immediately.

What can someone do with my account and routing number?

Try to set up ACH debits, create counterfeit checks, pay some online merchants, or use your account in overpayment and money-mule scams.

Am I liable for unauthorised ACH transactions?

Under Regulation E your liability is $50 if you report within two business days, generally up to $500 after that, and potentially unlimited for transfers after 60 days from your statement.

Should I close my bank account if someone has my account number?

If fraud has happened, ask your bank about closing the account and opening a new one with a new number. Otherwise, set up alerts and watch statements closely.

Is it safe to give my bank account number to an employer?

Yes, for direct deposit through an official payroll system. Do not send it to unverified contacts by email or text.

What Can Someone Do With Your Bank Account and Routing Number?