No, someone cannot hack your bank account with just your account number. An account number works like a mailing address for money: it tells the banking system where funds should go, but it does not unlock the door. A person who has your account and routing numbers can attempt unauthorized ACH debits and forge checks, which are real risks worth taking seriously. What they cannot do is log into your online banking, change your password, or drain the account in a single sweep. The distinction between those two categories of risk is the whole answer to how worried you should be.
What Someone Can Actually Do With Your Account Number
Two attacks are possible with nothing more than your account number and your bank’s routing number, both of which are printed on every paper check you write.
The first is an unauthorized ACH debit, sometimes called a “pull.” This is the same mechanism a utility company uses when you authorize it to withdraw a bill payment from your checking account. The ACH network reaches every U.S. bank and credit union, and it runs on the assumption that whoever submits a payment request had permission to do so.1Nacha. The ABCs of ACH A fraudster can abuse that trust by submitting a debit you never authorized.
The second is check fraud. A criminal can print your account and routing numbers onto counterfeit checks and try to cash them or use them at retailers. Check washing is a related tactic: thieves steal real checks from the mail, use household chemicals like acetone or bleach to dissolve the ink in the payee and amount fields while leaving your signature intact, then rewrite the check to themselves for a larger amount.
Both types of fraud leave a trail. ACH debits move through a regulated clearinghouse that carries originator information, and cashed checks generate paper records. Account-number-only fraud tends to produce individual bad transactions, not a wholesale takeover of your finances.
What They Cannot Do Without More Information
Your account number will not get anyone into your online banking. Every bank requires a separate username and password, and neither appears on a check or gets shared in normal transactions. Even if a fraudster guessed your username, modern banks add a second authentication factor: a one-time code sent by text, produced by an authenticator app, or confirmed through a push notification on your phone. Your account number satisfies none of those requirements.
The number also cannot be used to change your mailing address, add new payees, order a replacement debit card, or modify any account setting. Those actions live behind the login wall. That is precisely why banks are comfortable printing your account number on every check.
How Criminals Try to Turn a Number Into Something Bigger
The real risk is not the number itself. It is what a skilled scammer can do with it as a conversation starter.
Fraudsters use a stolen account number as a credibility prop during phishing calls. Someone claiming to be from your bank’s fraud department reads back the last four digits of your account number, tells you a suspicious charge just posted, and pressures you to confirm a one-time code that “just arrived on your phone.” That code is actually the code your bank sent to authorize a password reset the scammer just requested. Once they have it, they can take over the account.
SIM swapping is another escalation route. A criminal convinces your mobile carrier to move your phone number to a new SIM card in their possession. Every text and call, including one-time security codes, then routes to the attacker. Having your account number is not required for the swap, but it makes the phishing pitch that follows more believable.
Fake job offers and rental applications are increasingly used to harvest bank details directly. A supposed employer sends you a “direct deposit form” and asks for a voided check. A fake landlord requests bank information for “credit verification.” The job and the apartment do not exist, but your account and routing numbers are now in the fraudster’s hands, ready to be used for unauthorized debits or as ammunition in a follow-up phishing attempt.
The common thread: the criminal needs your cooperation, or your phone carrier’s cooperation, to get beyond what an account number alone can do. The number opens a conversation. Your response decides whether they get anything more.
Your Legal Protection If Fraud Happens
Federal law is more protective of consumers in account-number-only fraud than many guides suggest. The Electronic Fund Transfer Act and its implementing rule, Regulation E, treat the two situations differently: fraud committed with a lost or stolen “access device” like a debit card, and fraud committed by someone who simply used your account number without an access device.
Account-Number-Only Fraud on a Personal Account
When an unauthorized electronic transfer hits your account and no access device was lost or stolen, the tiered $50 and $500 caps that many articles cite do not apply. Those tiers exist only for lost or stolen cards. For account-number-only fraud, the rule is simpler: if you report the unauthorized transfer within 60 days of your bank sending the statement that shows it, your liability is zero.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
The regulatory commentary gives a plain example. If $200 is debited from your account without authorization and without an access device, and you notify the bank within 60 days of the statement being sent, you owe nothing. But if you let the 60-day window pass and a second unauthorized transfer of $400 hits on day 61, you can be held liable for that later transfer, because the bank can argue it would not have happened if you had reported the first one on time.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
When a Debit Card or PIN Is Involved
If the fraud did involve a lost or stolen card or PIN, the tiered liability rules apply. Reporting within two business days of discovering the loss caps your liability at $50. Reporting after two business days but within 60 days of the statement raises the cap to $500. Missing the 60-day window entirely can leave you liable for everything that happens afterward.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) The statute also requires the card to have been an “accepted” card and the issuer to have provided a way to identify the authorized user before any consumer liability attaches.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
How Long the Bank Has to Investigate
Once you report the fraud, your bank has 10 business days to investigate and decide whether an error occurred. It can take up to 45 calendar days instead, but only if it provisionally credits your account for the disputed amount within the initial 10 business days and tells you about the credit within two business days after that. The window stretches to 90 calendar days if the transfer was a point-of-sale debit card transaction, occurred within 30 days of the first deposit to a new account, or was not initiated within a state.5Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors
One boundary to note: these protections cover personal accounts held by natural persons for personal, family, or household purposes. Business accounts fall under the Uniform Commercial Code and different, generally less protective rules, so a business hit by the same kind of fraud has a harder path to a refund.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
What to Do If Your Account Number Is Compromised
Speed matters, because your zero-liability protection depends on reporting within 60 days of your statement. Do not wait for a statement to arrive. Act as soon as you suspect the number is in the wrong hands, even if no fraudulent transaction has posted yet.
- Call your bank immediately. Report the compromise and ask about a fraud alert. Your bank may recommend closing the account and opening a new one, or it may be able to block specific incoming debits. If unauthorized transactions have already posted, file a formal dispute so the Regulation E investigation clock starts running.
- Review recent statements line by line. Look for any unfamiliar debit, no matter how small. Fraudsters often test an account with tiny withdrawals before trying a larger one.
- File an identity theft report at IdentityTheft.gov or call 1-877-438-4338. The site generates an Identity Theft Report and a personalized recovery plan, which you can use to dispute fraudulent accounts or charges with businesses, credit bureaus, and debt collectors.6IdentityTheft.gov. What To Do Right Away
- Request a free ChexSystems report. ChexSystems tracks checking account history across banks, so a copy will show whether someone has opened a new account in your name. The number is 1-800-428-9623.6IdentityTheft.gov. What To Do Right Away
- Update any automatic payments. If you close the compromised account, every autopay linked to it will fail. Make a list of recurring charges (utilities, subscriptions, loan payments, insurance) and update each one with your new account details before the next billing cycle.
Most banks charge no fee to close a compromised account and open a replacement. The real cost is the downstream work of updating direct deposits and every recurring payment.
Reducing Your Risk Going Forward
You cannot keep your account number completely secret. It is on every check you write and every direct deposit form you submit. But you can make it much harder for someone to exploit.
- Use gel ink pens for checks. Gel ink bonds to paper fibers more effectively than ballpoint ink, which makes checks significantly more resistant to chemical washing. The American Bankers Association recommends gel pens for this reason.
- Send fewer paper checks. Every check in the mail is a check that can be stolen. Online bill pay, ACH transfers you initiate, and peer-to-peer payment apps move money without exposing a physical document.
- Turn on transaction alerts. Most banking apps let you set push notifications for any debit over a threshold you choose, even one cent. Real-time alerts mean you spot an unauthorized transaction within minutes rather than at the end of the month, which keeps you comfortably inside the 60-day reporting window.
- Never share security codes. Your bank will not call and ask for a one-time passcode, your full password, or your PIN. Anyone who does is running a scam, no matter how convincing the story or how much account information they read back to you.
- Lock your SIM or move to app-based authentication. Ask your mobile carrier to add a PIN before any SIM change or number transfer can go through. Better still, use an authenticator app instead of SMS for two-factor authentication, because app-generated codes cannot be captured through a SIM swap.
Your account number creates a narrow window of risk, not an open door. Someone who has it can attempt specific, traceable types of fraud that federal law protects you against, as long as you read your statements and report problems promptly. The number itself is not the danger. What matters is whether a scammer can use it to pressure you into handing over something more valuable.