Can Someone Steal Your Bank Info From a Check?

Yes, someone can steal your bank information from a check. Every check you write displays your name, address, bank, routing number, and account number, and those digits alone are enough for a thief to pull money electronically, print counterfeit checks on your account, or sell the data to someone who will. The paper itself does not need to leave your hands for the information to travel; a clear photo captures everything a criminal needs.

What Is Actually Printed on a Check

The top of a check shows your full legal name and mailing address, along with the bank’s name. The bottom edge carries the magnetic ink line: a nine-digit routing number identifying your bank, your unique account number, and the check number itself.1American Bankers Association. ABA Routing Number Those digits are printed for machines, but a smartphone camera reads them just as easily as a check scanner does.

With the routing and account numbers in hand, a thief can set up electronic withdrawals, pay their own bills from your balance, or create fresh checks drawn on your funds. They never need the original paper again. A lost, stolen, or photographed check is an open door to your checking account until you close it.

How Check Information Gets Stolen

Mail Theft

The most common route runs through the mail. Criminals pry open residential mailboxes or use stolen postal master keys to access blue USPS collection boxes, then pull out envelopes that appear to contain checks. The technique, called check fishing, sometimes involves sticky devices lowered through the slot. USPS has begun phasing out the universal arrow keys that made this easy, but the rollout has been gradual.

Checks also disappear from cars, purses, office desks, and unlocked homes. Rent payments taped to apartment doors and checks left on restaurant tables are easy targets.

Check Washing

Once a thief has a physical check, they often wash it, using chemicals like acetone or nail polish remover to dissolve the ink on the payee line and the dollar amount while leaving the printed bank details and your signature intact. The thief then rewrites the check to themselves for a larger amount. Gel ink was once considered resistant, but stronger solvents have largely closed that gap.

Digital Capture

A check does not have to be physically taken for its data to be compromised. A high-resolution phone photo during a transaction captures every digit on the bottom line in seconds. Dishonest employees, roommates, or anyone who handles your check briefly can snap a picture and walk away with everything they need. Some criminals also exploit mobile deposit systems by depositing the same check image into multiple accounts before banks catch the duplication.

What a Thief Does With Your Routing and Account Numbers

Those two numbers are versatile. The most common forms of misuse include:

  • Unauthorized ACH transfers. A thief enters your routing and account numbers on a website or payment portal and initiates electronic withdrawals, paying their bills, funding prepaid cards, or moving money to accounts they control.
  • Remotely created checks. These are payment instruments generated with your account information but without your physical signature. Instead, they carry a printed note stating that the account holder authorized the payment. The Federal Reserve has flagged remotely created checks as especially vulnerable to fraud because they lack a verifiable signature.2Federal Reserve. Board Announces Final Rule Governing Remotely Created Checks, Regulation CC
  • Counterfeit checks. With your account details, a thief can print convincing checks on blank stock from any office supply store. The counterfeits carry your real routing and account numbers, so they clear against your balance.
  • Resale on illicit marketplaces. Stolen bank account credentials are packaged and sold online, sometimes bundled with other personal data, and a single set of account details can pass through several buyers.

Early Signs Something Is Wrong

Check fraud rarely announces itself with a single dramatic withdrawal. Thieves test first, and the warning signs are easy to miss if you are not watching.

  • Small mystery transactions. Withdrawals or deposits under a dollar are classic verification tests. The thief confirms the account is active before escalating.
  • Unfamiliar payees or merchants. Any name on your statement you do not recognize, especially for ACH debits or electronic checks, deserves immediate investigation.
  • Check numbers out of sequence. If check 1087 clears while you are still writing check 1062, someone may be printing counterfeits.
  • Duplicate check numbers. Two transactions referencing the same check number almost always point to forgery.
  • Unexpected overdraft fees. A sudden overdraft notice on an account you expected to be healthy is one of the fastest signals that money has been drained. The average overdraft fee is roughly $31, so unauthorized transactions pile penalty charges on top of the stolen funds.
  • Returned-check notices. If your bank tells you legitimate checks are bouncing, a thief may have emptied the account before those checks arrived.

Real-time transaction alerts through your bank’s app are the single most effective early detection tool. A push notification when money leaves your account compresses the gap between theft and discovery from weeks to minutes.

How the Law Protects You, and the Deadlines That Govern It

Your protection depends on whether the fraud involved a paper check or an electronic transfer initiated with your check data. Different laws apply, and the distinction controls what you can recover.

Paper Check Fraud Under the UCC

Forged, washed, or counterfeit paper checks fall under the Uniform Commercial Code, adopted in some form by every state. The core rule is that a person is not liable on a check unless they actually signed it or authorized someone to sign it for them.3Legal Information Institute (LII) / Cornell Law School. UCC 3-401 Signature A bank that pays a forged check generally bears the loss, but that protection has a time limit.

Under UCC Section 4-406, you have a duty to review your bank statements with reasonable promptness and report any unauthorized checks. If the same thief forges a second check and your bank pays it in good faith, you lose the right to contest that second check if you had a reasonable window (up to 30 days) to catch the first and failed to do so. After one year without reporting, you lose the right to challenge any unauthorized signature or alteration at all.4Legal Information Institute (LII) / Cornell Law School. UCC 4-406 Customer’s Duty to Discover and Report Unauthorized Signature or Alteration

Electronic Transfers Under Regulation E

When a thief uses your routing and account numbers to initiate an electronic withdrawal, an ACH debit, or an online bill payment sourced from your check information, those transactions fall under the Electronic Fund Transfer Act, implemented through Regulation E. Paper check transactions themselves are explicitly excluded from Regulation E.5eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers

Regulation E sets a tiered liability structure based on how fast you report:

  • Within 2 business days of learning of the loss or theft, your maximum liability is $50 or the total of unauthorized transfers before you notified the bank, whichever is less.5eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
  • After 2 business days but within 60 days of your statement, your liability can reach $500, which includes transfers after the initial window that the bank can show it would have stopped if you had reported sooner.5eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
  • After 60 days, you can be liable for the full amount of any unauthorized transfers that happen after the 60-day window, with no cap. This is where people lose entire account balances.

The deadlines are unforgiving. The difference between reporting on day two and day three can be the difference between a $50 loss and a $500 one.

A Note on Business Accounts

Regulation E covers only consumer accounts held by natural persons for personal, family, or household purposes. A business checking account hit by the same fraud does not get the $50/$500 caps. Business accounts fall entirely under the UCC, which places more responsibility on the account holder to monitor statements and report quickly.

What to Do the Moment You Spot Fraud

Speed decides how much money you get back. The legal protections above all reward fast action and punish delay.

  • Call your bank’s fraud department immediately. Report every unauthorized transaction, dispute the charges, ask the bank to freeze or close the compromised account, and open a new one with a fresh account number. Request stop payments on any outstanding checks that have not cleared.6OCC (Office of the Comptroller of the Currency). Check Fraud
  • File a police report. Many banks and creditors require one before processing fraud claims. Bring statements, copies of forged checks if you have them, and any correspondence from the bank. Ask the officer to incorporate your identity theft complaint, which creates an Identity Theft Report that carries more weight with financial institutions.7Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud
  • Report to the FTC at IdentityTheft.gov. The site generates an FTC Identity Theft Report and builds a recovery plan with pre-filled letters you can send to banks and creditors.8Federal Trade Commission. IdentityTheft.gov
  • Place a security alert with ChexSystems, the consumer reporting agency banks check before opening new accounts. An alert or freeze on your ChexSystems file makes it harder for a thief to open new checking accounts in your name. You can manage it through the ChexSystems Consumer Portal or by calling 800-428-9623.9ChexSystems. Identity Theft Information
  • Complete an affidavit of forgery. Your bank will likely require a sworn statement, sometimes notarized, declaring that you did not authorize the transactions. The affidavit triggers the formal investigation.

Keep a written log of every call, every representative’s name, and every reference number. Banks sometimes lose track of fraud disputes, and your notes become the proof that you reported within the deadlines that protect your rights.

How to Reduce the Risk Before Anything Happens

Mail Checks Carefully

Never leave an outgoing check in an unlocked residential mailbox with the flag raised; that signals a thief that something worth taking is inside. Drop checks at the post office counter or inside the building’s slot. If you have to use a blue USPS collection box, do it right before a scheduled pickup rather than overnight.

USPS Informed Delivery emails you grayscale images of letter-sized mail headed to your address each morning.10United States Postal Service. Informed Delivery – Mail and Package Notifications If an expected check image appears in the digest but never arrives, that is an immediate red flag.

Order High-Security Checks

If you order checks, pay the extra few dollars for high-security stock. Useful features include chemical-sensitive paper that stains visibly if someone attempts washing, thermochromic ink that disappears with heat and cannot be photocopied, and true watermarks pressed into the paper that scanners cannot reproduce. No combination is foolproof, but each one pushes a thief toward an easier target.

Ask About Positive Pay (Business Accounts)

Businesses that write a significant volume of checks should ask their bank about Positive Pay. You upload a file listing every check you issue with its number, date, and amount, and the bank cross-references each check presented for payment against your list and flags anything that does not match. You approve or reject the exceptions before the bank pays them. Positive Pay catches counterfeit checks before money leaves the account.

Everyday Habits

Store your checkbook in a secure spot at home, not in a car console or an office drawer. Shred canceled checks and old bank statements. When paying a contractor, housekeeper, or anyone you do not know well, use an electronic payment method that does not expose your account numbers. And read your bank statements each month. The one-year UCC deadline and the 60-day Regulation E deadline both assume you are actually looking at what the bank sends you.

Use Stop Payments When a Check Goes Missing

If you know a specific check was lost or stolen before it was cashed, a stop payment order tells your bank to refuse it when it arrives. Most banks charge between $15 and $36, and the order typically lasts six months to one year depending on your state.11Consumer Financial Protection Bureau. How Do I Stop Payment on a Check After it expires, the check can potentially still be cashed, so renew the order if the check has not surfaced. A stop payment will not help if the thief has already used your routing and account numbers for electronic transfers; for that, you need the full fraud reporting process above.