Giving someone your bank account number is safe to do in most everyday situations, and it is often unavoidable: employers need it for direct deposit, the IRS needs it for refunds, utilities and insurers need it for recurring payments, and the same digits sit in plain magnetic ink at the bottom of every paper check you write. If those numbers do end up with a thief, federal law caps your exposure at zero for unauthorized electronic withdrawals as long as you report the problem within 60 days of the statement that shows the charge. The real question is not whether to share your account number, but how the protections work and where they stop.
The Risks If the Numbers Reach the Wrong Person
An account number by itself is not a key to your money. Combined with your routing number, though, it opens a few specific doors for fraud.
The most common attack is an unauthorized ACH debit. A thief enters your account and routing numbers into an online payment portal and pulls funds out while pretending to be you. ACH transactions do not require a card or PIN, so they can be initiated from anywhere with an internet connection.
A second route runs through what are called remotely created checks. These are payment instruments carrying your account information but no handwritten signature. Under the Uniform Commercial Code, the bank that processes one of these checks warrants that the account holder actually authorized the payment, which gives your bank a legal basis to recover funds if you did not.1Legal Information Institute. UCC 3-417 – Presentment Warranties Sophisticated fraudsters also manufacture counterfeit paper checks that look like the real thing and cash them at retail locations or deposit them elsewhere before the fraud surfaces.
A third tactic exploits micro-deposit verification. Some platforms confirm account ownership by sending a few cents and asking the account holder to verify the amount. Fraudsters link strings of random account numbers to brokerage or payment accounts hoping to hit a valid one, then use the verified link to pull larger sums.
Finally, a stolen account number can feed synthetic identity fraud, where criminals combine real pieces of data with fabricated names and birthdates to build new identities used to open fraudulent accounts and route stolen funds through shell companies.2United States Department of Justice. Two Men Who Allegedly Used Synthetic Identities Charged in Miami Federal Court
What Federal Law Refunds You
The Electronic Fund Transfer Act and its implementing Regulation E cover virtually every electronic debit from a consumer account, including ACH withdrawals, debit card charges, and transfers through real-time networks like FedNow.3Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose4eCFR. Subpart C – Funds Transfers Through the FedNow Service
Here is the scenario that matters when all you shared was your account number. If a thief uses your account and routing numbers to initiate unauthorized ACH debits or other electronic transfers without stealing a debit card or PIN, the tiered $50 and $500 liability caps described below do not apply at all.5Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers Your only obligation is to report the unauthorized transfer within 60 days of the date your bank sends, or makes available, the statement showing the charge. Report inside that window and your liability is zero. The bank must return the full amount.
Miss the 60-day window and you can be held responsible for unauthorized transfers that occur after day 60 and before you eventually notify the bank. Even then, the bank must prove those later transfers would not have happened if you had reported on time.6eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The original unauthorized charge on the statement you missed remains the bank’s responsibility.
If your bank delivers statements electronically, the 60-day clock begins when the institution transmits the statement, not when you open it. For prepaid accounts that provide electronic transaction history instead of formal statements, the window starts on the earlier of the date you actually access the history showing the unauthorized transfer, or the date the institution sends you a written history you requested.7eCFR. Part 1005 – Electronic Fund Transfers (Regulation E)
Debit Card or PIN Fraud Follows Different Tiers
If a thief got hold of your debit card, PIN, or another access device your bank issued, a stricter tiered system kicks in.8Consumer Financial Protection Bureau. 1005.2 Definitions This is a separate scenario from sharing an account number, but worth knowing because people often confuse the two.
- Report within 2 business days of learning of the loss or theft and your maximum liability is $50, or the amount taken before you notified the bank, whichever is less.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of your statement and liability can rise to $500 for transfers that occurred between the end of the two-day window and the date you notified the bank.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Fail to report within 60 days of your statement and you can face unlimited liability for transfers that occur after the 60-day window closes.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Extenuating circumstances such as extended travel or hospitalization can push these deadlines to a reasonable period under the circumstances.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Paper Check Fraud Follows a Separate Track
Forged or altered paper checks are not covered by Regulation E. A separate body of law, the Uniform Commercial Code, applies, and it imposes different duties on you.
You have a duty to review your bank statements with reasonable promptness and report unauthorized checks. If you do not, and the bank acted in good faith, you lose the right to dispute subsequent forged checks paid after a reasonable review period of up to 30 days from the date the statement was made available. There is also a hard outer deadline: if you fail to discover and report a forged signature or alteration within one year of receiving the statement, you are barred from challenging it regardless of the circumstances.10Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
If You Run a Business, the Protections Shrink
Regulation E protects consumer accounts only. An unauthorized ACH debit against a business checking account falls outside that framework. Instead, the ACH network’s own operating rules apply. Your bank can file a warranty claim against the bank that originated the unauthorized debit, but the deadline is one year from the settlement date of the transaction.11Nacha. Limitation on Warranty Claims That one-year lookback is meaningful, but it does not come with the provisional credit or strict investigation timelines that consumers receive. If you run a business, ask your bank about ACH debit blocks or positive-pay services.
How to Report Unauthorized Transactions
Speed matters more than formality. Call your bank’s fraud department as soon as you notice the charge. An oral report is enough to start the process and start the clock on your protections.12Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution Follow up with a written notice of error containing your name, account number, the disputed transaction, the amount, and why you believe it is wrong. Your bank may require that written confirmation within 10 business days of your call.
Once the bank has your notice, it has 10 business days to investigate and tell you whether an error occurred. It can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days.13eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors You have full use of those provisional funds during the investigation. If the bank confirms the error, it must correct it within one business day. If it finds no error, it must explain its findings within three business days and may reverse the provisional credit.12Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
Longer timelines apply in a few situations. For accounts less than 30 days old, the bank gets 20 business days before it must issue provisional credit and 90 days to complete its investigation. The 90-day window also applies to international transfers and point-of-sale debit card transactions.7eCFR. Part 1005 – Electronic Fund Transfers (Regulation E)
If the unauthorized activity looks like part of a broader identity theft, file a report at IdentityTheft.gov. That generates an FTC Identity Theft Affidavit, which you should print immediately because you cannot retrieve it after leaving the page. Combined with a police report, the affidavit forms a formal Identity Theft Report that strengthens your position when disputing fraudulent activity with your bank and other businesses.14Federal Trade Commission. Identity Theft: What to Do Right Away
Habits That Keep Sharing Safe
A few straightforward habits reduce the odds of ever needing to use those protections:
- Verify the recipient before you share. If a caller claims to be from your bank, hang up and call back using the number on your debit card or the bank’s official site.
- Avoid public Wi-Fi for anything involving account numbers. Use your home network or a VPN.
- Keep account and routing numbers out of email and text messages, which are not encrypted end-to-end. Use your bank’s secure portal or hand the information over in person when you can.
- Turn on transaction alerts. Most banks will text or email you for every debit or for transactions above a threshold you set, so you catch problems in hours instead of weeks.
- Review statements promptly. The 60-day clock that protects you starts when the statement is sent, not when you read it.
When to Close the Account
If you think your account number has been exposed but no fraud has happened yet, ask the bank to freeze the account, then close it. Move the balance to a new account and update every service tied to the old number, including direct deposits, autopayments, and payment apps.
If unauthorized transactions have already hit the account, do the opposite: leave it open until the dispute is resolved. Closing a compromised account before your bank finishes its investigation can complicate recovery of the stolen funds. Ask the bank to freeze outgoing transactions while the claim is pending, and keep monitoring until you have a final determination.