If someone has your bank account number and routing number, they can pull money out through ACH transfers, print counterfeit checks drawn on your account, and use the digits as a prop in phishing calls aimed at the rest of your identity. Federal law caps what you owe for unauthorized electronic withdrawals, but only if you report quickly: miss the 60-day window after your statement goes out and you can be on the hook for every dollar taken after that.1CFPB. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
What a Scammer Can Actually Do
Pull Money Through ACH
Your account number and routing number are enough to initiate transfers on the Automated Clearing House network, the same rails used for direct deposit, online bill pay, and recurring subscriptions. Plenty of online payment portals accept those two numbers without any further check, so a scammer never needs your debit card, PIN, or online banking password to set up a withdrawal.
The same information can authorize a demand draft, a withdrawal request that does not require your signature. Because demand drafts often look like routine business payments, they can clear before anything looks off to the bank.2CFPB. What Is a Demand Draft, Telephone Check, or Preauthorized Draft?
Print Counterfeit Checks
With basic check-printing software and inexpensive magnetic ink toner, a fraudster can produce a check carrying your name, routing number, and account number that looks almost identical to one your bank issued. Those checks can be cashed at retail counters or deposited through mobile banking apps into accounts the scammer controls, and because they resemble ordinary business payments they often clear before anyone flags them.
Use the Number as a Lever for Bigger Theft
A caller who can recite your account number, or even just the last four digits, sounds like a bank employee. That is the point. The real goal is usually to pry loose information the scammer does not yet have: your Social Security number, your online banking password, or the one-time verification code the bank just texted you. Hand any of those over and the scammer can take control of your online banking profile, open new accounts in your name, or reach other financial assets tied to your identity.
How Much You Can Be Held Responsible For
The Electronic Fund Transfer Act and its implementing regulation, Regulation E, limit your liability for unauthorized electronic transfers from a personal bank account. The protection shrinks the longer you wait.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
When an access device such as a debit card is lost or stolen, the tiers work this way:
- Reported within 2 business days: your loss is capped at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
- Reported after 2 business days but before 60 days: your loss can rise to $500.
- Reported more than 60 days after the statement date: unlimited liability for transfers that happen after the 60-day window closes and before you finally notify the bank.
The 60-day rule still applies when no card was lost and a scammer simply has your account number. Any unauthorized transfer that appears on your periodic statement has to be reported within 60 days of the date the bank sent that statement, or you absorb the full cost of transfers that happen afterward.1CFPB. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers Read each statement when it arrives. A small unauthorized withdrawal caught early is the thing that keeps a much larger loss from landing on you.
One boundary to flag: these federal caps cover accounts established for personal, family, or household use. The EFTA’s definition of “account” excludes business and commercial accounts entirely.4Office of the Law Revision Counsel. 15 USC 1693a – Definitions If a scammer drains a business checking account, liability turns on your commercial agreement with the bank and on state law, not the fixed federal tiers above. Business owners should ask about ACH debit blocks or positive-pay services that require pre-authorization of every withdrawal.
What To Do Right Now
Call your bank’s fraud department before anything else. The number is on the back of your debit card or on the bank’s website. Ask for an immediate freeze on the account to stop further withdrawals. The bank will usually close the compromised account, move your remaining balance to a new account number, and reissue your debit cards and checks.
Have this ready when you call:
- The bank’s full legal name and the compromised account number.
- A list of suspicious transactions with the date, merchant or recipient name, dollar amount, and transaction ID. Pull these from your online statement.
- A driver’s license or passport for identity verification.
Most banks will then ask you to complete a fraud affidavit or statement of unauthorized debit, often available through the bank’s website. It is a legal declaration that you did not authorize the listed transactions, and some banks require you to sign it in person at a branch.
How Long the Bank Has
Under Regulation E, the bank must investigate and resolve your dispute within 10 business days of your report. It can extend the investigation up to 45 calendar days, but only if it provisionally credits your account for the disputed amount within those first 10 business days so you can use the money while the investigation continues. It then has three business days after finishing to tell you the result.5eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
File an Identity Theft Report
After your bank, file a report at IdentityTheft.gov, the FTC’s dedicated portal. It takes about 10 minutes online, or you can call 1-877-438-4338. The report creates a formal record proving to businesses and creditors that someone misused your identity.6IdentityTheft.gov. What To Do Right Away
That report also gives you specific rights. Businesses must provide copies of transaction records tied to the theft, such as applications or account statements, free of charge within 30 days of your written request.7Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft Those records help you document the fraud and sometimes reveal information about who took the account details.
If counterfeit checks are being written against your account, IdentityTheft.gov recommends contacting the check verification companies TeleCheck (1-800-710-9898) and Certegy (1-800-437-5120) to flag the stolen checks so merchants will refuse them.
Freeze Your Credit and Add a Fraud Alert
Someone with your bank information may have enough other personal data to open new credit accounts in your name. A credit freeze and a fraud alert with the three major credit bureaus (Equifax, Experian, and TransUnion) block that route. Both are free under federal law.8Federal Trade Commission. Credit Freezes and Fraud Alerts
- A credit freeze blocks credit bureaus from releasing your credit report to new lenders and lasts until you lift it. You have to contact each of the three bureaus separately.
- An initial fraud alert requires lenders to verify your identity before approving new credit. It lasts one year, is renewable, and only has to be placed at one bureau, which must notify the other two.
- An extended fraud alert lasts seven years and requires an FTC identity theft report or a police report.
A freeze is the stronger of the two because it shuts off access to your report entirely; a fraud alert only asks lenders to take extra verification steps. After bank account fraud, place both.
If the Bank Denies Your Claim
Banks sometimes reject fraud claims, usually because they think the transfers were authorized or the reporting deadline passed. If that happens, escalate by filing a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by phone at (855) 411-2372. The online form takes about 10 minutes.9CFPB. Learn How the Complaint Process Works
The CFPB forwards the complaint to the bank, which generally has to respond within 15 days. You then have 60 days to review the response and reply. The CFPB also shares complaint data with other federal and state agencies, so a complaint can draw broader regulatory attention beyond your case.
Making the Account Harder To Hit Next Time
Once the compromised account is closed, tighten the new one. Most banking apps let you turn on real-time alerts the moment money moves. At a minimum, enable alerts for large transactions, low balances, login activity, and profile changes such as a new email address or phone number. Profile changes often come right before fraud attempts.
Set custom thresholds too. If you rarely spend more than a certain amount in one transaction, set an alert there and you will hear about anything bigger immediately. Alerts for peer-to-peer transfers, international transactions, and declined transactions add more early warning.
Some banks offer ACH debit blocks that reject incoming ACH withdrawal requests unless the sender is pre-approved. The feature is more common on business accounts, but ask whether your bank offers something similar for personal accounts. Even without a formal block, reading your statements each month and reporting anything unauthorized inside the 60-day window remains the strongest protection federal law gives you.1CFPB. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers