Someone who has your bank account and routing number can pull money out of your account through electronic (ACH) debits, print counterfeit checks drawn on your funds, link your account to outside payment platforms, and use the digits as secondary ID to talk their way into other accounts in your name. None of this requires your PIN or your online banking password. How much of the loss you end up eating depends almost entirely on how fast you report it: federal law caps your liability at $50 if you tell your bank within two business days, but waiting past 60 days can leave you on the hook for everything taken after that window closes.
Unauthorized ACH Withdrawals
The Automated Clearing House network moves money between bank accounts for everything from payroll to utility bills. A person with your routing and account numbers can set up ACH debits against your account to pay their own bills, load prepaid cards, or move money to accounts they control. On your statement, these pulls look like ordinary recurring charges, which is why they often sit unnoticed next to legitimate monthly expenses.
Many online payment portals ask only for a routing number and account number to add a funding source. ACH rules require the account holder’s authorization before a debit can be originated, but enforcement runs through the receiving bank flagging the transaction after the fact, not blocking it in advance. Because ACH batches process overnight, the money is usually gone by the time you see the charge. Federal rules give you up to 60 calendar days from the date your bank sends the statement showing the unauthorized debit to dispute it and get the funds returned.
Counterfeit and Washed Checks
The routing and account numbers printed along the bottom of every check are all a criminal needs to produce a convincing counterfeit. With check-printing software and magnetic ink, a fraudster can create checks carrying your real banking information that pass through normal processing. Those counterfeits can be cashed at retail stores, deposited at bank branches, or run through mobile deposit apps, and the money comes straight out of your balance.
A related trick is check washing. Criminals steal a real check, often from an outgoing mailbox, use chemicals to dissolve the ink, then rewrite the payee name and the amount while leaving your account information intact.1United States Postal Inspection Service. Check Washing The altered check looks authentic because it is an authentic document. Creating or using counterfeit financial instruments is a federal felony.2Office of the Law Revision Counsel. 18 U.S. Code 514 – Fictitious Obligations
Account Linking Through Micro-Deposits
Financial apps and brokerage platforms often verify a new bank connection by sending two tiny deposits, usually a few cents each, and asking the user to confirm the exact amounts. A fraudster with your routing and account numbers can try to link your account to a platform they control by starting that verification. Some run strings of random account numbers hoping to hit a valid match, then use the confirmed link to pull larger transfers later.
Small, unexplained deposits (often under a dollar) from a company you don’t recognize can be the warning sign that someone is setting up a link against your account. Call your bank rather than ignoring the trivial amount.
Social Engineering Against Your Other Accounts
Account and routing numbers work as secondary verification at many companies. When someone calls your utility provider, phone carrier, or bank and reads off the correct banking details, it adds credibility to their claim that they are you. That can be enough to get a representative to reset a password, change a mailing address, or grant administrative access. Once a fraudster controls one account in your name, the information inside helps them compromise others. The Department of Justice recommends contacting any company where fraud occurred and asking them to freeze or close the compromised account immediately.3U.S. Department of Justice. Identity Theft and Identity Fraud
How Much You Could Actually Lose
The Electronic Fund Transfer Act and its implementing regulation (Regulation E) set a tiered liability structure that rewards fast reporting. What you can lose depends on how quickly you notify the bank after discovering unauthorized activity.
- Report within 2 business days of learning about the unauthorized transfer: your maximum liability is $50, or the total amount of unauthorized transfers before you notified the bank, whichever is less.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report between 2 and 60 days: maximum liability rises to $500. You remain responsible for the first $50 plus any additional unauthorized transfers the bank can show would not have happened if you had reported within two days.
- Report after 60 days from the statement date: you lose the federal cap entirely for unauthorized transfers that occur after the 60-day window closes. If the bank can show it could have stopped those later losses had you reported in time, you bear full responsibility for them.
These timelines are why checking your statements regularly is one of the strongest protections you have. A single missed statement cycle can dramatically increase your out-of-pocket exposure.
What to Do If It Has Already Happened
Call Your Bank’s Fraud Line
Call the dedicated fraud line, not general customer service. Ask the bank to freeze or close the compromised account and issue a new account number. Walk through the unauthorized transactions by date, amount, and merchant name. The bank will usually have you fill out a written notice identifying the unauthorized transfers; it is a standardized form, not a sworn legal document.5Consumer Financial Protection Bureau. Stopping Automatic Debit Payments – Sample Notice of Unauthorized Transfer
If the unauthorized charges are recurring ACH debits, you also have the right to place a stop-payment order. Under Regulation E, your bank must honor a stop-payment request as long as you submit it at least three business days before the next scheduled transfer.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers If you make the request by phone, the bank may ask for written confirmation within 14 days. Banks commonly charge a fee for stop-payment orders, typically between $15 and $36.
Know What the Bank Owes You After You Report
Once your bank receives your notice, it generally has ten business days to investigate and determine whether an error occurred.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The bank can extend the investigation up to 45 calendar days, but only if it provisionally credits your account for the disputed amount within the first ten business days. You have full use of that provisional credit while the investigation continues.8Office of the Law Revision Counsel. 15 U.S. Code 1693f – Error Resolution
File With the FTC and Consider a Police Report
If the unauthorized activity suggests broader identity theft, report it at IdentityTheft.gov. The site generates an FTC Identity Theft Report and builds a recovery plan with pre-filled dispute letters.9Federal Trade Commission. IdentityTheft.gov Filing a police report is optional but useful. Some banks and creditors want a police report number before processing a dispute, and having one documents the theft if you later need to challenge a ChexSystems record or an account opened in your name. Bring your FTC report, a government-issued photo ID, and proof of address when you go to the police department.
How to Keep It From Happening Again
Get a New Account Number, Not Just a Freeze
Freezing the compromised account is temporary. You need a new account number, and when you open the replacement, list every employer, service provider, and company that has the old digits for direct deposit or auto-pay and update each one. Any recurring payment you miss will bounce once the old account closes for good. If the bank closes a compromised account with an outstanding negative balance, the closure may be reported to ChexSystems, which can make opening accounts elsewhere harder.10ChexSystems. ChexSystems Frequently Asked Questions If that happens because of fraud rather than your own activity, dispute the record with ChexSystems using an identity theft affidavit.
Place a Fraud Alert on Your Credit File
A fraud alert tells lenders to verify your identity before opening new credit in your name. An initial fraud alert lasts one year, is free, and only requires contacting one of the three major credit bureaus; that bureau must notify the other two.11FTC. Credit Freezes and Fraud Alerts If you file an FTC Identity Theft Report, you can request an extended fraud alert that lasts seven years.12Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts Placing either alert also entitles you to a free copy of your credit report from each bureau.
Lock Down the Account Itself
Ask your bank about ACH debit blocks or filters. A debit block stops any electronic withdrawal unless the company initiating it is on your pre-approved list. This is especially useful for savings or emergency accounts you don’t use for everyday bill pay.
If you write checks regularly, ask whether your bank offers Positive Pay. The service matches every check presented for payment against a list of checks you have actually issued, comparing check number, amount, and payee, and flags anything that doesn’t match before paying it. Positive Pay is more common on business accounts, but some banks offer versions for personal customers.
For everyday check-writing, use a gel or ballpoint pen with pigmented ink; that type of ink resists the solvents used in check-washing. Don’t leave outgoing mail with checks sitting in an unsecured mailbox, and deposit checks through your bank’s mobile app or at an ATM rather than mailing them when you can.