Someone who has your checking account number and routing number can pull money out of your account through ACH debits, print counterfeit checks that carry your real name and address, and pay their own bills using an “e-check” option that asks for nothing more than those two numbers. They cannot log into your online banking, use an ATM, swipe a debit card, or send a wire. Federal law fully reimburses you for unauthorized electronic transfers if you report them within 60 days of the statement that shows them, so what you can do with your checking account number matters far less than how quickly you spot the fraud.
ACH Debits Pulled From Your Account
The Automated Clearing House network lets a recipient pull funds from your account after entering your routing and account numbers on a payment form. No card, PIN, or signature is involved. This is the same mechanism people use legitimately to pay credit card bills and loan installments, which is exactly why it works for fraudsters. Your bank has no reason to flag the transfer at the point of initiation because the request originates from the recipient’s side.
A thief can also schedule the pull as a recurring debit for something ordinary like an insurance premium or a subscription. Those charges look routine on a statement, and if you don’t review closely they can bleed the account for months.
Counterfeit and Washed Checks
Blank check stock and desktop publishing software are widely available. With your account and routing numbers, a fraudster can print checks that include your correct name and address, which helps them clear manual verification at retailers and check-cashing outlets that don’t verify electronically.
Check washing is the related threat. A criminal intercepts a check you’ve already mailed, uses chemicals to dissolve the ink, then rewrites the payee and amount while your account information stays intact. Pigmented gel ink resists the process because the color particles absorb into the paper fibers.
Under the Uniform Commercial Code, a check bearing a forged signature is not “properly payable,” so your bank generally cannot charge your account for it.1Legal Information Institute (LII) at Cornell Law School. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration That protection depends on you reviewing statements and reporting forgeries promptly. Sit on a forged check too long and the bank’s obligation to reimburse shrinks.
E-Check Payments for the Thief’s Own Bills
Many utilities, insurance companies, and online retailers accept “e-check” payment, which asks only for a routing and account number. A thief can use that option to pay their own electric bill, phone plan, or insurance premium with your money. These transactions appear on your statement with ACH entry codes like “WEB” for internet-initiated payments or “TEL” for telephone-initiated ones, rather than as card purchases.
Because no physical card is involved, e-check payments bypass the fraud algorithms that card networks use. A $300 utility payment processed as an ACH debit looks routine to most monitoring systems, which makes your own statement review the primary line of defense.
What They Cannot Do With Just These Two Numbers
The account number and routing number alone do not open every door. A thief holding only those two cannot log into your online banking, withdraw cash at an ATM, or make point-of-sale purchases with a debit card. They cannot initiate an outgoing wire transfer, which requires separate authentication through your bank. They cannot change account settings, reset your password, or add themselves as an authorized user.
The risk is real but bounded: ACH debits, counterfeit checks, and e-check payments. If a thief also has your Social Security number, date of birth, or online banking credentials, the exposure escalates into full identity theft, but the two numbers on the bottom of a check don’t get them there by themselves.
Your Liability Depends on How Fast You Report
The Electronic Fund Transfer Act and its implementing rule, Regulation E, govern unauthorized electronic transfers from a consumer account.2Consumer Financial Protection Bureau. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) When no access device such as a debit card was stolen, and the fraud was carried out with your account number only, the rule is straightforward:
- Report within 60 days of the statement that shows the unauthorized transfer and you owe nothing. The bank must restore the full amount.
- Report after 60 days and you’re still protected for the transfers on the statement you missed, but you become liable for any additional unauthorized transfers that occur after that 60-day window closes and before you finally notify the bank.3Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The 60-day clock starts when the bank sends the statement, not when you open it. If a thief sets up recurring ACH debits and you ignore three months of statements, you could be on the hook for everything that drained after the first window closed.
How to Report Unauthorized Transactions
Call your bank the moment you spot a suspicious transaction. An oral report starts the clock on your Regulation E protections. Follow up in writing if the bank asks, but get the initial notice on record immediately.
After the call:
- Go through your statements and note every unauthorized transaction with its date, amount, and merchant.
- File a police report. Many banks require a case number before they finalize a fraud claim.
- Complete the bank’s fraud forms: a signed affidavit of forgery for check fraud, or a written statement of unauthorized debit for ACH transactions.
- File an identity theft report at IdentityTheft.gov if you suspect the account theft is part of something broader. That report creates a recovery plan and generates documentation banks and creditors accept.
Have your government ID and the police report handy when you fill out the forms. Be specific about dollar amounts and merchant names for each disputed item; vague claims slow the investigation.
Securing the Account and Getting Your Money Back
Your bank will typically close the compromised account and issue a new number once you report the fraud. Under Regulation E, the bank must provisionally credit the disputed amount within ten business days while it investigates. The investigation can take up to 45 calendar days. For new accounts opened within 30 days of the first deposit, transactions not initiated domestically, or point-of-sale debit card transactions, the bank gets up to 90 days.4Federal Reserve. Electronic Fund Transfer Act – Regulation E Manual
Once the new account is open, update every legitimate automatic payment with the new number: rent, utilities, loan payments, subscriptions, direct deposit. This is the step people most often botch, which leads to missed payments and late fees on bills that had nothing to do with the fraud. Write out a list of every recurring ACH debit and credit before the old account closes.
Stopping Unauthorized Recurring Debits
If a fraudster set up a recurring pull, you can place a stop payment order. To stop a specific upcoming payment, give the order at least three business days before the scheduled withdrawal. If you notify the bank orally, it may ask for written confirmation within 14 days.5Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank or Credit Union Account Banks often charge $15 to $36 for a stop payment order, though the fee may be waived when the payment is clearly fraudulent.
Aftereffects on Banking History and Credit
When a bank closes a compromised account, that closure may be reported to ChexSystems, a consumer reporting agency that tracks checking account history.6Consumer Financial Protection Bureau. Chex Systems, Inc. A negative entry can make it harder to open a new account elsewhere, and entries typically remain on file for up to five years. Request your ChexSystems report and dispute any inaccurate entries.
Checking account fraud doesn’t directly affect your credit score, because bank balances aren’t reported to the credit bureaus. But if the thief used your account information alongside other personal data to open credit accounts or intercept a tax refund, you’re in identity theft territory. Pull your credit reports at AnnualCreditReport.com and look for accounts you don’t recognize.
If you find signs of broader identity theft, consider a credit freeze at all three bureaus. A freeze prevents anyone from opening new credit accounts in your name and costs nothing to place or lift. An initial fraud alert is a lighter option: it lasts one year, requires lenders to verify your identity before granting credit, and you only need to contact one bureau, which notifies the other two.7Federal Trade Commission. Credit Freezes and Fraud Alerts
Shrinking the Window for Damage
You can’t keep your account and routing numbers secret. They’re shared every time you write a check or set up a direct deposit. What you can do is shrink the window a thief has before you spot the misuse:
- Review statements weekly. The 60-day reporting deadline is generous on paper, but fraudulent recurring debits compound fast.
- Set up transaction alerts. Most banks let you receive text or email notifications for any debit over a threshold you choose. A $1 threshold catches everything.
- Use your bank’s bill pay instead of handing merchants your account number. The bank sends the payment; the merchant never sees your account details.
- Shred old checks, voided checks, and bank statements. These are the most common physical sources of stolen account information.
- Don’t mail checks from an unsecured residential mailbox. Drop them at a post office or inside a secure postal collection box.
Transaction alerts combined with weekly statement reviews catch the majority of account-number fraud before the 60-day window becomes relevant.
Business Accounts Don’t Get These Protections
Everything above assumes a personal checking account. Regulation E’s liability caps, provisional credits, and investigation timelines do not cover business accounts.8Legal Information Institute (LII) at Cornell Law School. UCC – Article 4A – Funds Transfer (2012) Business ACH and wire transfers fall under UCC Article 4A, which generally holds the business liable for unauthorized transfers if the bank followed a “commercially reasonable” security procedure the business agreed to.9Legal Information Institute (LII) at Cornell Law School. UCC 4A-201 – Security Procedure If you run a company, ask your bank about Positive Pay, which cross-references every check presented against a list of checks you actually issued.