If a stranger has your bank routing number and account number, they can use that pair to pull money out of your account through electronic debits, print counterfeit checks drawn on your account, and use the details as leverage to pry loose more sensitive information about you. The routing number by itself is not sensitive — banks publish them openly — but combined with an account number, it opens the door to several specific types of fraud. Here is what someone can do with your routing and account number, what federal law says you owe if it happens, and the steps that actually shut the exposure down.
Unauthorized ACH Debits
The fastest way to lose money is through the Automated Clearing House network. An ACH debit needs only a routing number, an account number, and the account holder’s name. No card, no PIN, no signature. A fraudster with your numbers can set up transactions that look like ordinary bill payments to a utility, a credit card, or a loan servicer, and the money moves straight out of your balance.
Peer-to-peer payment apps are covered by the same federal framework. The Consumer Financial Protection Bureau has confirmed that any transfer meeting the definition of an electronic fund transfer falls under federal consumer protection rules, even when a third party fraudulently initiated it.1Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Private network rules do not override those rights, and the bank holding your account keeps its full error-resolution obligations.
Counterfeit Checks and Check Washing
Check-printing software and magnetic ink are widely available. With your routing and account number, someone can print counterfeit checks that carry your real banking details along the bottom edge, then cash them at retailers, deposit them into other accounts, or use them for purchases. The funds still come out of your account.
A related threat uses a real check of yours. In check washing, a thief steals a legitimate check from your mailbox and uses chemicals to erase the ink, then rewrites the payee and amount while your account information stays intact. The Office of the Comptroller of the Currency recommends writing checks in black gel ink, which resists chemical washing.2OCC. Check Fraud
Identity Theft and Synthetic Fraud
Your account number is also a credibility tool. Fraudsters call bank representatives or send phishing emails while quoting a legitimate account number, and that partial knowledge is often enough to impersonate you convincingly and coax out further details, including Social Security numbers. Security questions tied to recent transactions or balances become easier to answer once the caller already knows the account.
A growing variation is synthetic identity fraud. Criminals combine one person’s real account number with another person’s Social Security number and fabricated personal details to build an entirely new identity. That manufactured identity is used to open credit cards and loans, build a payment history, and raise credit limits. When the limits are high enough, the fraudster maxes out the credit and disappears, leaving the real people whose data was stitched together to sort out the damage.
How Much You Could Actually Lose
Federal law caps your losses from unauthorized electronic transfers on a personal account, but the cap depends entirely on how quickly you report. The Electronic Fund Transfer Act sets a baseline liability of $50 when you report promptly.3GovInfo. 15 USC 1693g – Consumer Liability Regulation E fills in the tiers:
- Report within 2 business days of learning about the unauthorized access, and your maximum liability is $50.
- Report after 2 business days but within 60 days of the bank sending the statement showing the unauthorized transfer, and your liability can rise to $500.
- Miss the 60-day window, and you can lose the entire amount taken, with no cap.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Forged checks work under different law. Under the Uniform Commercial Code, a bank may only charge your account for items that are “properly payable,” meaning items you actually authorized.5Cornell Law School. Uniform Commercial Code 4-401 – When Bank May Charge Customers Account A forged check is not properly payable, so the bank generally bears the initial loss. If your own carelessness contributed to the forgery, though, the UCC uses a comparative-fault analysis and splits the loss based on how much each party’s failure to exercise ordinary care contributed to the problem.6Cornell Law School. Uniform Commercial Code 3-406 – Negligence Contributing to Forged Signature or Alteration of Instrument
One boundary to know: these consumer protections cover personal accounts. Business accounts fall under Article 4A of the UCC, and the liability framework often leaves the business responsible when the bank followed an agreed security procedure.7Cornell Law School. Uniform Commercial Code 4A-202 – Authorized and Verified Payment Orders If the compromised account belongs to a business, read the banking agreement closely.
What to Do If Your Numbers Are Out There
Ask your bank for a full account closure, sometimes called a hard close, not a temporary freeze. A freeze only pauses activity. A hard close permanently deactivates the compromised credentials and forces the bank to issue a new account number.
Before you close the old account, pull your most recent statements and note the date of your last authorized transaction. That timeline helps the bank pinpoint when the unauthorized access began and supports any dispute you file. Then plan on rebuilding every connection tied to the old numbers.
Direct Deposits and Recurring Payments
Every automatic payment linked to the old account will fail once it closes. Mortgage, insurance, subscriptions, employer direct deposit, government benefit deposits — all of it has to be re-linked. Ask your bank for a list of established ACH originators so you can see exactly who has been reaching into the account and needs the new information. Missed updates trigger late fees and service cutoffs.
Tax refunds need extra care. If the IRS tries to deposit a refund into a closed account, the bank rejects it and the IRS sends a CP53E notice giving you 30 days to update your bank information through your IRS online account. You get one chance to make that change.8Internal Revenue Service. Understanding Your CP53E Notice Miss it and the IRS mails a paper check about six weeks later. IRS employees cannot update your bank details by phone. The IRS also limits direct deposits to three electronic refunds per bank account per tax year, which matters if your new account is shared in the household.9Internal Revenue Service. Tell IRS to Direct Deposit Your Refund to One, Two, or Three Accounts
Reporting and Protecting Your Credit
File a report with the Federal Trade Commission at IdentityTheft.gov. The portal generates a personalized Identity Theft Report and a step-by-step recovery plan, and that report becomes your official documentation when disputing charges with banks and creditors.10Federal Trade Commission. Identity Theft Recovery Steps
Then file a police report with your local department. Many banks and creditors want both the police report and the FTC Identity Theft Report before they will permanently remove unauthorized charges or close fraudulent accounts.11Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud Businesses can also require proof of identity, a police report, and a completed affidavit before releasing transaction records tied to the fraud.12Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft
Fraud Alerts and Credit Freezes
A fraud alert tells creditors to verify your identity before opening new accounts in your name. An initial fraud alert lasts one year and can be renewed, and anyone who suspects they may be a victim can place one. An extended fraud alert lasts seven years but requires an FTC Identity Theft Report or a police report, and it also removes you from pre-screened credit offer lists for five years.13Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
A credit freeze goes further. It blocks creditors from accessing your credit report at all, which prevents new accounts from being opened in your name. Placing and lifting a freeze is free at all three major credit bureaus under federal law, and a freeze does not affect your credit score or your existing accounts.14Consumer Advice – FTC. Credit Freezes and Fraud Alerts You can lift it temporarily when you actually need to apply for credit.
Blocking Fraudulent Entries on Your Credit Report
If the fraud leads to accounts or debts appearing on your credit report, you can require the credit reporting agencies to block that information. Provide proof of identity, a copy of your Identity Theft Report, and identification of the fraudulent entries, and the agency must block the information within four business days.15Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
Reducing Future Exposure
- Write checks in black gel ink, which resists chemical washing.2OCC. Check Fraud
- Ask your bank about an ACH debit block or filter that rejects any ACH debit unless the originator is on a pre-approved list.
- Ask about Positive Pay, mostly available on business accounts, which requires the bank to match every check presented against a list of checks you actually issued.
- Check your account at least weekly rather than waiting for the monthly statement. That is what keeps you inside the two-day reporting window and caps your liability at $50.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Avoid sending account details by email or entering them on unfamiliar sites. Bank bill pay through your online portal keeps the account number hidden from the recipient.
- Shred old statements, voided checks, and pre-printed deposit slips before throwing them out.