A scammer with your bank account number and routing number can withdraw money from your account, set up fraudulent payments, and create counterfeit checks in your name. The good news is that your liability is limited by federal law if you catch and report unauthorized transactions quickly. Here’s exactly how these scams work and what you can do to protect yourself.
Initiate Unauthorized Withdrawals
The most common way scammers exploit a stolen account number is through ACH debits. ACH is the electronic network banks use to process direct deposits, bill payments, and bank-to-bank transfers. When a scammer has your account number and your bank’s routing number (which is publicly available), they can set up withdrawals from your account by posing as a legitimate business or as you.
These fraudulent debits are often small at first, sometimes just a few dollars, specifically to avoid triggering your attention or your bank’s fraud alerts. If those small charges go unnoticed, the scammer may escalate to larger withdrawals. Some scammers set up recurring payments to drain an account gradually over weeks or months.
Create Counterfeit Checks
Your account number and routing number are printed at the bottom of every check you write. A scammer who gets those numbers can use them to print convincing counterfeit checks drawn on your account. These forged checks can be used to make purchases, pay other people, or cash out funds directly. The Office of the Comptroller of the Currency warns that check fraud includes using stolen check images or forged checks to make unauthorized transactions.
This type of fraud can be especially damaging because paper checks can take days to clear, and the resulting charges may not appear on your statement right away. By the time you notice, the scammer may have written multiple checks against your account.
Set Up Fraudulent Payments
Many online merchants and service providers accept direct bank payments using just an account and routing number. A scammer can use your information to pay for goods, services, or subscriptions without needing your debit card or PIN. Some scammers also use stolen account details to fund prepaid cards or digital wallets, effectively converting your bank balance into a form of payment that’s harder to trace.
What They Can’t Do With Just an Account Number
Your account number alone doesn’t give a scammer full access to your bank account. They typically can’t log in to your online banking, change your password, or transfer money between your own accounts without your login credentials. They also can’t use your debit card at ATMs or in stores without the card itself and your PIN. The real danger comes when they pair your account number with your routing number, which together are enough to initiate electronic debits and create fake checks.
Your Liability Under Federal Law
Federal law (Regulation E) caps how much you can lose to unauthorized electronic transfers, but the cap depends entirely on how fast you report the problem.
- Report within 2 business days of learning about the unauthorized activity: your maximum liability is $50.
- Report after 2 business days but within 60 days of receiving your bank statement: your liability can rise to $500.
- Report after 60 days from the date your bank sent the statement showing the fraud: you could be on the hook for the full amount of any unauthorized transfers that occurred after that 60-day window, with no cap.
The lesson is simple: the faster you report, the less you lose. If extenuating circumstances prevented you from notifying your bank on time (a medical emergency or extended travel, for example), your bank is required to extend those deadlines to a reasonable period.
How to Spot Unauthorized Activity
Check your bank statements and transaction history at least once a week. Look for charges you don’t recognize, even small ones. Scammers often test an account with a tiny debit of $1 or $2 before attempting larger withdrawals. If you see any transaction you didn’t authorize, no matter how small, treat it as a red flag.
Most banks let you set up real-time alerts for transactions over a certain dollar amount, or for any debit that posts to your account. Turning on these notifications is one of the simplest ways to catch fraud early, which directly reduces your financial exposure under the liability rules above.
Steps to Take if Your Account Number Is Compromised
If you know or suspect that someone has your bank account number and may be using it fraudulently, act immediately.
- Contact your bank. Call the number on the back of your debit card or on your bank’s website. Report the unauthorized transactions and ask to freeze or close the compromised account. Your bank will typically issue you a new account number.
- Review recent transactions. Go through your statements carefully and flag every charge you didn’t authorize. Your bank will need this information to process your dispute.
- File a dispute in writing. Most banks require a written follow-up to your phone report. Ask your bank what forms or letters they need and submit them promptly, since your liability protections depend on timely reporting.
- Place a fraud alert. If you suspect your personal information has been more broadly compromised, contact one of the three major credit bureaus to place a fraud alert on your credit file. This makes it harder for someone to open new accounts in your name.
- Monitor your accounts going forward. Even after you get a new account number, keep a close eye on all your financial accounts for several months. Scammers who obtained your information once may try again.
How Scammers Get Account Numbers
Understanding how account numbers end up in the wrong hands can help you avoid it in the future. Common methods include phishing emails or texts that trick you into entering your banking details on a fake website, data breaches at companies where you’ve made electronic payments, stolen mail containing bank statements or checks, and social engineering calls where someone impersonates your bank and asks you to “verify” your account number.
Your account and routing numbers are also visible on every physical check you write, which is why some people prefer electronic payments for transactions with unfamiliar parties. If you do write checks, be cautious about who receives them, since anyone holding your check has the information needed to set up a fraudulent ACH debit.