What can someone do with your account and routing number?

Understanding account and routing numbers

Your bank account number is a unique identifier for your checking or savings account. A routing number, or ABA routing number, is the code assigned to a specific financial institution. Any customer at that bank branch will have the same number, though some larger banks have multiple routing numbers that vary by state or account type.

Routing numbers are always 9 digits, no matter which bank you use. Bank account numbers are typically 8 to 12 digits, but they can also be as long as 17 digits. 

Everyone with a checking or savings account is assigned a unique bank account number and a routing number. These two are used to authorize deposits, withdrawals, and some types of online purchases.

Risks of having your account and routing number exposed 

It’s important to note that if a scammer only has either your account or routing number, your risk of identity theft or financial loss is relatively low. Most financial institutions and businesses require you to enter both numbers, usually along with additional verification, to transfer funds or make purchases.

However, that’s not to say there is zero risk if only one of the numbers ends up in the wrong hands. Though chances are low, potentially fraudsters still could:

• Make online purchases on platforms with weak security
• Target you with phishing or social engineering attacks, pretending to be your bank
• Create fake checks 

What happens if someone has your bank account number and routing number?

Now, if your checking or savings account and routing numbers are compromised, the risk of fraud increases significantly. Knowing both of these numbers gives fraudsters more opportunities to wreak havoc on your finances and attempt the following: 

• Make online payments, including paying bills and funding digital wallets.
• Create fraudulent checks to make you pay for their purchases or even cash the checks themselves.
• Initiate unauthorized ACH debits and transfer your money to their accounts or pay their own expenses.
• Make unauthorized deposits into your accounts when laundering money to conceal funds from government agencies. Deposits can also be made as part of a money mule scheme.
• Launch phishing scams by setting up fake emails or texts pretending to be your financial institution and claiming there’s some “issue” with your account.

Can someone hack your bank account with the routing number and account number?

No, scammers can’t directly hack your bank account using only your account and routing numbers—getting access usually requires additional sensitive information, like login credentials or 2FA codes. They also wouldn’t be able to do the following:

• Withdraw cash: ATMs and bank branches require your bank card and PIN or a government-issued ID to access funds.
• Set up direct debit: This requires your signature or digital consent and, sometimes, identity verification.
• Open up new accounts or cards: This requires identity verification, usually provided by a driver’s license, passport, or Social Security number.

Real-world examples of account exploits

Real-world cases show that having your account and routing numbers exposed is dangerous not only in theory. For many years, news has been filled with stories of people falling victim to various schemes and losing money. 

One such scheme made news when scammers were offering a reward for a “stolen” car on social media. Fraudsters pretended a car had been stolen and offered a financial reward once a victim reported finding it. To receive it, all the victim had to do is provide their bank account and routing number—and some people did. This case shows that scammers don’t even need to come up with sophisticated schemes, all they have to do is rely on people’s trustingness and negligence.

Another example of a simple yet effective scheme made news in 2024 when a lawyer lost thousands of dollars after revealing the firm’s bank account and routing numbers in a prospective real estate deal. Even worse, the attorney noticed fraudulent transactions only several months later, which resulted in some of her fraud claims being denied by the bank.

If you don’t have notifications set up with your bank or don’t pay close attention to your transaction history, the charges can go unnoticed—and the zero-liability protection can expire when you finally declare bank fraud. Banks typically allow 60 days to report the incident. 

What to do if someone has your bank account number

Knowing what to do if someone has your bank account number can save you some headaches and, possibly, a lot of money. If you suspect that your number has been compromised, take the following steps:

Notify your bank immediately

The first thing to do is call your bank and report the incident. Alerting your bank as quickly as possible can help prevent fraudsters from transferring your funds or initiating unauthorized payments.

Freeze your account

Ask the bank to temporarily (or permanently) close the account to prevent unauthorized transactions. Consider freezing other accounts if you have more than one with the same financial institution. If you have recurring payments or direct deposits, request a new bank account number.

Report fraud to the authorities 

The next step is to report the incident to local and federal authorities. This helps create an official record, supports investigations, and may be required by your bank for reimbursement. Key resources you should contact include: 

• Your local police department
• The Federal Trade Commission
• Credit reporting agencies 

Monitor for suspicious activity

Once you’ve reported the incident, watch closely for fraud as it may emerge later. There are a few ways you can check for suspicious activity, and it’s a good idea to do the following as often as possible:

• Review your online and paper bank statements: look for unfamiliar transactions, even small ones.
• Check credit reports: request free reports from AnnualCreditReport.com and look for new accounts or hard inquiries you didn’t authorize.
• Examine your online banking account: check for changes in personal information and newly linked accounts.
• Follow up with local authorities and national agencies: keep track of your reports to stay updated on your case or recommended next steps.

Assess the situation

Carefully review any information you receive from authorities and take all recommended steps toward protecting your financial accounts. Try to understand how your account number got compromised to avoid it happening again in the future. Think about what other sensitive details can be at risk and take steps to protect those as well. 

How to protect your banking information

Banks follow strict rules from the FDIC regarding sharing your PII with third parties, but you must follow basic security protocols as well. If you are looking for ways to keep your bank information safe, do the following: 

• Limit when you share bank information: Only share account numbers and PII with reputable sources. Don’t write checks to strangers you don’t trust, only shop on secure websites, and check the legitimacy of a brick-and-mortar business or online platform before disclosing your account numbers.
• Use strong, unique passwords and 2FA: Set up your online banking account with a secure password. Enable two-factor authentication (2FA) and/or biometric authentication if possible to add another layer of security. 
• Don’t leave checks/checkbooks lying around: Store your bank information and checks in a safe location. Don’t leave them in a car or carry them in a purse or your pocket.
• Destroy paper documents: Shred documents with sensitive information so no piece of paper can reveal your private details.
• Enable alerts: Set up alerts for withdrawals, transfers, and other banking activity. Monitor them frequently, and if you see unauthorized activity, be sure to report it.
• Use secure WiFi: Don’t log in to online banking platforms or pay online while using public WiFi. It is usually unsecured and makes your data easy to intercept.
• Don’t store bank account information on your phone: Avoid storing bank account numbers and other details on your phone or in cloud storage as those can be hacked by cybercriminals.

How Onerep helps prevent financial fraud

Having only your bank account and routing number gives scammers the opportunity to steal your money, but the ways are limited. However, when paired with your PII like legal name, address, phone number, and other details, these numbers can be used to authorize transactions and commit identity theft.

Unfortunately, finding those personal details is even easier than finding your bank account number—it’s often as simple as a single Google search. The main reason behind it is data brokers. These sites collect your information from various sources, including public records and social media sites, and publish it online for anyone to see. Anyone can find out when you were born, where you live, who your relatives are, what your income is, and much more.

Onerep protects your personal information by removing it from 232 data brokers. The service scans the sites to find the exact pages where your details are exposed, then sends opt-out requests on your behalf. Even after your info is removed, Onerep runs regular scans to ensure that your data isn’t republished.

Having your personal information removed from data brokers protects you from phishing and identity theft and helps prevent unauthorized access to your financial accounts.

FAQ 

Is it safe to share your bank account number?

Overall, it is safe to give your bank account number only to legitimate businesses, clients, and family or friends. Avoid sharing it with strangers, on unsecured or unestablished online platforms, and when using public WiFi.

What can someone do with your bank account number?

If someone has only your bank account number, there isn’t much they can do with it. The most likely problems include unauthorized online purchases from sites with low security and attempts to link your account to payment platforms that don’t require identity verification. Transfers, withdrawals, opening new accounts, and other actions require more information—your routing number, legal name, usernames and passwords, and other sensitive details that help confirm it’s really you.

What can someone do with your account and routing number?

If someone only has your account and routing number, they can’t do much. Possible fraud includes unauthorized ACH debits, fake checks, and phishing attacks. More serious actions like gaining access to your bank account or opening new ones in your name require passing identity verification.

If someone has your bank account number, can they take money out?

No, someone can’t take your money out just by having your account number. Making transfers requires having your routing number as well, along with identity authentication. 

How can someone access money in a checking account?

Access to money in a checking account typically requires authentication as legitimate financial institutions have robust security measures in place. Authentication includes providing PINs for cards, login credentials for online accounts, and ID verification to create new accounts and cards.