Can a scammer set up a direct debit from my account with just my bank details?
In some cases yes. With account number and sort code, a fraudster can attempt to set up unauthorised direct debits in the UK.
Last reviewed: 1 June 2026
Explanation
In countries using the BACS direct debit scheme — primarily the UK — a bank account number and sort code are all that is technically required to initiate a direct debit instruction. Safeguards exist in the form of the Direct Debit Guarantee, which allows you to claim an immediate refund from your bank for any payment not matching your authorisation, but you must spot the charge first. In the US, ACH transactions similarly require only routing and account numbers. If you believe your details have been shared with someone untrustworthy, monitor your account closely, set up transaction alerts, and contact your bank about restricting direct debits. You do not always need to close your account — restrictions can often be applied.
Common red flags
- You shared your account number and sort code with someone untrustworthy
- Unknown direct debits appear on your statement
- Small test transactions from unrecognised companies
- Your details appeared in a data breach
What to do now
- Set up transaction alerts with your bank
- Review your direct debits and cancel any unrecognised ones
- Contact your bank if you suspect unauthorised setup — they can block it
- Claim a refund under the Direct Debit Guarantee for any unauthorised payment
Frequently asked questions
Should I close my bank account if my details were exposed?
Not necessarily. Speak to your bank — they can often add restrictions or alerts without the disruption of a full account closure.