Can a scammer set up a direct debit from my account with just my bank details?
In some cases yes. With account number and sort code, a fraudster can attempt to set up unauthorised direct debits in the UK.
Last reviewed: 1 August 2026
Explanation
In countries using the BACS direct debit scheme — primarily the UK — a bank account number and sort code are all that is technically required to initiate a direct debit instruction. Safeguards exist in the form of the Direct Debit Guarantee, which allows you to claim an immediate refund from your bank for any payment not matching your authorisation, but you must spot the charge first. In the US, ACH transactions similarly require only routing and account numbers. If you believe your details have been shared with someone untrustworthy, monitor your account closely, set up transaction alerts, and contact your bank about restricting direct debits. You do not always need to close your account — restrictions can often be applied.
The practical exposure comes from how routinely these details are shared — every invoice, cheque, and standing-order form reveals them, and fraudsters exploit the gap between a mandate being lodged and you noticing it. Small 'test' collections from unfamiliar names are a common precursor to larger ones, which makes alerts on low-value transactions disproportionately useful.
The guarantee schemes attached to direct debit systems are strong but reactive: refunds are prompt once claimed, yet the claiming depends entirely on you spotting the payment. A monthly scan of active mandates in your banking app — cancelling anything unrecognised — closes the loop, and unexpected mandate confirmations from companies you have never dealt with deserve a call to your bank the same day.
Common red flags
- You shared your account number and sort code with someone untrustworthy
- Unknown direct debits appear on your statement
- Small test transactions from unrecognised companies
- Your details appeared in a data breach
What to do now
- Set up transaction alerts with your bank
- Review your direct debits and cancel any unrecognised ones
- Contact your bank if you suspect unauthorised setup — they can block it
- Claim a refund under the Direct Debit Guarantee for any unauthorised payment
Frequently asked questions
Should I close my bank account if my details were exposed?
Not necessarily. Speak to your bank — they can often add restrictions or alerts without the disruption of a full account closure.
A company I've never heard of sent a direct debit confirmation letter — what does it mean?
Someone has attempted to lodge a mandate on your account. Contact your bank immediately to block it, check your statement for collections, and keep the letter — that early notice is exactly how the safeguards are meant to work.