Can a scammer take money from my account with just my account number?
A bank account and routing number together can be used to initiate ACH withdrawals — so yes, this information can be misused, though most banks have protections against unauthorised transactions.
Last reviewed: 10 June 2026
Explanation
Your bank account number and routing number together are the credentials needed to set up an ACH (electronic) transaction. ACH debits — used for direct debits, bill payments, and most automated subscriptions — are initiated using exactly this combination. If a fraudster obtains your account and routing numbers, they can attempt to set up an unauthorised direct debit.
Most banks have controls that reduce this risk: new ACH debit mandates may trigger verification, unusual large withdrawals may be flagged, and your bank monitors for patterns inconsistent with your normal account use. If an unauthorised ACH debit occurs, the Electronic Fund Transfer Act gives you the right to dispute it — report it to your bank within 60 days.
Where does someone get your account and routing number? A personal cheque contains both. If you wrote a cheque to a fraudulent 'contractor' or sent one to a scam address, those details are now in their hands. Data breaches at businesses that store your banking details, and phishing attacks where you enter banking details on a fake website, are other common vectors.
If you believe your account and routing numbers have been compromised, contact your bank. Some banks can close the existing account and open a new one, assigning you a new account number — this is the most effective prevention once compromise has occurred.
Common red flags
- You wrote a cheque to someone who turned out to be a scammer
- A form you filled in on a suspicious website asked for your bank account and routing numbers
- Unexpected small debit appeared from a company name you do not recognise
- A data breach notification mentioned your banking information was exposed
What to do now
- Contact your bank immediately to report suspected account number compromise
- Request a new account number and check whether your bank can proactively block suspicious ACH debits
- Monitor all transactions closely for the next 90 days and set up alerts for any debit over a small amount
- Dispute any unauthorised ACH debits within 60 days through your bank
- File a report with the FTC at ReportFraud.ftc.gov
Frequently asked questions
Is it safe to share my account and routing number for legitimate direct debits?
Sharing them with established, reputable businesses for legitimate direct debits (rent, utilities, subscriptions) is normal practice. The risk is sharing them with individuals or businesses whose trustworthiness you cannot verify.
Can a scammer take money with just my account number, without the routing number?
An account number alone is not sufficient to initiate most ACH transactions — the routing number is also needed. However, both appear together on every cheque, so they are usually obtained together.