Can a scammer commit fraud if they know my bank account number and routing number?
Yes — account and routing numbers can be used to initiate ACH transfers or create fraudulent checks; however, receiving a direct deposit doesn't expose these numbers to your employer in a way that creates risk.
Last reviewed: 10 June 2026
Explanation
Your bank account number and routing number together are enough to initiate ACH (Automated Clearing House) debit transactions — the electronic transfer system used for direct debits, bill pay, and payroll. A scammer who has these details can potentially set up a fraudulent ACH pull from your account. Many online bill payment systems accept these two numbers with minimal additional verification.
Paper check fraud is another vector: a fraudster can print counterfeit checks bearing your account number and routing number and attempt to cash them or use them for purchases. These same two numbers are printed on every check you write, which is why paper checks remain a fraud risk in a digital age.
However, the risk is often overstated for routine situations. Your account number is already shared widely in normal financial activity — it is given to your employer for direct deposit, to utility companies for direct debit, and is printed on checks. The fraud risk emerges when these details fall into the hands of someone who would misuse them.
Monitor your account regularly for small debit transactions you don't recognise. Your bank's ACH dispute process should reverse fraudulent debits, typically within a few business days once reported. If you discover your account details are in circulation through a scam or breach, contact your bank — in severe cases you can close the account and open a new one.
Common red flags
- Small unexplained ACH debits appear in your transaction history
- A bill pay service you don't use appears in your statement
- You receive a notice from your bank about an ACH transaction you didn't initiate
- Your check number sequence is disrupted — checks may have been reproduced
- You shared your account and routing number with someone who turned out to be fraudulent
What to do now
- Enable transaction alerts on your account so ACH debits trigger immediate notifications
- Review your recent transaction history for small unrecognised debits
- Report any fraudulent ACH transactions to your bank promptly — ask about their dispute process
- If your bank details were part of a scam, discuss with your bank whether closing and re-opening the account is advisable
- Minimise your use of paper checks — use card payments or bank transfers instead
- Be cautious about sharing account and routing numbers with parties you haven't verified
Frequently asked questions
My employer has my account and routing number for direct deposit — should I be worried?
No — this is a standard and necessary part of receiving direct deposits. The risk arises when these details reach an unauthorised person. Payroll data breaches do occur, which is why monitoring is useful.
How long do I have to dispute an unauthorised ACH debit?
Under US Regulation E you have 60 days from the statement date on which the error appeared to dispute it. Earlier reporting generally leads to faster resolution and stronger protection.