Can someone steal money using my bank routing and account number?
Yes, in some cases. Routing and account numbers can be used to initiate ACH transfers or set up fraudulent direct debits if other verification steps are bypassed.
Last reviewed: 1 August 2026
Explanation
In the US, ACH (Automated Clearing House) transactions require only a routing number and account number to initiate a payment. While banks and payment processors apply fraud filters, some fraudulent debits do succeed. Outside the US, sort codes and account numbers enable direct debit setup in several countries. The risk is higher when combined with other personal information. Your account number appears on the bottom of cheques and on direct debit authorisation forms, so it is not a secret in the same way a PIN is, but its misuse is possible. Monitor your account statements regularly, review active direct debits periodically, and report any unrecognised transactions to your bank promptly.
The practical risk calculus differs from card fraud in a way worth internalising: account numbers are semi-public by design — printed on every cheque you write and shared for every legitimate payment you receive — so the system's protection comes from reversal rights rather than secrecy. Unauthorised debits can generally be disputed and returned, but the process only works if you notice them, and fraudsters exploit exactly the gap between setup and discovery. A direct debit created quietly this month may not take a meaningful amount until next quarter.
That makes review cadence your main control. A monthly scan of active mandates and recent debits takes minutes and catches almost everything this fraud type can do; alerts on debits above a chosen threshold automate the rest. Where the risk concentrates is combination: an account number alone does little, but paired with your name, address, and a forged signature or phished verification, it supports more serious impersonation — which is why documents showing your account details deserve the same shredder treatment as anything bearing your signature.
Common red flags
- Unrecognised direct debits or ACH withdrawals on your account statement
- You shared your account details with an unverified party
- Small test transactions you don't recognise — often a precursor to larger fraud
- Notification of a new payee set up on your account that you didn't authorise
What to do now
- Check your statement monthly for unrecognised direct debits or ACH transactions
- Contact your bank immediately to dispute and reverse any unrecognised charges
- Review and cancel any direct debit mandates you no longer recognise
- Consider setting transaction alerts for all debits above a threshold
Frequently asked questions
Should I never give out my account number?
Giving your account number for legitimate payroll setup or bank transfers is normal. The risk comes from sharing it with unverified parties who could use it to authorise withdrawals. Always verify who you are sharing financial details with.
How quickly do I need to report an unauthorised debit?
As soon as you see it. Dispute rights for unauthorised transactions are strong but often time-bound, and the clock generally runs from when the transaction appeared. Regular statement checks protect those rights; a debit discovered a year late is much harder to unwind.