Can Someone Steal Your Bank Info From a Check?

Yes, someone can steal your bank information from a check, and they do not need anything more than the check itself. Every paper check you write prints your name, address, bank, nine-digit routing number, and account number in plain view along the bottom edge. With just the routing and account numbers, a thief can set up electronic withdrawals, print counterfeit checks drawn on your account, or sell the data to someone who will. So the honest answer to can someone steal your bank info from a check is that a check already contains the information; the only question is whether it reaches the wrong hands.

What Is Actually Printed on Your Check

The top of a standard check shows your full legal name and mailing address, along with the bank’s name. The bottom carries the routing number that identifies your bank, followed by your unique account number and the check number.¹ Those digits are printed in magnetic ink for high-speed processing, but a smartphone camera reads them just as easily as a bank machine does.

Armed with the routing and account numbers alone, someone can pay bills from your account, fund prepaid cards, or generate fresh checks drawn on your funds. They never need the original paper again. A lost, stolen, or photographed check is an open door to your checking account until you close it.

How Check Information Gets Stolen

Mail Theft

The most common route is straight out of a mailbox. Criminals pry open residential mailboxes or use stolen postal keys to reach the contents of blue USPS collection boxes, then pull envelopes that look like they hold checks. This is often called check fishing. Outgoing rent payments left in an unlocked mailbox with the flag raised are easy pickings, as are envelopes dropped into a collection box the night before pickup.

Check Washing

Once a thief has a physical check, they often “wash” it using common chemicals such as acetone or nail polish remover to dissolve the ink on the payee line and dollar amount while leaving your signature and the printed bank details untouched. The thief then rewrites the check to themselves for a larger amount. Gel ink was once considered resistant, but more aggressive solvents have largely closed that gap.

Phone Photos and Dishonest Handlers

A check does not have to be physically stolen for its data to leak. A high-resolution phone photo taken during a transaction captures every digit on the bottom line in seconds. Anyone who briefly handles your check, an employee, a roommate, a contractor, can snap a picture and walk away with everything needed to drain the account. Some criminals also exploit mobile deposit systems by depositing the same check image into multiple accounts before banks detect the duplication.

What Thieves Do With Your Routing and Account Numbers

Unauthorized ACH transfers. A thief enters your routing and account numbers on a website or payment portal and initiates electronic withdrawals: paying their bills, funding prepaid cards, or moving money to accounts they control.
Remotely created checks. These are payment instruments generated with your account information but without your physical signature. They carry a printed note stating the account holder authorized the payment. The Federal Reserve has flagged remotely created checks as especially vulnerable to fraud precisely because they lack a verifiable signature.²
Counterfeit checks. With your account details, a thief can print convincing checks on blank check stock sold at any office supply store. Those counterfeits carry your real routing and account numbers, so they clear against your balance.
Resale. Stolen account credentials get packaged and sold on illicit marketplaces, sometimes bundled with other personal data, and a single set of details can pass through several buyers, each attempting a different form of fraud.

Warning Signs Your Account Has Been Compromised

Check fraud rarely announces itself with one dramatic withdrawal. Thieves tend to test the waters first, and the signals are easy to miss unless you’re watching.

Small mystery transactions. Withdrawals or deposits under a dollar are classic verification tests, used to confirm the account is active before larger amounts move.
Unfamiliar payees. Any name you don’t recognize on your statement, especially for ACH debits or electronic checks, deserves immediate attention.
Check numbers out of sequence. If check 1087 clears while you’re still writing check 1062, someone may be printing counterfeits against your account.
Duplicate check numbers. Two transactions referencing the same check number almost always indicate forgery.
Unexpected overdraft fees. A sudden overdraft notice when you expected a healthy balance is one of the fastest signals that funds have been drained. The average overdraft fee at U.S. banks is roughly $31 per occurrence, so penalties can pile on top of stolen funds quickly.
Bounced checks you know were funded. If your bank tells you legitimate checks are being returned, a thief may have emptied the account before your payments cleared.

Turning on real-time transaction alerts through your bank’s app is the single most effective early warning. A push notification the moment money leaves your account compresses the gap between theft and discovery from weeks to minutes.

What to Do the Moment You Spot Fraud

Speed matters more than anything else here. The legal protections below all reward fast reporting and punish delay.

Call your bank’s fraud department. Report every unauthorized transaction, dispute the charges, ask the bank to freeze or close the compromised account and open a new one with a fresh account number, and request stop payments on any outstanding checks that have not cleared.³
File a police report. Many banks and creditors require one before processing fraud claims. Bring statements, copies of any forged checks, and correspondence from the bank, and ask the officer to incorporate your identity theft complaint into the report so it becomes an Identity Theft Report carrying more weight with financial institutions.⁴
Report to the FTC. File at IdentityTheft.gov. The site generates an FTC Identity Theft Report and builds a personalized recovery plan with pre-filled letters for banks and creditors.⁵
Place a security alert with ChexSystems. ChexSystems is the consumer reporting agency banks check before opening new accounts. A security alert or freeze on your file makes it harder for a thief to open new checking accounts in your name. Use the ChexSystems Consumer Portal or call 800-428-9623.⁶
Sign an affidavit of forgery. Your bank will likely require a sworn statement, sometimes notarized, declaring that you did not authorize the transactions and did not benefit from the proceeds. That document triggers the bank’s formal investigation.

Keep a written log of every call, every representative’s name, and every reference number. Banks sometimes lose track of disputes, and your notes become the proof that you reported within the deadlines that protect your rights.

Your Legal Protections and the Deadlines That Govern Them

The rules depend on whether the fraud involved a paper check or an electronic transfer initiated with your check data. These are two different bodies of law, and the distinction changes what you can recover.

Paper Check Fraud Falls Under the UCC

Forged, washed, and counterfeit paper checks are governed by the Uniform Commercial Code, adopted in some form by every state. A person is not liable on a check unless they actually signed it or authorized someone to sign it on their behalf.⁷ A bank that pays a forged check generally bears the loss, not you, but that protection has a time limit.

Under UCC Section 4-406, you have a duty to review your statements with reasonable promptness and report unauthorized checks. If the same thief forges a second check and the bank pays it in good faith, you lose the right to contest that second check if you had a reasonable window (up to 30 days) to catch the first and did not. After one year without reporting, you lose the right to challenge any unauthorized signature or alteration, period.⁸

Electronic Withdrawals Fall Under Regulation E

When a thief uses your routing and account numbers to initiate an electronic withdrawal, an ACH debit, an online bill payment, a one-time electronic transfer sourced from check information, those transactions are covered by the Electronic Fund Transfer Act through Regulation E. Paper check transactions themselves are explicitly excluded from Regulation E’s coverage.⁹

Regulation E sets a tiered liability structure based on how fast you report:

Within 2 business days. Your maximum liability is $50 or the total amount of unauthorized transfers before you notified the bank, whichever is less.⁹
After 2 business days but within 60 days of your statement. Liability can reach $500, including transfers after the initial two-day window that the bank can show it would have stopped had you reported sooner.⁹
After 60 days. You can be liable for the full amount of any unauthorized transfers that occur after the 60-day window, with no cap. This is where people lose entire account balances.

Those deadlines are unforgiving. The difference between reporting on day two and day three can be the difference between a $50 loss and a $500 one.

Business Accounts Get Less

Regulation E only covers consumer accounts held by natural persons for personal, family, or household purposes. Business checking accounts do not get the $50/$500 caps. They fall entirely under the UCC, which places more responsibility on the account holder to monitor statements and report promptly. The one-year absolute deadline under UCC 4-406 applies, but your bank may argue you should have caught the fraud much sooner, and courts often agree.

How to Protect Yourself Before It Happens

Mail Checks Carefully

Never leave outgoing checks in an unlocked residential mailbox with the flag raised. That is a signal to thieves that something worth stealing is inside. Drop checks at the post office counter or inside the building’s mail slot. If you must use a blue USPS collection box, do it right before a scheduled pickup rather than leaving the envelope overnight.

USPS Informed Delivery emails you grayscale images of letter-sized mail heading to your address each morning.¹⁰ If an expected check image shows up in your digest but the envelope never arrives, treat it as a red flag that the mail was intercepted.

Order Better Check Stock

If you write checks, pay the extra few dollars for high-security stock. Useful features include chemical-sensitive paper that stains visibly if someone tries to wash it, thermochromic ink that disappears under heat and can’t be photocopied cleanly, and true watermarks pressed into the paper that scanners can’t reproduce. No combination is foolproof, but each one adds friction that pushes a thief toward an easier target.

Businesses: Ask About Positive Pay

Businesses writing significant check volume should ask their bank about Positive Pay. You upload a file listing every check you issue, including numbers, dates, and amounts, and the bank cross-references each check presented for payment against that list, flagging anything that doesn’t match. You approve or reject exception items before the bank pays them. Positive Pay is one of the few defenses that catches counterfeit checks before money leaves the account rather than after.

Stop Payment Orders

If you know a specific check was lost or stolen before it cleared, a stop payment order tells your bank to refuse it on arrival. Most banks charge between $15 and $36, and the order typically lasts six months to one year depending on state law.¹¹ After it expires, the check can still be cashed, so renew the order if the check has not surfaced. A stop payment will not help if the thief has already used your routing and account numbers electronically; for that, you need the full fraud reporting process above.

Everyday Habits

Store your checkbook at home, not in a car console or a desk drawer at work. Shred canceled checks and old statements rather than tossing them. When paying a contractor, housekeeper, or anyone you don’t know well, consider an electronic payment method that doesn’t expose your account numbers. And actually read your bank statements each month. The one-year UCC deadline and the 60-day Regulation E deadline both assume you are looking at what the bank sends.

1
American Bankers Association. ABA Routing Number
2
Federal Reserve. Board Announces Final Rule Governing Remotely Created Checks, Regulation CC
3
OCC (Office of the Comptroller of the Currency). Check Fraud
4
Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud
5
Federal Trade Commission. IdentityTheft.gov
6
ChexSystems. Identity Theft Information
7
Legal Information Institute (LII) / Cornell Law School. UCC 3-401 Signature
8
Legal Information Institute (LII) / Cornell Law School. UCC 4-406 Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
9
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
10
United States Postal Service. Informed Delivery – Mail and Package Notifications
11
Consumer Financial Protection Bureau. How Do I Stop Payment on a Check