What Can a Scammer Do With My Bank Account Number?

A scammer who has your bank account number and routing number can pull money out through the ACH system, print counterfeit checks drawn on your account, and use the digits as a prop in phishing calls designed to pry loose the rest of your identity. Federal law caps what you owe for unauthorized electronic transfers, but only if you report the fraud quickly. Miss the 60-day window and you can be liable for every dollar that leaves after it closes.¹

ACH Withdrawals and Demand Drafts

Your account number and routing number are the same two pieces of information used for direct deposit, online bill pay, and recurring subscriptions. Many payment portals accept them without any further verification. A scammer doesn’t need your debit card, PIN, or online banking password to set up an ACH pull against your account.

The same numbers can authorize a demand draft, which is a withdrawal request that doesn’t need your signature. Demand drafts often look like ordinary business payments, so they can clear before anything flags them.²

Counterfeit Checks

Check-printing software and magnetic ink toner are cheap. With your name, routing number, and account number, a fraudster can produce a check that looks almost identical to one your bank issued. Counterfeit checks get cashed at retail locations or deposited through mobile banking apps into accounts the scammer controls. As with demand drafts, no card or PIN is involved, and the checks can pass initial processing before the fraud shows up on your statement.

Phishing Calls That Sound Like Your Bank

A stolen account number is also useful as social proof. A caller who can recite your account number, or even just the last four digits, sounds like a bank employee. That’s the point. The call is designed to lower your guard so you’ll hand over what the scammer doesn’t have yet: your Social Security number, your online banking password, or a one-time verification code your bank just sent you. With those, they can take over your online banking, open new accounts in your name, or reach other financial accounts tied to your identity.

What You’re on the Hook For

The Electronic Fund Transfer Act and Regulation E cap what you can lose to unauthorized electronic transfers from a personal account. The cap depends on how fast you report.³

Reported within 2 business days of learning about the loss or theft: your liability is capped at $50, or the amount taken before you notified the bank, whichever is less.
Reported after 2 business days but before 60 days: liability can climb to $500.
Reported more than 60 days after the bank sent the statement showing the first unauthorized transfer: unlimited liability for anything taken after that 60-day window and before you finally reported.

The 60-day rule applies even when no card was lost. If a scammer just has your account and routing number, any unauthorized withdrawal on your statement still has to be reported within 60 days of the statement date. Miss that, and you eat the losses that come after.¹

Read your statements every month. A small unauthorized withdrawal caught early is a very different problem from one caught six months in.

Business Accounts Aren’t Covered

These federal caps apply only to accounts established for personal, family, or household purposes. The EFTA’s definition of “account” excludes business and commercial accounts.⁴ If a business account gets drained, recovery depends on commercial agreements and state law rather than the fixed federal tiers above. Business owners should ask their bank about ACH debit blocks or positive-pay services that require pre-authorization for every withdrawal.

Freeze the Account and Report the Fraud

Call your bank’s fraud department as soon as you notice anything wrong. The number is on the back of your debit card or on the bank’s website. Ask for an immediate freeze so nothing else can move. Most banks will close the compromised account, transfer the remaining balance to a new account number, and reissue debit cards and checks.

Have this ready before you call:

The bank’s full legal name and the compromised account number.
For each suspicious charge: the date, the merchant or recipient, the dollar amount, and the transaction ID. Pull these from your online statement.
A driver’s license, passport, or other government-issued ID for identity verification.

Most banks then ask you to complete a fraud affidavit, a signed declaration that you didn’t authorize the transactions. Some require you to sign it at a branch.

How Long the Bank Has to Investigate

Regulation E gives the bank 10 business days from your report to investigate and resolve the dispute. The bank can take up to 45 calendar days instead, but only if it provisionally credits your account for the disputed amount within the first 10 business days so you have the funds while the investigation runs. The bank has to tell you the results within three business days of finishing.⁵

File an FTC Identity Theft Report

File a report at IdentityTheft.gov, the FTC’s dedicated portal. It takes about 10 minutes online and creates a formal record you can hand to banks and creditors as proof that your identity was misused. There’s also a phone option at 1-877-438-4338.⁶

The report unlocks specific rights. Businesses have to give you copies of transaction records tied to the theft, such as applications or account statements, free of charge, within 30 days of a written request.⁷ Those records help you document the fraud and can point at the person behind it.

If counterfeit checks are being written against your account, IdentityTheft.gov recommends contacting the two major check verification companies so businesses will refuse the stolen checks: TeleCheck at 1-800-710-9898 and Certegy at 1-800-437-5120.

Credit Freeze and Fraud Alert

Someone with your bank account number often has enough other information to try opening new credit in your name. A credit freeze and a fraud alert with Equifax, Experian, and TransUnion block that path, and both are free under federal law.⁸

A credit freeze stops the bureaus from releasing your report to new lenders. It lasts until you lift it, and you have to place it with each of the three bureaus separately.
An initial fraud alert requires lenders to verify your identity before approving new credit. It lasts one year and can be renewed. Contacting one bureau is enough; that bureau notifies the other two.
An extended fraud alert lasts seven years and removes you from pre-approved credit offer lists. It requires an FTC identity theft report or a police report to set up.

A freeze is stronger protection because it blocks access to your file entirely. A fraud alert only asks lenders to take extra verification steps. After bank account fraud, place both.

If the Bank Denies Your Claim

Banks sometimes reject fraud claims, usually because they believe the transfers were authorized or because the reporting window has passed. If your dispute is denied, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint, or by phone at (855) 411-2372. The online form takes about 10 minutes.⁹

The CFPB forwards your complaint to the bank, which generally has 15 days to respond. You then have 60 days to review the response and add feedback. The CFPB shares complaint data with other federal and state regulators, so a single complaint can pull broader attention onto a bank’s practices.

Making It Harder Next Time

Once your account is secure, turn on real-time alerts in your banking app. At a minimum, set alerts for large transactions, low balances, login activity, and any change to your account profile such as a new email address or phone number. Profile changes often show up right before a fraud attempt.

Custom thresholds help too. If you rarely spend above a certain amount, an alert at that level flags anything larger the moment it hits. Alerts on peer-to-peer transfers, international transactions, and declined transactions add extra early warning.

Some banks offer ACH debit blocks for business accounts that reject any incoming ACH withdrawal unless the sender is on a pre-approved list. The feature is less common on personal accounts, but it’s worth asking about. With or without a formal block, reading your statements each month and reporting anything wrong inside the 60-day window is still the strongest protection federal law gives you.¹

1
CFPB. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
2
CFPB. What Is a Demand Draft, Telephone Check, or Preauthorized Draft?
3
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
4
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
5
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
6
IdentityTheft.gov. What To Do Right Away
7
Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft
8
Federal Trade Commission. Credit Freezes and Fraud Alerts
9
CFPB. Learn How the Complaint Process Works