Someone holding your bank account and routing number can pull money out through ACH debits, print counterfeit checks drawn on your balance, link your account to outside payment apps, and use the numbers as identity verification to talk their way into your other accounts. None of that requires your PIN, your online banking password, or your signature. What limits the damage is how quickly you notice and report it: federal law caps your loss at $50 if you tell your bank within two business days, and lets your losses go uncapped after 60 days.
Unauthorized ACH Withdrawals
The Automated Clearing House network moves money between bank accounts for payroll, utility bills, and app transfers. Anyone with your routing and account number can set up an ACH debit against your account to pay their own bills, fund a prepaid card, or push money to an account they control. On your statement, these debits look like ordinary recurring charges, which is why they blend in.
ACH rules require the account holder’s authorization before a debit is originated, but that rule is enforced after the fact by the receiving bank, not blocked in advance. Because ACH runs in batches, the money is usually gone from your balance before the charge appears. You have up to 60 calendar days from the date the statement showing the debit is sent to dispute it and get the funds returned.
Counterfeit and Washed Checks
The routing and account number printed along the bottom of every check is enough to produce a convincing counterfeit. With check-printing software and magnetic ink, a fraudster can create checks carrying your real banking information that pass through normal processing, then cash them at a retailer, deposit them at a branch, or submit them through a mobile deposit app. The money comes straight out of your balance.
A related method is check washing. Criminals steal a legitimate check, often from an outgoing mailbox, and use chemicals to dissolve the ink so they can rewrite the payee and the amount while the original account information stays intact.1United States Postal Inspection Service. Check Washing The altered check looks authentic because it is authentic. Creating or using counterfeit financial instruments is a federal felony.2Office of the Law Revision Counsel. 18 U.S. Code 514 – Fictitious Obligations
Account Linking Through Micro-Deposits
Financial apps and brokerage platforms often verify a new bank connection by sending two tiny deposits, usually a few cents, and asking the user to confirm the exact amounts. A fraudster with your routing and account number can start that verification against your account to link it to a platform they control. Some run through strings of random account numbers hoping to hit a valid one, then use the confirmed link to pull larger transfers later.
Small, unexplained deposits under a dollar from a company you do not recognize can be the first sign someone is trying to verify your account for future withdrawals. Call your bank about them rather than dismissing the amount.
Social Engineering Against Your Other Accounts
Account and routing numbers work as secondary verification at many companies. When a caller reads correct banking details to a utility provider, phone carrier, or even your bank, it adds credibility to the claim that they are you. That perceived legitimacy can be enough to get a representative to reset a password, change the mailing address, or grant administrative access.
Once a fraudster controls one account in your name, the information gathered there can be used to compromise others, so a single pair of numbers can expose your broader financial identity. The Department of Justice recommends contacting any company where you know fraud occurred and asking it to freeze or close the compromised account immediately.3U.S. Department of Justice. Identity Theft and Identity Fraud
How Much You Can Lose Under Federal Law
The Electronic Fund Transfer Act and its implementing regulation, Regulation E, set a tiered liability structure that rewards fast reporting. Your maximum out-of-pocket loss depends on how quickly you notify your bank after discovering unauthorized activity.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within two business days and your maximum liability is $50, or the total unauthorized amount if that is less.
- Report between two and 60 days after the statement is sent and your maximum liability rises to $500. You are responsible for the first $50 plus any additional unauthorized transfers the bank can show it could have prevented had you reported sooner.
- Report after 60 days and you lose the federal cap for any unauthorized transfers that happen after the 60-day window closes. If the bank can prove it could have stopped those later losses, you bear them in full.
The clock runs from the date your bank sends the statement showing the unauthorized activity, which is why checking statements each cycle is one of the strongest protections you have. A single missed cycle can dramatically increase your exposure.
Reporting Unauthorized Transactions
Speed matters more than anything else once you spot a charge you did not authorize. The liability tiers above start running from the moment you learn about, or reasonably should have learned about, the unauthorized activity.
Call Your Bank’s Fraud Line
Use the dedicated fraud line, not general customer service. Ask the bank to freeze or close the compromised account and issue a new account number. Identify each unauthorized transaction by date, amount, and merchant name. The bank will usually have you fill out a written notice of unauthorized transfer describing which items you did not authorize.5Consumer Financial Protection Bureau. Stopping Automatic Debit Payments – Sample Notice of Unauthorized Transfer
If the unauthorized charges are recurring ACH debits, you can place a stop-payment order. Under Regulation E, your bank must honor a stop-payment request as long as you submit it at least three business days before the next scheduled transfer.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers If you make the request by phone, the bank can require written confirmation within 14 days. Stop-payment fees typically run $15 to $36.
Know the Investigation Clock
After the bank receives your notice, it generally has ten business days to investigate and decide whether an error occurred.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors It can extend the investigation to 45 calendar days, but only if it provisionally credits your account for the disputed amount within the initial ten business days. You have full use of the provisional credit while the investigation continues.8Office of the Law Revision Counsel. 15 U.S. Code 1693f – Error Resolution
File With the FTC and Local Police
If the activity looks like broader identity theft, report it at IdentityTheft.gov. The site generates an FTC Identity Theft Report, builds a personalized recovery plan, pre-fills dispute letters, and tracks your progress.9Federal Trade Commission. IdentityTheft.gov A police report is optional but useful. Some banks and creditors ask for a report number before processing a dispute, and having one documents the theft if you later need to challenge a ChexSystems record or an account opened in your name.3U.S. Department of Justice. Identity Theft and Identity Fraud Bring your FTC Identity Theft Report, government-issued photo ID, and proof of address to your local police department.
Protecting the Account Going Forward
Move to a New Account Number
Freezing the compromised account is only a temporary fix. You need a new account number, and once you have one, list every employer, service provider, and biller that had the old details for direct deposit or automatic payment, then update each one. Any recurring payment you forget will bounce once the old account is fully closed.
If the bank closes an account with an outstanding negative balance, the closure can be reported to ChexSystems, which may make opening accounts elsewhere harder.10ChexSystems. ChexSystems Frequently Asked Questions When the balance came from fraud rather than your own activity, you can dispute the record by submitting an identity theft affidavit to ChexSystems.
Place a Fraud Alert on Your Credit
A fraud alert tells lenders to verify your identity before opening new credit in your name. An initial alert lasts one year, is free, and only requires contacting one of the three major credit bureaus, which must notify the other two.11FTC. Credit Freezes and Fraud Alerts If you file an FTC Identity Theft Report, you can request an extended alert that lasts seven years.12Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts Placing either alert also entitles you to a free copy of your credit report from each bureau.
Turn On Preventive Banking Tools
Ask your bank about ACH debit blocks or filters. A debit block prevents any electronic withdrawal unless you have pre-authorized the company originating it, so the bank processes only the transactions on your approved list and rejects the rest. This is worth setting up on savings or emergency accounts you do not use for everyday bill pay.
If you write checks regularly, ask whether the bank offers Positive Pay. The service matches each check presented against a list of checks you have actually issued, comparing check number, amount, and payee, and flags anything that does not match before paying it. Positive Pay is more common on business accounts, but some banks offer a personal version.
For day-to-day protection, write checks with a gel or pigmented-ink pen, which resists the solvents used in check washing. Do not leave outgoing mail with checks in an unsecured mailbox, and deposit checks through a mobile app or an ATM rather than mailing them when you have the choice.