Someone who has your bank routing number and account number can pull money out of your account through unauthorized ACH debits, print counterfeit checks drawn on your account, and use those numbers as a wedge to pry loose more sensitive information about you. The routing number by itself is not secret — banks publish them — but paired with your account number, it is enough to cause real damage before you notice.
Here is what that damage looks like, what federal law puts back on the bank, and what to do the moment you suspect your numbers are out.
Unauthorized ACH Debits
The fastest way to drain a compromised account is through the Automated Clearing House network. An ACH debit needs only the routing number, the account number, and the account holder’s name. No card, no PIN, no signature. A fraudster can set up debits that look like ordinary bill payments to a utility, credit card, or lender and move money straight out of your balance.
Peer-to-peer payment apps are covered by the same federal rules. The Consumer Financial Protection Bureau has said that any transfer meeting the definition of an electronic fund transfer falls under federal consumer protections, even when a third party fraudulently initiated it.1Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs The private network’s own rules do not override your rights against the bank that holds your account.
Counterfeit Checks and Check Washing
Your routing and account numbers sit along the bottom of every check you write. With those digits, cheap check-printing software, and magnetic ink, a criminal can produce counterfeit checks that carry your real banking details and pass initial screening at retailers or deposit-taking banks.
A related trick is check washing. Someone steals a legitimate check from your mailbox, uses chemicals to lift the ink, then rewrites the payee and amount over your real account information. The Office of the Comptroller of the Currency recommends writing checks with black gel ink, which resists chemical washing.2OCC. Check Fraud
Leverage for Broader Identity Theft
Account numbers are also social-engineering fuel. A caller who can recite your real account number sounds like you to a bank representative, and that credibility can be enough to answer security questions tied to recent transactions or balances, or to talk a rep into confirming other personal details.
Synthetic identity fraud takes this further. A criminal combines your real account number with someone else’s Social Security number and fabricated personal details, builds a new “person” on paper, opens credit cards and loans in that name, pays reliably to raise the limits, then maxes everything out and vanishes. The cleanup falls on whoever’s real data is tangled up in the file.
What You Can Actually Lose on a Personal Account
Federal law caps your liability for unauthorized electronic transfers, but the cap depends entirely on how fast you report. The Electronic Fund Transfer Act sets the baseline,3GovInfo. 15 USC 1693g – Consumer Liability and Regulation E lays out three tiers:
- Report within two business days of learning about the unauthorized access, and your maximum liability is $50.
- Miss the two-day window but report within 60 days of the bank sending the statement showing the transfer, and liability can rise to $500.
- Wait longer than 60 days after that statement is sent, and you can be on the hook for the entire amount, with no cap.
Once you dispute an unauthorized transfer, the bank has 10 business days to investigate. If it needs more time, it must provisionally credit your account for the disputed amount and can take up to 45 days total to finish the review.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Counterfeit checks work under a different rule. Under the Uniform Commercial Code, a bank can only charge your account for items that are “properly payable,” meaning items you actually authorized.5Cornell Law School. Uniform Commercial Code 4-401 – When Bank May Charge Customers Account A forged check is not properly payable, so the bank generally absorbs the initial loss — though the allocation can shift if your own carelessness contributed to the forgery.6Cornell Law School. Uniform Commercial Code 3-406 – Negligence Contributing to Forged Signature or Alteration of Instrument
One boundary to know: these consumer protections apply to personal accounts. Business accounts fall under UCC Article 4A, and if you and the bank agreed on a security procedure and the bank followed it, the loss on an unauthorized payment order can sit with the business.7Cornell Law School. Uniform Commercial Code 4A-202 – Authorized and Verified Payment Orders Most business banking agreements include such procedures, so businesses should read their agreement rather than assume Regulation E applies.
Secure the Account Right Now
If you think your routing and account number are out, ask the bank for a full account closure, sometimes called a hard close, rather than a temporary freeze. A freeze pauses transactions; a hard close permanently retires the compromised account number and forces the bank to issue a new one.
Before you close the old account, pull your most recent statements and note the date of your last authorized transaction. That timeline helps the bank isolate the unauthorized activity and supports any dispute. Then ask the bank for a list of established ACH originators tied to the old account, because everything on that list needs to be moved.
Move Every Recurring Payment and Deposit
Closing an account breaks every automatic link running through it: paychecks, government deposits, mortgage, insurance, subscriptions, utility autopay. Anything you forget will bounce, and late fees pile up fast. Work through the ACH originator list systematically and update each one to the new account.
Tax refunds need their own attention. If the IRS tries to deposit a refund into a closed account, the bank rejects it and the IRS sends a CP53E notice giving you 30 days to update your bank information through your IRS online account — and you get only one shot at that change.8Internal Revenue Service. Understanding Your CP53E Notice Miss it and you get a paper check about six weeks later. IRS employees cannot update the bank information over the phone. The IRS also limits direct deposits to three electronic refunds per bank account per tax year, which matters if the new account is shared.9Internal Revenue Service. Tell IRS to Direct Deposit Your Refund to One, Two, or Three Accounts
Report the Fraud and Lock Down Your Credit
File first with the Federal Trade Commission at IdentityTheft.gov. The portal produces a personalized Identity Theft Report and a recovery plan, and that report is the document banks and creditors will ask for when you dispute charges or push to have fraudulent accounts removed.10Federal Trade Commission. Identity Theft Recovery Steps
Then file a police report with your local department. Many banks and creditors require both the police report and the FTC report before they will permanently remove unauthorized charges or close fraudulent accounts.11Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud Businesses that hold records of transactions made in your name must release those records to you when you provide proof of identity, a police report, and a completed affidavit.12Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft
Next, decide between a fraud alert and a credit freeze. A fraud alert tells creditors to verify your identity before opening new accounts. An initial alert lasts one year and anyone who suspects fraud can place one; an extended alert lasts seven years but requires an FTC Identity Theft Report or police report, and it removes you from pre-screened credit offer lists for five years.13Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts A credit freeze goes further by blocking creditors from pulling your report at all, which stops new accounts cold. Placing and lifting a freeze is free at all three major bureaus, doesn’t affect your credit score, and doesn’t touch your existing accounts.14Consumer Advice – FTC. Credit Freezes and Fraud Alerts
If fraudulent accounts or debts do show up on your credit report, you can require the credit reporting agencies to block that information. Once you send proof of your identity, a copy of your Identity Theft Report, and a list of the fraudulent entries, the agency must block them within four business days.15Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
Habits That Keep Your Numbers Out of Circulation
A few practices meaningfully reduce the chance of a repeat:
- Write checks with black gel ink, which resists chemical washing.2OCC. Check Fraud
- Ask your bank whether it offers an ACH debit block or filter, which blocks any ACH pull from your account unless the originator is on a list you have approved.
- Check your account at least weekly instead of waiting for a monthly statement, so unauthorized activity falls inside the two-business-day window that caps your liability at $50.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Don’t share your account details over email or on unfamiliar sites. When you can, pay through your bank’s online bill pay, which keeps your account number hidden from the recipient.
- Shred old statements, voided checks, and pre-printed deposit slips. They all carry the same two numbers you’re trying to protect.