What can someone do with your bank account and routing numbers?

Warning signs your bank account number has been compromised

Recognizing the early warning signs of unauthorized access to your bank account can save you from major losses. Keep an eye out for unusual account activity and suspicious transactions. Here are some indications that someone has your bank account information.

Unexplained debits or discrepancies in your bank statements 

Review your account statements line by line. If you notice unauthorized transactions – even small ones – or any discrepancies you can’t account for, treat it as a serious warning sign. Cyber crooks sometimes make a tiny test charge or withdraw money in small amounts to see if you’re paying attention. Any suspicious activity like unapproved electronic payments or withdrawals should be investigated immediately.

Suspicious phone calls or messages asking for personal details or passwords 

Be wary of unexpected phone calls, texts, or emails claiming to be from your bank or a credit union. Common phone scams involve a fraudulent caller warning that your account is at risk and then asking you to “verify” sensitive personal details (like your online banking password or PIN). Legitimate financial institutions will never ask for your full password over the phone. If someone who claims to be a bank representative pressures you for confidential information, it’s a red flag that your details may already be in the wrong hands.

Alerts of logins or new payees you didn’t authorize 

Many banks send alerts for security events, such as a login from a new device, changes to your contact info, or the addition of a new payment recipient. If you receive notifications for actions you didn’t take, someone might be trying to access your online banking. Likewise, if you suddenly stop receiving account alerts you had set up, a scammer might have altered your notification settings. These could be signs that your bank account has been compromised and is being manipulated without your knowledge. 

What someone can actually do with your bank account and routing numbers?

Your routing number identifies your bank or credit union, while your bank account number identifies your personal account at that financial institution. Together, these numbers enable the smooth transfer of money for legitimate purposes like direct deposits and bill payments. 

Unfortunately, in the wrong hands, both your account number and routing number become tools for criminals to steal money and commit financial fraud. Here are some ways bad actors can exploit both your bank account number and routing number.

Set up unauthorized withdrawals and ACH payments 

With both your bank account and routing numbers, a scammer can attempt to electronically withdraw money from your account via ACH (Automated Clearing House) transactions. They might set up unauthorized ACH payments or transfers, essentially pulling funds out to pay for services or funnel money to their own accounts. Many online retailers and service providers allow direct bank transfers for online purchases – a fraudster could transfer money or pay bills using your account if no other verification is required. 

Create counterfeit or fake checks 

If someone has your bank account and routing numbers, they can print counterfeit checks with your information. Armed with a fake check, a criminal can try to cash it or deposit it to siphon money from your account. Modern technology has made it easy to create fake checks that look convincing. The scammer might write these fraudulent checks to themselves or to pay for goods, and when the check is processed, it pulls funds from your real account. They could even deposit digital images of the fake checks via mobile banking apps. 

Facilitate wire transfer fraud 

While knowing your bank account and routing numbers alone isn’t usually enough to directly send a wire transfer (banks require ID or authentication for that), fraudsters can still use that information to commit wire fraud indirectly. For example, they might impersonate you with a bank (through social engineering tactics) and provide your details to trick a banker into initiating a wire transfer. In 2024, consumers reported losing more money to scams where they paid via bank transfers (direct from accounts) than any other payment method.

Launder money through your account 

Surprisingly, a scammer who has your bank numbers might deposit money into your account – not as a gift, but as a way to move dirty funds. This is a form of money laundering. They could use your account as a temporary pit stop for illegal money, making it seem like a legitimate transaction. For instance, if you ever notice an unexpected direct deposit or random funds appearing in your account from an unknown source, do not rejoice – be concerned. It could be an attempt to launder money using your account, which could get you entangled in a legal mess.

Commit identity theft and open new accounts 

Your bank account information can also be used in broader identity theft schemes. On its own, an account and routing number won’t reveal your identity. But in combination with other personal details (like your name, Social Security number, or driver’s license info), criminals can impersonate you. They might attempt to open new credit accounts or even new bank accounts in your name, using pieces of your bank details to seem credible. For example, they could use your account number on fraudulent loan applications or to answer knowledge-based verification questions. According to recent data, identity thieves are rampant – over 1.1 million reports were filed through the FTC in 2024. Financial identity theft, where thieves use personal and banking data to open or access accounts, is a common subset of these crimes. 

What someone cannot do with just your bank account and routing numbers

It’s important to understand the limits of what a thief can do with your account and routing numbers, because it helps you know where your security still stands:

They cannot instantly clean out your account at an ATM or bank branch

To make an in-person withdrawal, a crook would need your physical debit card and PIN, or to present a fake ID matching the account holder’s name. Simply having a bank account and routing number isn’t enough to convince a teller to hand over cash. Banks and credit unions have safeguards and will ask for proper identification.

They can’t directly log in to your online banking

Your online account login credentials (username, password, and any 2FA codes) are separate from your routing/account numbers. Crooks can’t see your account balance or personal info just by knowing your account number. They would typically need your login (or to hijack your devices via malware) to access your online banking profile.

They can’t authorize major transfers or changes without verification

Large transactions like wire transfers or new account openings typically require identity verification beyond just bank account number or routing number. For example, your financial institution might call you or require a one-time passcode. Many digital banking services will send an alert or require confirmation if someone tries to link your account to a new payee or service. These measures help ensure that both your bank account number and routing number alone are insufficient for a fraudster to take full control.

They can’t simply take over other accounts

Some people worry that if a scammer has their bank numbers, they might also access other unrelated accounts (like credit cards or investments). The reality is those other accounts have their own identifiers and security. However, as noted, your bank info could be one piece of an identity theft puzzle. But a thief can’t call your cell phone provider or another bank and gain authority just with an account and routing number – they’d need additional personal details to pass security checks.

Despite these limitations, do not become complacent. The details printed on your checks or shared for payments should still be protected. Think of your bank account number and routing number as keys – on their own, they might not open every door, but in skilled hands they can open enough doors to cause serious damage. Banks do have security layers, but it’s wise to assume that if both your account number and routing number are exposed, you are vulnerable and should act to secure your accounts.

How can someone get your bank account and routing numbers

Even if you’ve never directly given out your account details to an untrusted party, determined scammers have ways to steal your banking information. Understanding their tactics can help you avoid the traps. Here are some common ways criminals can get your bank account number and routing number.

Phishing emails and fake websites 

One of the most prevalent methods that cyber crooks get their hands on sensitive data is phishing — sending emails or texts that impersonate a trusted entity (like your bank, a payment service, or even a colleague) to trick you into providing your bank details along with other sensitive information. The message might urge you to “verify your account” or warn of an urgent security issue, then direct you to a fake website that, at first sight, looks legit. If you enter your account and routing numbers (or login info) there, the scammers capture it. Some phishing sites install keyloggers that record what you type, including any online banking password you enter.

Check theft and check fraud 

The seemingly old-fashioned check fraud is alive and well. Your paper checks display your routing number and account number prominently along the bottom. If a thief steals a check from your checkbook or mailbox — they’ve got your bank details. They can then create counterfeit checks with that info or use the check’s info to initiate electronic payments. 

Data breaches of companies or banks 

Large-scale data breaches are another way your bank numbers can leak. You might trust that you’ve only shared your account info with reputable companies – but if one of those companies (or even your bank) gets hacked, your bank account number could be exposed through no fault of your own. 

Malware or keyloggers on your devices

Cybercriminals may try to infect your computer or phone with malware designed to capture sensitive data. For example, a keylogger can record everything you type, including your online banking credentials and account numbers. They might trick you into downloading such malware via fake antivirus alerts, trojan-infected email attachments, or malicious app downloads. Once installed, the malware can snoop on your banking sessions or even allow remote access to your device. 

Public Wi-Fi eavesdropping 

Logging into your bank account over a free Wi-Fi might seem convenient, but beware: public Wi-Fi networks can be hunting grounds for hackers. If the network is unsecured (no password) or compromised, an attacker could intercept data you send over it. In tech terms, they could perform a man-in-the-middle attack to capture information like your account login credentials or numbers you enter on a banking site. Some scammers even set up fake Wi-Fi hotspots with innocent names like “City Coffee Free WiFi” to lure people. 

Social engineering and impersonation 

Sometimes, the easiest way for thieves to get your info is just to ask – deceivingly. This tactic is called social engineering. The fraudster might call you, pretending to be from your financial institution or another official source, and use information they already know to gain your trust. They might say, “I’m calling from Big Bank’s fraud department. We have your routing number as #### and account number ending in 1234 on file – is that correct? We need to verify a possible fraud attempt. Please confirm the code we just sent to your phone.” In reality, that code is the 2FA code to log in to your online banking, which they triggered. If you give it to them, they can log in and do damage. In other cases, scammers impersonate potential employers or service providers to whom you might willingly give a voided check or account info, which they then misuse. 

What to do if you suspect misuse of your bank account

If you discover or strongly suspect that someone has accessed your account or is using your bank account number fraudulently, time is of the essence. Taking quick action can limit the damage and set the recovery process in motion. Here are a few steps you should take.

Report to your bank immediately 

At the very first sign of trouble (an unfamiliar withdrawal, a notification of changes you didn’t make) contact your bank’s fraud department. Inform them that your bank account may have been compromised. Banks have protocols to deal with such situations: they can freeze the account to prevent further unauthorized transactions, help you review recent bank transactions, and guide you on next steps. If fraudulent transactions are confirmed, you typically have up to 60 days to report them and not be held liable. The sooner the bank knows, the faster they can secure your funds. They may also issue you a new account number or debit card if needed.

File a police report if necessary 

Having an official police report can help establish that you are a victim and not a willing participant in any fraudulent activity. This can be important for claims investigations or if creditors need proof of the crime. Admittedly, the police may not always be able to track down the culprit for a small-scale bank fraud case. However, your report contributes to crime statistics and could be useful if your case is part of a larger fraud ring. Plus, the police report number is often requested by banks and credit reporting bureaus when you dispute fraudulent accounts or charges.

Contact the credit bureaus and set fraud alerts 

When your bank account information is compromised, there’s a chance other aspects of your identity are at risk too. Contact the three major credit reporting bureaus – Experian, TransUnion, and Equifax – to alert them. At a minimum, you can place a fraud alert on your credit reports, which encourages lenders to verify your identity more carefully if someone tries to open new credit accounts in your name. Fraud alerts are free and last one year (extended alerts last seven years if you prove you were an ID theft victim). Also, consider freezing your credit (also known as a security freeze) on your credit reports. A freeze blocks new creditors from accessing your credit file entirely, stopping new accounts from being opened, until you lift the freeze.

Change your passwords and secure other accounts

If someone had enough data to mess with your bank account, assume that any related online accounts could also be at risk. Immediately change your online banking password to a new, strong password (one you haven’t used anywhere else). If you use that same password for other sites or services, change those as well – and never reuse banking passwords on non-bank accounts. 

How to protect your bank account and routing number information

Protecting your bank account details before they fall into the wrong hands will spare you a lot of headaches. Here are proactive steps to keep your banking information safe from prying eyes and sticky fingers:

Monitor bank statements and set up alerts 

Vigilance is your first line of defense. Monitor your bank statements and transaction history frequently – don’t wait for the monthly paper statement. With mobile and online banking, it’s easy to check your account weekly or even daily. Look for any suspicious transactions or questionable small charges. Many banks also offer automatic account alerts: for example, you can get an email or text if a withdrawal over a certain amount occurs, or if your balance drops below a set threshold. These notifications act as an early warning system so you can react quickly to unauthorized uses of your bank account number. The faster you catch fraud, the easier it is to resolve. Also, if your bank offers free credit monitoring, enroll in it. It can tip you off to new inquiries or accounts that might stem from stolen bank data.

Secure your devices and networks 

Make it as hard as possible for hackers to penetrate your digital life. Start with strong, unique passwords for your financial logins – your online banking password should be long (think 12+ characters) and not used anywhere else. Consider using a reputable password manager such as NordPass to generate and store complex passwords if needed. Keep your smartphone and computer operating systems up to date. Such updates often fix security vulnerabilities. Use trusted security software to defend against malware and keyloggers. And remember one of the earlier points: avoid banking on public Wi-Fi. If you must do so, using a VPN (virtual private network) such as NordVPN will encrypt your connection. At home, set a strong password on your Wi-Fi router too – you don’t want someone next door snooping on your data through an unsecured network.

Avoid sharing account details unless absolutely necessary 

Be very careful about who you share your bank account number and routing number with. In everyday life, there are legitimate reasons to share them – for instance, with your employer for or with your utility company. Those are normal. But if a random person or unfamiliar entity asks for your bank account number as well as a routing number, treat it with heavy skepticism. Don’t email or text your account and routing numbers, and never post a voided check picture on social media (people often do this to celebrate getting paid). Use electronic payments or money transfer apps (such as  PayPal or Zelle) when possible because they often mask your account info from the other party. Likewise, never give out your bank account number in response to unsolicited calls – your bank or credit union will not randomly call and ask for your full account number. When in doubt, keep it to yourself. Also, consider what documents lying around your home or office have your account information. Store statements, checkbooks, and any papers with account numbers in a safe place.

Don’t use your bank account and routing numbers for online shopping

Whenever possible, do not directly use your bank account details for online purchases. Some online merchants or subscription services allow you to enter a routing and bank account number to pay. Online shopping is best done with a credit card or a secure third-party payment service. Credit cards offer robust dispute rights: for example, under US law, your liability for a fraudulent credit card charge is max $50, and many providers waive even that. With debit cards or bank drafts, the money leaves your account and you must fight to get it back. If you don’t have or want a credit card, consider prepaid cards or a payment app that debits your account behind the scenes – at least then the merchant never sees your actual account number. The goal is to minimize who is handling your sensitive banking information.

Only enter banking info on secure, trustworthy sites 

Sometimes you will need to provide your bank account and routing numbers online (for instance, maybe to set up direct deposit on your employer’s payroll site, or a government site for tax refunds). When you do, check that the website is secure. Look for “https://” at the start of the URL and a padlock icon in the browser’s address bar. The “s” in https means the data you send is encrypted. Never enter confidential info on a site with just “http://” (no “s”) because that can be intercepted. Also, ensure you’re on the correct website – phishing sites can look identical to the real thing except for a slight tweak in the address (like mybank.verify-security.com instead of mybank.com). 

Check your credit report regularly 

Get in the habit of checking your credit reports from the major bureaus a few times a year (you can do it for free via annualcreditreport.com in the US, or use a service). This is how you catch any new accounts opened in your name or any credit accounts that go delinquent due to fraud. Look for accounts or inquiries you don’t recognize – these could indicate someone used your stolen info to attempt something. By catching identity theft early, you can mitigate it before it snowballs. Regular credit monitoring is a cornerstone of identity theft prevention. It also ties back to your bank safety: if someone used your bank info to help answer security questions to open a loan, you’ll see that on your report. 

Use a credit monitoring service or identity protection tool 

For complete peace of mind, consider using an identity theft protection service. These services keep an eye on your financial footprint and alert you to potential fraud. For instance, NordProtect’s credit monitoring feature tracks your credit files and notifies you of new inquiries, accounts, or changes to your personal data. If a scammer tries to exploit your bank account details to open a loan or commit financial fraud, you’ll be notified. Additionally, NordProtect offers dark web monitoring – a feature that continuously scans dark web sources and breach databases to see if that information is exposed. If your bank account number ever appeared in a known breach or dump, you’d get an alert and advice on what to do next.