What Can Scammers Do With Your Bank Account Number?

Can Scammers Access Your Bank With Just Your Account Number?

Peter Dolce’s nightmare started with a fraud alert for a suspicious $254 purchase. While the alert sent his heart racing, it was only after combing through past account statements that he realized it was just the tip of the iceberg [*].

Over the past year, scammers had siphoned out more than $13,000 from the veteran’s bank account without his knowledge. Even worse, Chase Bank said he’d waited too long to report the fraud and wouldn’t reimburse him.  

According to the Federal Trade Commission (FTC) [*]:

There were over 33,000 reports of bank fraud in the first quarter of 2023.

For many victims, all it takes to get scammed is their bank account number and a few other pieces of sensitive information falling into the wrong hands.

The problem is that most of us use our bank account numbers on a regular basis — whether signing up for direct deposit for a job or paying for items online with a debit card number.

So, what can scammers do with your bank account number? And what can you do to keep it — and your money — safe? Here’s what you need to know.

{{show-toc}}

How Do Scammers Steal Your Bank Account Numbers?

There’s not much illegal activity that crooks can pursue with just your bank account number (compared to if they steal your credit card numbers). But that doesn’t mean bank account numbers aren’t valuable data.

A bank account number is often the linchpin for many other scams, which can be more dangerous.

If fraudsters can combine your bank details and other easy-to-find information — such as your Social Security number (SSN), ABA or routing number, checking account number, address, or name — they can easily begin to steal money from your account.

Here’s how scammers can steal your bank account numbers in the first place:

• Phishing attacks. Scammers send fake bank text messages and emails or make phone calls that claim to be from your bank or other trusted companies (like Amazon or Apple). Often, they’ll include a link to a fake website that steals your bank account number or login information.
• Cyberattacks such as hacking and malware. Hackers can break into your computer or other internet-connected devices (such as mobile phones) and find any personal and financial information that you’ve stored on it. In other cases, cybercriminals may trick you into downloading malware that gives them full access to your devices.
• Data breaches. Financial institutions are often hot targets for cybercriminals to hack into their databases and leak information to the Dark Web. For example, more than 80,000 bank account numbers were leaked as part of the 2019 Capital One data breach [*].‍
• Social engineering. With more of your stolen information, scammers can create fake bank accounts under your name or gain access to your account (by fooling bank employees).‍
• Hacking payment processors or online retailers. Hackers may also target companies that are storing your linked bank account information — such as online stores or payment processors. ‍
• Using “skimming” and “shimming” devices. Fraudsters attach tiny devices to ATMs that steal your card details when you swipe or insert them. ‍
• Stealing your mail. Some scammers may even dig through your mail or garbage for old bank statements or other documents that contain your financial information.

Who is it safe to give your bank account numbers to?

Your bank account numbers should be kept private as much as possible. But that doesn’t mean they can never be shared. There are some legitimate situations in which someone will require your banking details.

In most cases, it’s safe to share your bank account number with:

• Tax filing services to pay for or receive annual tax credits.
• Your employer to set up direct deposit for recurring paychecks.
• Online payment and money transfer services such as PayPal or Zelle to deposit funds into your account.
• Credit card or loan providers to enable automatic bill withdrawal.
• Close friends or family members to whom you write checks.

The bottom line: Only share your bank account details with people or companies you know and trust. If you have any suspicions, look for a safer alternative.

⛳️ Related: How To Spot a Chase Phishing Email (5 Examples) →

What Can Someone Do with Your Bank Account Number? 7 Real Risks

1. Commit ACH fraud and withdraw your money
2. Use your bank details for online shopping
3. Launder money through your bank account
4. Create and use fraudulent checks
5. Steal your identity
6. Gain access to your online banking information
7. Conduct tax fraud

Take a look at these seven real risks that could have devastating ramifications if your bank account gets compromised. 

1. Commit ACH fraud and withdraw your money

ACH transfers use a financial network called the Automated Clearing House to transfer money from one bank account to another. But if scammers gain access to your bank account number, they can use it for fraudulent ACH transfers or payments.

For example, scammers could use your bank account details to buy products online. Or worse, they could trick you into sending them money that you’ll never be able to get back.

When the Fisher family was in the process of closing on a $1.4 million home, they were targeted by hackers who inserted themselves into an email conversation between the Fishers and their real estate agent [*].

The hackers changed the account details where the Fishers were supposed to send their downpayment — and disappeared with their cash.

How ACH Fraud happens

• Cybercriminals gain access to your bank account numbers as well as other pieces of personal information — a bank routing number or driver’s license is usually all that’s needed.
• Then, they find stores or retailers that accept ACH transfer as a payment method. For example, they could make purchases on Amazon if they have the necessary information [*].
• Scammers can also use this information to set up recurring payments, such as for subscriptions or utilities.

Look out for these warning signs:

ACH fraud is often easy to spot if you’re checking your accounts regularly. Look for unusual (or lower than expected) values in your checking and savings accounts as well as unexpected transfers or withdrawals.

Be especially cautious if you see multiple small withdrawals or transfers, as scammers often do this to avoid fraud detection tools.

Zoom out: Sign up for Aura (free for your first 14 days). Aura monitors your bank, credit, and investment accounts for suspicious activity, and will alert you up to 4x faster than the competition.

2. Use your bank details for online shopping

If scammers have your bank details, they can use them to make purchases on many online shopping sites.

In one example, a 33-year-old was scammed while buying a $2,600 Rolex on an online marketplace. The fraudster created a fake listing and then stole both the victim’s cash and their bank account details [*].

How scammers use your bank details for online shopping

• Scammers often create fake shopping websites with too-good-to-be-true deals to entice you. Then, they only offer specific payment methods — such as use of your bank account details, wire transfers, or gift cards.
• If you make a purchase, the item never arrives (or is a counterfeit version) and the scammers gain access to your bank account number.
• Then, they can use your stolen financial information to shop on genuine sites, make bogus charges to your account, or commit other forms of financial fraud.

Look out for these warning signs:

First, beware of scam websites designed to steal your banking information. Common signs of a fake shopping website include:

• Poor spelling, grammar, and design (such as blurry images).
• A lookalike domain name aimed to trick you into trusting its authenticity (for example, “Walmrat-deals.com” instead of “walmart.com”).
• A lack of contact information as well as details about the company, where they’re located, and their return policy.
• Only accepting non-reversible payment options, such as ACH transfers, wire transfers, or apps like Zelle and Venmo.

The bottom line: Steer clear of scammers who ask you to make any online purchases via money orders, wire transfers, or preloaded money cards.

⛳️ Related: The 9 Worst Wire Transfer Scams Happening Right Now →

3. Launder money through your bank account

Most people think of money laundering as a means to conceal the origins of money obtained illegally. But many people don’t realize that they can become accidental money mules if a scammer uses their bank account to launder money.

One major example this year has been phony remote work opportunities [*]. Scammers post fake job opportunities and request your payment details during the interview process. Then, they send you fraudulent checks and ask you to deposit them into your account and send some of the money back.

But when the check bounces, the full amount comes out of your account.

How scammers use your bank account to launder money

• Criminals target students, the unemployed, or victims on dating sites and social media with fake job opportunities. As part of the interview process, they ask for bank account details or request that applicants open a new account in order to “receive payments.”
• The fake job entails receiving goods or payments that the victim is then asked to ship to other people. Or, they’re given a check for more than the cost of their services, and are told to cash it and send the “extra” to another account.
• But victims are unknowingly laundering illegal money, selling and shipping stolen goods, or depositing fake checks.

Look out for these warning signs:

If a job posting seems too good to be true, it’s probably a scam. Beware of remote jobs that offer huge payments for seemingly menial tasks — such as being a mystery shopper, adding decals to your car, or becoming a personal assistant (with little-to-no training).

If anyone sends you a check for more than the amount you were supposed to get, don’t cash it or send funds “back” to another account. This is a classic refund scam.

⛳️ Related: How To Identify Fake Job Scams →

4. Create and use fraudulent checks

If scammers have enough pieces of information about you, they can create fake checks or even trick your bank into sending them paper checks for your account.

Then, they can either write checks to themselves or use them for refund scams — in which they ask victims to deposit fake checks and send back some of the money. But when the check bounces, the victim’s account is withdrawn for the full amount.

In one example, a Memphis woman was sent a check to buy supplies for a fake job and instructed to send back $3,000 in Visa gift cards to her “employer” [*]. But the check bounced, and she was out the full amount plus what she’d spent on the gift cards.

How scammers create fraudulent checks for your account

• Scammers utilize stolen bank account numbers to create fake checks.
• These checks are almost always used in employment scams — turning unknowing jobseekers into money mules.
• In other cases, victims are instructed to open a shared bank account with the scammer to “process” the checks. But the scammer can then use that legitimate account for creating more fraudulent checks that are tied to your information.

Look out for these warning signs:

You most likely won’t know if a scammer has written or sent you a fake check until it bounces or you see unexplained transactions on your account (labeled as “check withdrawal”).

If you receive a check from someone you’ve only met online, look for warning signs, such as:

• The check lacks an official financial institution logo or has a very faint logo.
• The bank’s address is missing or is different from the official address you find online.
• The check numbers are inconsistent between the upper-right corner and bottom line.

⛳️ Related: Wells Fargo Identity Theft Protection: Pros, Cons & Alternatives →

5. Steal your identity

Bank account identity theft occurs when a scammer uses your personal and financial information without your knowledge or consent.

It’s important to mention that a scammer cannot steal your identity with your bank account number alone. However, it only takes a few additional details to kickstart the identity theft process.

For instance, after noticing his bank account was missing a significant amount of money, a Michigan man learned that a scammer used his bank account information to open two new accounts with a slightly altered spelling of his last name and a different phone number [*].

How scammers can steal your identity using your bank account numbers

• Scammers gain access to your personally identifiable information (PII) through phishing attacks, data breaches, or other scams.
• Then, they use that information to gain access to your bank account and steal your money.

Look out for these warning signs that your identity has been stolen, including:

• Strange or unrecognized transactions on your bank account statements or credit report.
• New credit cards or loans in your name.
• Calls, emails, or letters from creditors, lenders, and banks you don’t recognize.
• A sudden drop in your credit score.
• Unfamiliar bills or packages arriving at your home.

Zoom out: Monitor your credit for signs of fraud. Aura’s credit monitoring feature will alert you in near real-time if anyone tries to open new accounts in your name or use your personal information to steal your money. Learn more about how Aura helps keep your credit and money safe →

6. Gain access to your online banking information

Scammers often use your bank account number as leverage to gain access to your online banking account.

For example, they could send you a phishing email claiming to be from Ally bank (or whatever financial institution you use) asking you to “confirm” your login details — and include your real account number to trick you into trusting the email’s legitimacy.

How scammers can use your bank account number to get into your online accounts

• There are several ways that scammers can gain access to your online bank account. They could use phishing attacks, malware or other cyberattacks, or buy your credentials online after a data breach.
• For example, the Michigan-headquartered Flagstar Bank was the recent victim of a data breach. More than 1.5 million customers had their banking details and Social Security numbers (SSN) leaked to the Dark Web [*].
• Once scammers enter your online banking portal, they have unlimited access to your funds.

Look out for these warning signs:

Always be cautious if you receive an unsolicited email, text, or phone call claiming to be from your bank. In all cases, you should hang up (or ignore the message) and log in to your bank account through its official website or app, rather than clicking on a link in a text message or email.

Make sure that you also take login attempt notifications seriously. If you receive an alert that your bank has been accessed from a location you don’t recognize or at a time when you weren’t active, someone else may have gained access to your online bank account.

⛳️  Related: How To Keep Your Online Bank Accounts Safe and Secure →

7. Conduct tax fraud

Scammers may use your bank account details and other stolen information to file phony tax returns (and pocket the refund). If this happens, you could end up in a nightmare scenario in which the IRS thinks you’ve committed fraud.

How scammers can conduct tax fraud with your bank details

• First, scammers (either an unknown criminal or an unscrupulous tax professional) steal your personal information and file a fraudulent tax return.
• Then, they enter their own banking details for the deposit and are never heard from again. Such was the case for a Georgia criminal who sought more than $23.8 million in fake tax refunds [*].
• Another way scammers can commit tax fraud is by stealing personal tax information to file a tax return in your name. Once the funds are deposited into your account, the scammers contact you posing as the IRS. They may claim that the refund was an error, and you must return the money. Next, they provide an account to which you are told to send the money — and then they disappear.

Look out for these warning signs:

Take any unfamiliar correspondences from the IRS seriously. You could be the victim of tax fraud if the IRS claims you’ve already filed a tax return (and you haven’t), you’re notified of an unfamiliar IRS.gov account, or you receive unfamiliar tax documents and transcripts.

Pro tip: The IRS provides an app to check the status of any returns you legitimately file. You can also view your online account to check your tax return and payment history for any signs of fraud.

⛳️ Related: The 7 Latest Chase Bank Scams (and How To Avoid Them) →

How To Tell If Scammers Have Your Bank Account Number

• Unexplained payments for small amounts. Scammers often start small with minimal withdrawals (i.e., a few cents to a few dollars) to test if your account is legitimate.
• Unexpected notifications from financial organizations. New purchases or credit lines flagged by your bank or credit card company are cause for concern.
• Callers who claim to be from your bank. Scammers may claim to be employed by your bank or credit agency to gain more personal and financial details. They’ll often provide some or your bank account numbers (or the full number) to build your trust.
• Your bank account has been completely emptied. If small withdrawals weren’t enough of an indication, a massive transaction that drains your account is a major sign.
• Your bank account has been closed. Scammers close out accounts once they’re drained to hide their activity. Be on high alert if your account is closed without authorization.
• You get a transaction limit warning. Receiving a notification about a transaction limit (or a big hit to your credit score) is another telltale sign.

⛳️ Related: Beware of These Wells Fargo Scam Texts →

Do Scammers Have Your Bank Account Number? Do This

If you suspect scammers have your bank account number and you’re a victim of identity theft, act quickly.

Once scammers access your bank account number, be sure to take the following steps.

1. Check your bank statements for unexpected charges and activity. Keep a documented list of any unusual behavior or transaction that you do not recognize.  
2. Call your bank and freeze your accounts. Contact the fraud department at your bank and explain the situation. They’ll freeze or cancel your accounts and issue you new cards and account numbers.
3. Freeze your credit with all three of the major reporting bureaus. Report the fraud individually to each of the big three credit bureaus — Equifax, Experian, and TransUnion — and ask them to freeze your credit file.
4. Report the fraud to the FTC. The FTC is the go-to source for fraud of all types, including bank, credit, medical, and tax fraud. All new cases of fraud can be reported directly through ReportFraud.FTC.gov. For identity theft, file an official report at IdentityTheft.gov.
5. File a police report. Local law enforcement can file a report indicating that you are the victim of a fraud crime. While your local police may not investigate the crime, a report can help you dispute any illegitimate charges or withdrawals. You may also want to file a report with the FBI’s Internet Crime Complaint Center (IC3).‍
6. Notify any company that was impacted. Alert any company or organization that has access to your banking details to let them know that your account was compromised. This could include payment apps, digital banking services, utility providers, and online stores. ‍
7. Change your online banking passwords. Protect yourself from further financial harm by securing your online accounts with stronger passwords and multi-factor or two-factor authentication (MFA or 2FA). You should take the same cybersecurity measures on your other sensitive accounts — such as your email account.  ‍
8. Consider signing up for an all-in-one digital security solution. Aura combines #1-rated identity theft protection with 24/7 credit monitoring and digital security tools including antivirus software and a virtual private network (VPN) to keep you safe from scammers. Try Aura free for 14 days to see if it’s right for you.

⛳️ Related: 2024 Bank Scams To Watch Out For →

Are You Liable for Charges That Scammers Make Using Your Bank?

Generally speaking, you are not liable for charges that scammers make with your bank account details. Scammers have committed a crime — and most banks won’t victimize you further by demanding that you pay for the crime from your own bank account.

However, there are a few guidelines to properly file a claim and avoid becoming liable for unauthorized charges.

• For ACH fraud: you must notify your bank within 60 days of your statement to avoid paying for illegitimate ACH transactions.
• For e-commerce purchases and withdrawals: you also have a 60-day time frame to avoid charges. You can file a claim with your bank online or over the phone.
• Once you notify your bank or financial intuition: they have 10 business days to investigate the issue (or up to 20 days for victims with a bank account open less than a month).

The bank must correct the issue within one business day of declaring that a crime has occurred, and report its findings to you within another three business days.

⛳️ Related: Do Banks Refund Scammed Money? →

The Bottom Line: Protect Your Bank Account From Bad Actors

It may not seem like a big deal for scammers to have access to your bank account numbers; but combined with other information, this can lead to devastating consequences.

Don’t let scammers get access to your bank account numbers, online accounts, or finances. Look for the warning signs of bank account fraud, and contact your financial institution if you see anything suspicious.

For added protection, consider signing up for Aura.

Aura protects your online accounts, identity, and finances from scammers. And if the worst should happen, Aura provides 24/7 access to U.S.-based Fraud Resolution specialists as well as up to $1,000,000 in insurance coverage for eligible losses due to identity theft.

Keep scammers out of your bank account. Try Aura free for 14 days.