I Gave a Scammer My Bank Account Number: What to Do Now

Call your bank’s fraud line today, using a number you know is real, and ask about closing the account and opening a new one. With your account and routing numbers, a scammer can try to pull money out through electronic debits or checks you never wrote. But those numbers aren’t your online banking login. And if money is taken without your permission, federal law (or state law, for checks) may protect you if you report it in time (CFPB, CFPB). Here’s what to do.

What can a scammer do with my bank account number?

Yes, a scammer can use it, mainly to try to take money out. The CFPB notes that businesses often let you pay bills through the ACH network by providing your account number and bank routing number. A scammer can use the same numbers to try to:

• Set up electronic withdrawals. The OCC lists scam companies setting up automatic debits from your account among the most common banking scams.
• Create a check you never signed. The CFPB says a “demand draft,” or telephone check, lets someone withdraw money from your checking account without your signature, and that giving out your account and routing numbers gives someone the means to do it. It’s illegal for telemarketers to take money this way with unsigned “remotely created payment orders.”
• Print fake checks. Scammers use software, laser printers and blank check stock to produce counterfeit checks, the U.S. Postal Inspection Service says.
• Use your account to move money. A stranger may send money to your account, or mail you a check, then ask you to send some back or pass it on. That’s how fake check and overpayment scams work, and forwarding the money can make you a money mule.

Can a scammer access my bank account?

They can try. IdentityTheft.gov warns that a thief could try to use your account number to access or withdraw funds. But the number isn’t your password. Scammers who want to sign in as you go after your passwords (FTC) and the one-time verification codes banks use to prove it’s really you (FTC).

That’s why fake “bank” callers ask for your login, a texted code or your debit card number, a trick the CFPB describes (CFPB). See how to check if a call is really from your bank and what to do if you clicked a phishing link.

What to do if you gave a scammer your routing and account numbers

1. Call your bank’s fraud line

Use a number you know is real, like the one on your statement (IdentityTheft.gov) or the back of your debit card (FTC), not one from a caller, text or email. Tell the bank what you shared and when. Note the date, the name of the person you spoke with and any claim number.

Helping a parent? Regulation E’s official interpretation says a report from someone acting on their behalf counts, though the bank may ask for proof (CFPB).

2. Ask to close the account and open a new one

IdentityTheft.gov’s advice for exposed bank account information is to close the account and open a new one, which gets you a new number. The OCC also suggests asking your bank about closing your checking account to prevent further fraud.

Ask it to stop any automatic withdrawals you didn’t approve (OCC), whether any debits or checks are pending, and what else it can do to block ones you don’t recognize.

Then update automatic payments with your new account information (IdentityTheft.gov), and give it to anyone who deposits money for you, like an employer.

3. Tell the bank about anything else you shared

Your online banking login, a one-time code or your debit card details are more urgent, because they can let a scammer into your account or spend from it. If you shared:

• Your login or password: create a new, strong password, change it anywhere else you used it, and turn on two-factor authentication (FTC).
• A verification code: tell your bank right away. The FTC says a scammer can use your code to prove they’re you, and no real bank fraud department will ever ask for it (FTC).
• Your debit card, PIN or security code: report it within two business days of finding out to keep your limit at $50 (CFPB). See also I gave a scammer my credit card number.
• Access to your computer or phone: see I let a scammer into my computer.
• Your Social Security number: see I gave a scammer my Social Security number and consider a credit freeze.

4. Watch every transaction and turn on alerts

Review your transactions regularly, including any checks you didn’t write. If you find a withdrawal you didn’t make, call the fraud department and ask to have it removed (IdentityTheft.gov). The FTC also suggests signing up for text or email alerts whenever there’s a new transaction.

5. Don’t move money that shows up out of nowhere

If money you didn’t expect lands in your account and someone asks you to send some back, stop. A bank can take back a deposit credited by mistake (CFPB). A fake check can take weeks to be discovered, and by then you’re stuck paying the bank back (FTC).

Moving money for strangers can cost you money or even lead to jail, the CFPB warns. Stop communicating with whoever asked and tell your bank (CFPB).

6. Optional: freeze your ChexSystems report

ChexSystems reports on checking account applications, openings and closures. The CFPB says it will freeze your report if you ask (800-428-9623 or chexsystems.com). It also suggests that victims of bank or check fraud review these screening reports, especially before opening a new account. If you’re opening one now, ask your bank how a freeze would affect it.

Can I get my money back?

It depends on how the money left your account, and how fast you report it.

If money left electronically

The Electronic Fund Transfer Act and its rule, Regulation E, cover unauthorized electronic transfers, such as ACH payments (CFPB), ATM withdrawals, debit card purchases, some online bill payments and automatic deductions (CFPB). A transfer is unauthorized if someone other than you started it without your permission and you got no benefit from it (CFPB).

What you could owe depends on when you report (CFPB, Regulation E commentary):

What happened	When you tell your bank	The most you could owe
Your debit card, PIN or security code was lost or stolen	Within 2 business days of finding out	$50, or the amount taken if that’s less
Your debit card, PIN or security code was lost or stolen	After 2 business days	Up to $500
Money was taken, but your card, PIN and code were never lost or stolen	Within 60 days after the bank sends the statement showing it	Nothing, in the official interpretation’s example
Any unauthorized electronic transfer	More than 60 days after that statement	Possibly all transfers after day 60 until you report, if reporting sooner would have stopped them

These deadlines must be extended in unusual situations, like lengthy travel or a hospital stay (CFPB).

• Being tricked doesn’t make it your transfer. If a scammer fools you into sharing your login, a texted code or your debit card number and then takes money, the CFPB treats that as unauthorized. It also says a bank can’t use your carelessness to make you pay more than Regulation E allows (CFPB).
• The bank must investigate. It generally has 10 business days (20 if the account is less than 30 days old). If it needs longer, it must generally give you a temporary credit, minus up to $50, and resolve the claim within 45 days, or 90 in some cases (CFPB).
• Answer in writing if asked. If you reported by phone and the bank asks for written confirmation, send it within 10 business days, or it doesn’t have to give you that temporary credit (CFPB).

If a check you didn’t write was paid

Contact your bank as quickly as you can. If the check was processed as an electronic transfer, federal law gives you extra protections. If not, you may be protected under state law, the CFPB says. Your statement will often show which; if not, ask your bank (CFPB).

The OCC, which oversees national banks, says banks are generally required to reimburse customers for forged checks, but can investigate first. A bank may not have to pay if it acted in good faith and your own lack of ordinary care substantially contributed to the forgery. Expect to sign an affidavit, and the bank may ask for a police report.

You generally have up to 30 days from the statement date to report an unauthorized signature or alteration on a check, and time limits vary by bank and state.

If you sent the money yourself

Maybe you wired back an “overpayment,” or moved money because a caller said it wasn’t safe. The FTC warns that if you’re scammed into moving money out of your account, you won’t be protected and probably won’t get it back. Still, report it to your bank right away and ask it to reverse the payment (FTC). See I paid a scammer through Zelle, or the guides for Cash App and Venmo.

How to report it

After your bank:

1. FTC: report the scam at ReportFraud.ftc.gov. The FTC can’t resolve individual reports, but it uses them to investigate and bring cases.
2. IdentityTheft.gov: the FTC points anyone who thinks a scammer has their bank account number to IdentityTheft.gov (FTC). If someone used your information, report it there to get a recovery plan.
3. FBI Internet Crime Complaint Center: if the scam happened online, file at IC3.gov. IC3 doesn’t investigate cases itself, and you won’t hear back from it (IC3). More: what happens after you file at IC3.
4. U.S. Postal Inspection Service: if you’ve been affected by check fraud or got a fake check (USPIS), report it at uspis.gov/report or call 1-877-876-2455.
5. Local police: the OCC suggests a police report for check fraud (OCC).
6. CFPB: if your bank mishandles your claim, submit a complaint. The CFPB says most companies respond within 15 days.
7. Older adults and caregivers: the National Elder Fraud Hotline, 833-FRAUD-11 (833-372-8311), assigns a case manager to help you report. It’s open Monday through Friday, 10 a.m. to 6 p.m. Eastern (Office for Victims of Crime).

Keep copies of messages, phone numbers and payment details; IC3 says to keep originals in case an agency asks (IC3). Use the where to report a scam tool and the scam recovery checklist to keep track.

Watch for the follow-up scam

Scammers buy and trade lists of people who’ve already lost money, so you may be targeted again (FTC). Watch for:

• A “refund” offer. Someone offers to get your money back for a fee, or needs your checking account number to “deposit a refund.” Government agencies and legitimate organizations never ask for money to help you get a refund, and never ask for your financial account numbers. A refund check for more than you lost, with a request to return the difference, is always a scam (FTC).
• Your bank’s “fraud department” calling. A caller who asks for a verification code, or tells you to move money to “protect it,” is a scammer. Hang up and call the number on your statement (FTC).
• Someone claiming to be the FBI’s IC3. IC3 says it will never contact you directly for information or money (IC3).

What varies

• How the money left. Electronic transfers fall under Regulation E. For checks that aren’t processed electronically, any protections come from state law (CFPB).
• Your bank and state. Account agreements and deadlines for reporting check problems differ (OCC).
• Your account type. Regulation E covers accounts set up mainly for personal, family or household use (CFPB). For a business account, check your agreement and ask your bank.
• Who pressed “send.” A transfer a scammer made without your permission is treated differently from a payment you made yourself, even if you were tricked.