Routing Number Fraud and Scams: How to Protect Yourself

Routing numbers are public information, which makes them an attractive tool for fraudsters. While knowing someone's routing number alone isn't enough to steal their money, combining it with an account number opens the door to several common fraud schemes. Here's what to watch for and how to protect yourself.

Check Fraud: Counterfeit and Altered Checks

One of the oldest forms of routing number fraud involves counterfeit checks. Fraudsters print fake checks using real routing numbers — sometimes their own bank's routing number, sometimes a completely fabricated one that still passes the ABA checksum. The check looks legitimate, clears provisionally when you deposit it, and then bounces days later after the funds have been withdrawn.

The golden rule: never spend funds from a check until your bank confirms the funds have cleared — not just been provisionally credited. This is especially important for checks received from strangers, overpayment scams, or unexpected windfalls.

ACH Fraud: Unauthorized Debits

ACH fraud occurs when someone uses your routing number and account number to initiate unauthorized ACH debits from your account. This requires knowing both your routing number and your account number — routing number alone is not enough. Common scenarios include:

• Data breaches that expose account numbers from a vendor's database
• Phishing attacks that trick you into entering your banking information on a fake website
• Insider fraud at institutions where employees have access to account data

The good news: unauthorized ACH debits are reversible within 60 days of the statement date. Report them to your bank immediately and file an ACH return request. Our guides explain the ACH return process in more detail.

Direct Deposit Hijacking (Payroll Redirect Scams)

One of the fastest-growing fraud types involves criminals gaining access to an employee's HR or payroll portal and changing the direct deposit routing number and account number to one they control. The employee doesn't notice until their paycheck fails to arrive on payday.

Protect yourself by: enabling multi-factor authentication on all payroll portals, watching for unexpected emails asking you to "verify" your direct deposit information, and checking your bank account on every payday. If you use an employer with a self-service portal like ADP or Workday, set up alerts for any changes to your payment settings.

Tax Refund Fraud

Fraudsters who obtain your Social Security number may file a fraudulent tax return on your behalf and redirect the refund to their own account by providing a different routing number. The IRS's direct deposit system processes refunds to whatever routing number is on the return. By the time you file your legitimate return and discover the fraud, the refund is gone.

Prevention: file your tax return early — before fraudsters can file first — and consider placing an IRS Identity Protection PIN on your account.

Protecting Your Routing and Account Numbers

• Never share your account number in response to an unsolicited request, even if the caller claims to be from your bank
• Shred any documents that display your account number, especially old checks and bank statements
• Set up account alerts for all ACH debits so you're notified immediately of any unauthorized activity
• Review your bank statements monthly and report suspicious transactions promptly
• Use our routing number lookup to verify any routing number before accepting it from a third party

Remember: your routing number alone is public and harmless. It's the combination of routing number, account number, and identity information that creates risk. Browse our guides section for more on payment security and routing number verification.