What Should You Do If a Breach Exposes Bank Account and Routing Numbers?

If a breach exposed your bank account and routing numbers, treat it as time-sensitive financial risk. While credit card leaks often allow quick reversals, compromised bank details can enable ACH withdrawals, counterfeit checks, and new payment authorizations that directly drain your funds. This guide explains immediate actions, how to work with your bank, what to watch in the coming months, and how to protect your broader financial identity.

First, confirm exactly what was exposed

Breaches and alerts often use broad language. Before you act, identify the precise data involved and the exposure date. Knowing whether your account number, routing number, name and address, and any identity information (SSN, DOB, driver’s license) were included will shape the right response.

• Was it only your routing number? This alone is not enough for ACH withdrawals, but it can still help fraudsters pair data later.
• Was your bank account number exposed? That enables ACH debits and counterfeit checks.
• Were identity elements (SSN/DOB) exposed too? That increases the risk of account takeover, new accounts, and tax or benefits fraud.
• When did the exposure occur? You may need to review statements further back than a single month.

Immediate actions (today)

1. Call your bank’s fraud department immediately. State that your bank account and routing numbers were exposed in a breach. Ask them to:
   • Place a watch or heightened monitoring on the account for unauthorized ACH debits and check activity.
   • Explain their ACH dispute deadlines and provisional credit timelines.
   • Set up alerts for every transaction and for new payees or external linkages.
2. Decide: monitor closely or request a new account number.
   • If your account number was exposed, the safer route is to migrate to a new account number. This prevents future pulls using the compromised number.
   • If only the routing number was exposed, you can usually continue with alerts and monitoring, but remain vigilant.
3. Transfer recurring payments if you get a new account number. Ask your bank to assist with an “account number change” service that moves direct deposit, bill pay, and ACH authorizations to the new account. Keep the old account open with a low balance until all payees successfully switch, then close it.
4. Turn on granular alerts. Enable push/SMS/email alerts for:
   • All ACH debits and credits
   • External account links (Plaid/connects), Zelle/ACH enrollments, new payees
   • Checks clearing and large or unusual transactions
5. Check recent activity now. Review at least the last 90 days of bank statements and your online activity log. Flag any unknown debits, micro-deposits, or trial charges that may indicate a test pull.

How to handle unauthorized ACH withdrawals

If you see a suspicious debit:

1. Contact the bank the same day. Many institutions follow strict ACH dispute windows (often 60 calendar days from the statement date for unauthorized consumer debits). Report quickly to preserve rights and speed provisional credit.
2. File a written ACH dispute (Reg E claim). Complete your bank’s affidavit or dispute form. Provide the date, amount, merchant name, and why it’s unauthorized. Keep copies of everything you submit.
3. Request a “debit block” or “filter” if available. Some banks can block further ACH debits from the same originator or require your approval before funds leave.
4. Consider closing and reissuing the account number after fraud to prevent repeat pulls.

Protect against counterfeit checks and mailed fraud

With an exposed account and routing number, criminals can print counterfeit checks. Ask your bank about:

• Positive Pay or consumer check safeguards where available.
• Signature or amount alerts for checks clearing.
• Reducing or halting check usage and shifting to electronic bill pay within your bank’s portal.

If other identity data was exposed too

If the breach included your SSN, DOB, or driver’s license number alongside bank details, elevate your response:

• Place a fraud alert with any one of the three bureaus (Experian, Equifax, TransUnion). They’ll pass it to the others. This adds friction to new credit applications.
• Consider a credit freeze with all three bureaus to block new credit entirely until you lift the freeze. It’s free and you can thaw it temporarily when needed.
• Monitor deposit accounts too. Check ChexSystems or Early Warning Services for unauthorized bank account openings in your name.
• Watch tax and benefits accounts for suspicious activity if SSN was involved.

Strengthen your online banking security

• Change your online banking password to a unique, long passphrase (at least 14+ characters). Do not reuse passwords.
• Enable multi-factor authentication (MFA) and prefer app-based or hardware-based codes over SMS when supported by your bank.
• Review connected apps and services (e.g., budgeting tools via Plaid). Remove anything you don’t use, and re-link only after you’ve secured or replaced your account number.
• Update payee lists and verify that only legitimate contacts and billers remain.

Document everything you do

Create a simple incident log with dates, times, and actions:

• Names of bank representatives and ticket numbers
• Copies of dispute forms and any letters or emails
• Screenshots of alerts and suspicious activity
• Notes on account re-issuance, merchant communications, and status updates

Good documentation helps resolve disputes and supports any future claims if issues appear later.

What to monitor over the next 12 months

• Bank transactions: Review statements monthly and scan your account activity weekly or via alerts.
• New external link attempts: Watch for notifications that someone tried to link your bank account to a payment app or service.
• Check activity: If you still use paper checks, keep volumes low and watch for out-of-pattern clearings.
• Credit reports: Look for unexpected accounts, inquiries, or address changes, especially if SSN/DOB were exposed.
• Mail and email: Be wary of “account verification” messages or letters about new accounts you didn’t open.

When you might not need a new bank account number

Not every incident requires reissuing your account number. You may opt to keep your number if:

• Only your routing number was listed in the breach and your bank confirms no other exposure.
• The breached data is strongly historical or partial (e.g., masked account numbers) and your bank confirms low risk.
• You have tight, real-time alerts and your bank offers strong ACH controls or filters.

However, if both your account and routing numbers were exposed, replacing the account number is the most conservative route to prevent future unauthorized pulls.

Common questions

Can someone withdraw money with just my routing number?

No. A routing number identifies your bank. To initiate an ACH debit, a fraudster usually needs your routing number and your account number (plus your name and sometimes address). Still, treat any exposure seriously.

If I move to a new account number, what breaks?

Direct deposits, ACH payments, and auto-drafts tied to your old number will fail until updated. Ask your bank to help migrate recurring transactions, and maintain the old account briefly with a small balance until all payees switch over.

Will a credit freeze stop bank-account fraud?

No. A credit freeze stops new credit lines, not debits from existing deposit accounts. You still need bank-level controls, alerts, and possibly a new account number if yours was exposed.

What if a merchant I trust was breached?

Even familiar companies can be compromised. Replace your account number if exposed, rotate credentials, and set alerts. Don’t assume future transactions from the same merchant are safe until you’ve re-authorized them on your new account.

Practical script for calling your bank

“My bank account and routing numbers were exposed in a data breach. I want to prevent unauthorized ACH debits and counterfeit checks. Can you place enhanced monitoring and alerts on my account? If my account number was exposed, I’d like to open a new account and migrate my existing direct deposits and bill payments. Please explain the ACH dispute window, provisional credit timing, and any blocks or filters you can set for ACH debits.”

If you haven’t seen fraud yet

It’s normal not to see immediate activity after a breach. Criminals often test with small transactions or wait months. Keep alerts on, review statements, and consider a new account number if exposure is confirmed. It’s also smart to plan your documentation and monitoring steps now so you’re ready if anything appears later.

Where to get ongoing credit and identity monitoring

Because financial identity misuse can surface months after a breach, consider a service that tracks changes to your credit and alerts you to activity that could affect your financial identity. If you want an option to evaluate after you’ve taken the steps above, you can review SmartCredit as an optional next step for credit and identity monitoring: SmartCredit for privacy, credit monitoring, and identity protection.

Conclusion

A breach that exposes your bank account and routing numbers deserves an immediate, structured response. Confirm what was exposed, contact your bank’s fraud team, enable strong alerts, and consider replacing your account number if it was compromised. Dispute unauthorized ACH debits quickly, document every step, and monitor for new link attempts or unusual activity. If identity data was also exposed, add a fraud alert or credit freeze to reduce the risk of new-account abuse. With a clear plan, you can contain the damage, restore control, and reduce the chance of repeat fraud over the months ahead.