# What Can Someone Do With Your Bank Statement?

- Author: CheapBankConvert (https://cheapbankconvert.com)
- Published: 2026-10-17
- Category: Safety and trust
- Canonical: https://cheapbankconvert.com/blog/what-can-someone-do-with-your-bank-statement

> What can someone do with your bank statement if it leaks? The real risks, the details that matter most, and what to do in the first hour.
What can someone do with your bank statement? With the account and routing numbers they can try to pull money or forge checks, and with your name, address and spending they can impersonate you or write convincing scam messages. They cannot log into your bank from a statement alone. Call your bank quickly and watch the account closely.

## What can someone do with the account and routing numbers on a bank statement?

The account and routing numbers on a bank statement are the details you give a utility or employer to move money in or out of your account. In the wrong hands, someone can try to set up payments that draw from your account or print fake checks. Banks catch much of this, but only if you check your account.

### Why these two numbers matter

A routing number identifies the bank and is public. The account number identifies your account. Together they are enough to set up a payment from your account with a business that does not check carefully, which is why statements usually mask most of the account number. The full number still appears on checks, and some statements print it in a footer or summary.

### What they cannot do with it

A statement does not contain your online banking password, your card's security code or your PIN. Someone holding only a statement cannot sign in to your banking app or withdraw cash at a machine. The damage they can do runs through payments that look like your own and through tricking you or your bank.

### How you are protected

US law limits what you owe for unauthorized electronic transfers, but the limits depend on reporting quickly. The [CFPB's guide to unauthorized transactions](https://www.consumerfinance.gov/ask-cfpb/how-do-i-get-my-money-back-after-i-discover-an-unauthorized-transaction-or-money-missing-from-my-bank-account-en-1017/) says to report an unauthorized withdrawal within 60 days after the bank sends the statement showing it, or you could be responsible for later transactions. Reading each statement when it arrives is the habit that keeps that protection.

## Bank statement details that feed identity theft and scams

Bank statement details beyond the numbers are useful to a thief because they make an impersonation believable. Your full name, address, employer, regular bills and favourite shops let someone answer security questions, apply for credit as you, or send a message that sounds exactly like your bank or a company you pay.

### What identity thieves do with personal details

The [FTC's page on identity theft](https://consumer.ftc.gov/articles/what-know-about-identity-theft) lists what thieves do with stolen personal and financial information: use or open credit accounts in your name, open phone or utility accounts, steal a tax refund, and get a job or medical care under your identity. A statement rarely holds everything needed for all of these, but it fills gaps in what a thief already has.

### The scam message problem

The transaction list is a script for phishing. If a statement shows you pay a particular phone company every month, a fake message from that company about an overdue bill looks plausible. If it shows a recent large purchase, a fake fraud alert about that purchase sounds real. The more specific a scam message is, the more people believe it.

### What the transactions reveal about you

A month of transactions shows where you live, where you work, when you get paid, which pharmacy and clinic you use, and who you send money to. For most people the embarrassment of that exposure is a bigger worry than theft. It is one reason to think twice about where you [store bank statements in the cloud](/blog/is-it-safe-to-store-bank-statements-in-the-cloud) and who can open that folder.

## Leaked bank statement risk by field

A leaked bank statement is risky in proportion to the fields it shows. A fully printed account number with your name and address is the worst case. A masked number on an old statement from a closed account is close to harmless. The table below ranks the usual fields from most to least useful to a thief.

The risk ratings are a general guide for planning, not a measure of any real incident.

| Field on the statement | What a thief could try | Risk |
| --- | --- | --- |
| Full account number plus routing number | Set up payments from your account, forge checks | High |
| Name and home address | Impersonate you, redirect mail, pass identity checks | High when combined with the account number |
| Employer and pay deposits | Target you with job or payroll scams, guess your income | Medium |
| Regular bills and merchants | Write convincing fake bills or fraud alerts | Medium |
| Medical, legal or personal payments | Embarrass or pressure you | Medium, personal rather than financial |
| Masked account number (last four digits) | Make a call to your bank sound more convincing | Low |
| Balances | Judge whether you are worth targeting | Low |

### Reading the table

Two fields together are worse than either alone. The account number with your name and address is the pairing banks worry about most. If you are deciding what to hide before sharing a statement, start there.

## Which leaked bank statements carry little risk?

Leaked bank statements carry little risk when the account is closed, the account number is masked, and the file reached someone who has no reason to misuse it, such as a known landlord who received it by mistake. In those cases a call to your bank is enough. You do not need to replace accounts.

### Low-risk situations

- **A closed account.** Payments set up against a closed account fail.
- **A single page with a masked number.** The last four digits identify the account to you, not to a thief.
- **A file sent to the wrong person you know.** Ask them to delete it. A colleague or relative who receives your statement by mistake is not a fraudster.
- **A statement shared with a government office as part of an application.** Agencies ask for statements routinely. If you are applying for benefits, [which bank statements a SNAP application needs](/blog/snap-application-bank-statements) covers what is normally requested, so you can send just that.

### Situations that are not low risk

A statement posted publicly, sent to a scammer, or exposed in a data breach at a company that held it calls for the steps in the next section. So does any leak that showed a full account number alongside your name and address.

## The first hour after a bank statement leak

The first hour after a bank statement leak is for three things: tell your bank, secure the accounts tied to the statement, and start watching for activity you did not make. Most of the damage from a leak comes from unnoticed payments, so speed and attention matter more than anything else.

Follow these steps in order:

1. **Call your bank** using the number on the back of your card or on its official website. Explain what leaked and ask whether they recommend a new account number.
2. **Change your online banking password** and turn on two-step sign-in, in case the leak was part of a wider attack.
3. **Change the password of the email account** the bank uses to contact you, because that account can reset others.
4. **Set up alerts** in your banking app for every withdrawal and every new payee.
5. **Consider a fraud alert or credit freeze.** The FTC's identity theft page says a fraud alert is free, lasts one year and needs a request to just one of the three credit bureaus, which must tell the other two. A freeze stops anyone opening new credit in your name while it is in place.
6. **Write down what happened**, including the date and who received the file. You will want this if you dispute a payment later.

### The weeks that follow

Read every statement for the next few months, line by line. Small test payments of a dollar or two can come before a larger theft. If anything appears that you did not make, report it at once; the CFPB guide notes that the bank generally has to investigate and may give you a temporary credit while it does.

## Bank statement leak mistake: trusting a caller from the fraud team

The most costly mistake after a bank statement leak is trusting a caller who says they are from your bank's fraud team. Scammers who hold your statement know your name, your bank and your recent purchases, so their call sounds real. They then ask you to read out a code or move money to a "safe account".

### How the scam goes

The caller mentions a real transaction from your statement and says it looks suspicious. They say they need to verify you and ask for the one-time code your bank just texted you. That code is often the key to signing into your account or approving a payment. Some callers go further and ask you to transfer your balance to a new account "for protection".

### What to do instead

Hang up. Call your bank yourself on a number you looked up. A real bank will never be offended by this. Do not read out codes, passwords or card details to anyone who called you.

### Prevention for next time

Most leaks start with a file that travelled further than it had to. Upload statements only to sites that state how they handle files, and avoid doing it on networks you do not trust; [whether to upload a bank statement on public WiFi](/blog/upload-bank-statement-on-public-wifi) and [whether it is safe to upload bank statements online](/blog/is-it-safe-to-upload-bank-statements-online) cover both checks.

[CheapBankConvert](/get-started) is built so the statement does not stay with it: its FAQ says files are deleted once you have downloaded your converted file. It is still in early access, so check the homepage before you plan around it.