Someone has my account number and sort code — what can they actually do?

People give a sort code and account number to employers, landlords, friends and marketplace buyers many times a year, and then panic after giving them to someone who turned out to be dishonest. It is worth being clear about what those digits actually authorise, because the answer is much narrower than the fear.

Safety

Step by step

1. Know what they are for.They identify an account so money can be sent to it. They are printed on cheques, given to employers for wages and to anyone paying you. They are not credentials.
2. Know that money cannot be pulled out with them alone.A payment out of your account needs your authorisation through banking, a card, or a signed instruction. Two numbers do not authorise anything.
3. Understand the direct debit risk, and the protection.The plausible misuse is setting up a fraudulent direct debit. The Direct Debit Guarantee entitles you to an immediate and full refund from your bank of any payment taken in error or without a valid instruction, and your bank must chase it up, not you.
4. Assess what else was given away.Sort code and account number plus full name, date of birth, address and a document number is a different matter entirely — that is enough to attempt credit in your name. Judge the risk by the whole set.
5. Check the account, then keep checking.Look for small unexpected payments and for new direct debits or standing orders you did not set up. Turn on transaction notifications so anything new is visible at once.
6. Tell the bank if it was given to a fraudster.They can note the account, apply extra checks, and in some cases issue new account details without closing the account. Ask specifically.
7. Only change the account if there is a reason.Changing details means redirecting wages, direct debits and standing orders. It is worth doing after a serious compromise or repeated attempts; it is disproportionate after handing the numbers to one dishonest buyer.
8. Watch for the follow-up call.A criminal who has your account details will often ring pretending to be the bank, using them to establish credibility. Hang up and dial 159.

Tips

• Cheques carry the sort code and account number in plain sight and have done for a century. That is the best illustration of how these numbers were designed to be used.
• If you are worried about a fraudulent direct debit specifically, review the direct debit list in your banking app once a month. It takes a minute and catches it immediately.
• Never supply date of birth alongside bank details to a marketplace buyer. Payment does not need it, and identity fraud does.

Common mistakes

• Panicking and closing the account immediately — Disruptive and usually unnecessary. Talk to the bank first — new details without closure is often available.
• Assuming a screenshot of your banking app is harmless — It usually shows the balance, recent transactions and sometimes the full name and address, which is far more than the two numbers.

Questions people ask