A payroll vendor says your bank account and routing numbers were exposed.
Contact the bank before guessing which product to change
Use the number on your bank card, statement, or official website and explain exactly what information the breach notice says was exposed. Ask the bank what controls it recommends for that account type and whether it wants to replace the account number.
Do not rely on a credit freeze for this problem. A freeze is primarily aimed at new-credit access, not at protecting an existing deposit account from fraudulent transfers or account takeover.
Secure online banking and its recovery channels
Change the banking password if credentials may be involved or if the password was reused. Review enrolled devices, external transfer accounts, beneficiaries, alert destinations, and contact information. Turn on multi-factor authentication if it is not already enabled.
Watch for a change to the email address or phone number on the account, because that can interfere with fraud alerts and password recovery.
Increase transaction visibility
Enable alerts for transfers, withdrawals, new payees, and other high-risk events if the bank offers them. Review pending transactions as well as posted items because early detection can change what the bank is able to do.
Ask the bank how it wants unauthorized transactions reported and what records it needs from you.
Replace the account number when the bank recommends it
An account-number change can affect payroll, bill payments, direct deposits, and linked services, so coordinate the transition rather than closing an account impulsively. Ask how long old payment instructions remain valid and what happens to pending items.
Keep a checklist of every legitimate service that must receive the new details.
Escalate to identity-theft recovery if other misuse appears
If someone also opens accounts, uses your identity at another institution, or creates fraudulent debts, report the broader identity theft through IdentityTheft.gov and review your credit files. The bank incident may be one part of a larger identity-theft case.
Keep bank case numbers and statements with the rest of your incident documentation.
Ask what kind of payment instructions are at risk
An account and routing number can be used in different transaction systems than a debit-card number or online-banking credential. Tell the bank exactly which fields the notice says were exposed and ask what categories of transaction it is concerned about. The institution may recommend monitoring, account-number replacement, limits, or other controls based on the account type and its own systems.
Do not assume changing the online-banking password changes the account number. Those are separate layers of the same banking relationship.
Map every legitimate dependency before replacing the account
List payroll deposits, Social Security or benefit deposits, rent or mortgage payments, utilities, loan payments, peer-to-peer transfer services, brokerage links, tax payments, and other recurring transfers. Ask the bank how pending transactions will be handled if it closes or renumbers the account.
Move the legitimate dependencies deliberately. A rushed account closure can create missed payments that have nothing to do with the original breach.
Keep fraud alerts and statements during the transition
Even after a replacement account is opened, review the old account’s final statements and any transactions that arrive during the bank’s transition period. Save the fraud case number and the date the bank says the old credentials stop working.
If a separate identity-theft problem appears—such as an unfamiliar loan or credit account—start the credit and FTC recovery steps too. Bank-account exposure and new-account identity theft can coexist.
Example: payroll bank details were included in the breach
Call the bank using the number on your card or statement and explain that the account and routing numbers—not merely a debit card—were exposed. Ask what transaction types the bank considers at risk, whether it recommends a new account number, and which alerts or restrictions it can place. Secure online banking at the same time if login credentials were reused or exposed elsewhere.
Before changing the account number, build a dependency list: payroll, benefits, tax payments, mortgage or rent, utilities, credit-card autopay, investment transfers, and payment apps. Ask the bank how it handles deposits and withdrawals already in flight. If a replacement account is opened, update legitimate services in a controlled order and keep the old account under review for the transition period the bank specifies.
Save the breach notice, bank case number, final statements from the old account, and the date the new account became active. Continue reviewing transactions and keep transfer alerts enabled. If the incident later produces a fraudulent loan, credit account, or other identity theft, add the FTC and credit-bureau recovery steps rather than assuming the bank replacement solved the wider problem.
- Call the bank through a known channel.
- Ask what specific transaction types are at risk.
- Map every recurring deposit and payment.
- Coordinate account-number replacement if recommended.
- Review old and new accounts during the transition.
Confirm the old account is truly retired
If the bank replaces the account number, ask when the old number stops accepting debits and credits and how returned or delayed transactions will be handled. Review the last statements from the old account even after the new one is working. Then remove obsolete payment instructions from apps and merchants that no longer need access. The transition is complete only when legitimate deposits and bills have moved successfully, the old account no longer shows unexpected activity, and your alerts are active on the replacement account.
Coordinate alerts and changes on joint accounts
If the account is jointly owned, tell the other owner what changed and confirm whose phone and email receive alerts. Joint access can create confusion during a replacement if one person updates a payment while the other still uses the old details. Keep one shared checklist of legitimate changes without storing passwords or full account numbers.
