I had recently given someone my account number and routing number to deposit money into my checking account. They owed me money I had lent and said this would be the easiest way for them to do it. I had recently asked if they followed through and they blocked my phone number. I have a bad feeling they're trying to do more than deposit money. They don't know where I live, my real name nor do they have my card number. Is there anything they can really do with just my account and routing number? Should I get a new account? Will I be fine?
In theory they can, just like companies can directly take money (called Direct Debit here in the UK) from your account using those values.
However to be able to do direct debits you'd need an established business account with a major bank which won't do any good for a fraudster as it's pretty much impossible to open one anonymously.
Finally all transactions are logged and banks can reverse them if there is suspicion of fraud, so there's no need to worry. Account and routing numbers are fairly low entropy so if this was a good fraud opportunity we would already have crooks bruteforcing those numbers.
Disclaimer: I an not a lawyer...
Technically they can. More exactly, they can ask your bank to transfer money from your account to theirs, since they have enough information to uniquely identify both accounts.
The real question then is whether the bank will accept. From a legal point of view, as you did not explicetly allow the operation the bank should reject it. In a real world, banks do not always control everything, and some could simply accept the transfer. But as you did not allow it, they must refund your account if you ask for it - this may depend on local laws but at least in France it is clear: when a bank has validated a transfer that was not explictely allowed by the account owner, either with a signed order or with a numerically authentified operation, the bank is in fault and must refund the account if the owner asks for it. If the owner contests an operation, the bank must prove that it has been regularly approved - but if you contest an operation that you did allow, the bank can charge you with the research costs.
Do you know this person? It's hard to tell if you have been victimized by a professional con artist or if this is just a bad friend/family member/acquaintance? Do you know where this person lives?
I had an experience over a decade ago where I paid with a check and the cashier typed my account and routing number into a credit card machine and the bank processed it. Then when I got the statement, they had also deposited the paper check. It was a simple error on the part of the store and I worked it out with them.
What was really disconcerting to me was that when I called the bank and asked why they would process the same check number, for the same amount twice for the same retailer, the service rep got snippy with me and said that they didn't know whether it was my mistake or the retailers and said I needed to talk to the retailer.
To bring this back to your question, that experience makes me believe that this is probably easier to do than most people think. Yes, an account would be needed with the bank but if it's a sophisticated operation, they may have gotten control over one the bank trusts. Whether you should worry depends on a lot of things one being the country you live in. If this is a personal account in the US under 100K, you are insured by the FDIC. It might take a while to sort out if they drain your account and you probably have bills to pay so it will at least be a major annoyance. If this is a business account, the bank is under no obligation to refund your money and there is no federal insurance. If you are in this situation you should get an account with 2-factor security.
Regardless of what kind of account it is, you should watch it like a hawk and if there are any odd transactions, contact the bank immediately. I would also call the bank and tell them of your concerns. Ask them to not allow any transfers without your explicit authorization. If they say they can't, you might want to look for a new bank.