Giving someone your routing and account number is generally safe, and you do it all the time without thinking about it: every paper check you write prints both numbers on the bottom, and every direct deposit setup, tax refund, and automatic bill payment relies on them. The numbers are identifiers, not passwords. The real question is who’s asking, why, and what to do in the rare case someone misuses them.
What Someone Can and Cannot Do With Just These Numbers
Your routing number is a nine-digit code that identifies your bank. Your account number identifies your specific account at that bank. Together they work like a mailing address for money. They do not unlock your online banking, your balance, or your transaction history. Those sit behind a username, password, and usually a second authentication step.
Having these numbers alone, a bad actor has a limited menu of options. The main one is initiating an unauthorized ACH debit, essentially instructing their bank to pull money from your account. Some online retailers accept bank-account payments using only the routing and account number, so a fraudster could attempt purchases. And someone with your numbers can create a remotely created check, a document that looks like a check but uses your printed name instead of your actual signature. The bank that processes such a check warrants that you authorized it, and the paying bank can demand repayment from the depositing bank if no authorization existed.1eCFR. 12 CFR 229.34 – Warranties and Indemnities
Wire transfers are a different matter. Someone cannot initiate a wire with just your routing and account number; wires require additional authentication through your bank, and consumer wire transfers are explicitly excluded from the electronic fund transfer rules that cover ACH.2Consumer Financial Protection Bureau. 12 CFR 1005.3 Coverage The realistic fraud risk from shared numbers is ACH debits, online purchases at merchants that accept bank-account payment, and remotely created checks.
When It’s Routine to Share Them
Plenty of normal transactions require both numbers. Employers need them to deposit your paycheck. The IRS uses them to send refunds or pull estimated tax payments. Utility companies, insurers, mortgage servicers, and lenders use them to set up recurring payments through the ACH network.
Financial apps and investment platforms also ask for these numbers when you link a bank account. To confirm you actually own the account, a platform will often make two tiny deposits (usually under a dollar each) and ask you to verify the amounts. That micro-deposit process is a standard ownership check, not a warning sign. If a company asks for your routing and account number for a purpose you initiated and understand, the request is following the same infrastructure that moves trillions of dollars through the banking system every day.
How to Share Them Safely
The risk isn’t really in the numbers; it’s in how and to whom you hand them over. A few habits make a meaningful difference:
- Verify the requester independently. If someone calls claiming to be your bank’s fraud department and asks for your account number, hang up and call the number on the back of your debit card. Legitimate fraud teams won’t pressure you to stay on the line, and they won’t ask you to read back your full account number and a one-time code “for verification.” That script is backward: it uses your information rather than protecting it.
- Check for encryption. Any website asking for bank details should use “https” in the address bar. If you don’t see the padlock, don’t enter anything.
- Ignore unsolicited requests. Government agencies, utilities, and banks don’t ask for account numbers through text messages, pop-ups, or unexpected emails. Treat any such request as a scam until you’ve confirmed otherwise through a channel you chose.
- Push, don’t pull, when you can. Instead of giving your account number to a company so it can debit you, use your bank’s online bill-pay feature to send payment to the company. The company never sees your account details that way.
- Send the numbers through a channel the recipient controls. A payroll portal, a lender’s secure document upload, or your bank’s internal transfer tool is safer than email or text.
What Protects You If Something Goes Wrong
The Electronic Fund Transfer Act and its implementing rule, Regulation E, give you the right to dispute unauthorized electronic transfers from a personal account. The widely repeated $50 and $500 liability caps apply when an “access device” like a debit card or PIN is lost or stolen.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Your routing and account number by themselves are not an access device under the regulation.4Consumer Financial Protection Bureau. 12 CFR 1005.2 Definitions When someone uses only your account information to pull an unauthorized ACH debit, your liability is generally zero as long as you report it within 60 days of the bank statement that first shows the transfer.
The scenario that hurts people is inaction. If you don’t review your statements and miss the 60-day window, you can face unlimited liability for unauthorized transfers that occur after that deadline.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers After you notify the bank, it has 10 business days to investigate; if it needs the full 45 calendar days allowed, it must provisionally credit your account during the review so you aren’t left short.5Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors
Stopping a Recurring Debit You No Longer Want
If you previously authorized a company to debit your account on a recurring basis and want it to stop, you can revoke that authorization by notifying your bank at least three business days before the next scheduled transfer. The bank must honor the stop-payment order even if the company resubmits the debit.6Federal Reserve. Electronic Fund Transfer Act – Regulation E Supplement Manual and Examination Procedures
You can give the order by phone, but the bank may require you to follow up in writing within 14 days. If it does and you don’t, the phone request lapses. Most banks charge a stop-payment fee, often in the $15 to $35 range, though some waive it for premium accounts or online requests. Notify the company directly too, so it stops attempting the debit.
Business Accounts Don’t Get the Same Protections
Everything above applies to personal bank accounts. Regulation E defines a protected account as one established primarily for personal, family, or household purposes, and a consumer as a natural person.7eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Business accounts fall outside those definitions, so the dispute rights, investigation timelines, and liability caps described above generally don’t apply. Business account holders rely on their commercial account agreement and the Uniform Commercial Code, which typically put more responsibility on the account holder to detect fraud quickly. If your business shares account details with vendors or payroll providers, ask your bank about an ACH debit block or filter that restricts which companies can pull funds.
If Your Account Information Is Misused
If you believe someone has your routing and account number and is using them fraudulently, move fast. The federal protections above are generous, but each has a time limit that shrinks the longer you wait.
- Contact your bank immediately. Report the unauthorized activity, ask the bank to freeze or close the compromised account and open a new one, and request a recall or reversal of any fraudulent transfers.8Internet Crime Complaint Center (IC3). Account Takeover Fraud (ATO)
- Update every linked service. Any employer, biller, or app with your old numbers needs the new ones. Skipping this step means your next paycheck or refund could bounce into a closed account.
- File an identity theft report at IdentityTheft.gov. The site generates a formal FTC identity theft report and a personalized recovery plan. For wire transfer schemes or online fraud, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.
- Review statements weekly for at least the next 60 days. That window is your deadline to dispute any further unauthorized transfers without risking unlimited liability.
- Consider placing a fraud alert on your credit reports. It costs nothing and requires creditors to take extra verification steps before opening new accounts in your name.