How to Send ACH Information Securely: Encryption and Verification

To send ACH information securely, put your routing and account numbers into an encrypted file, verify the recipient through a channel other than the one that asked for them, and deliver the file through a secure portal or password-protected attachment rather than a plain email. The ACH network moved roughly 35.2 billion payments worth $93 trillion in 2025, and fraudsters increasingly target the moment when account details first change hands.1Nacha. ACH Network Volume and Value Statistics The steps below walk through exactly how to share your details without exposing yourself to unauthorized withdrawals or identity theft.

What the Recipient Actually Needs

Every ACH transaction requires four pieces of data: the name of your financial institution, its nine-digit routing number, your account number, and your account type (checking or savings). The routing number, formally the ABA routing transit number, identifies which bank receives the funds and is assigned only to institutions eligible for a Federal Reserve master account.2American Bankers Association. ABA Routing Number Your account number identifies your specific account within that bank.

Both numbers appear at the bottom of a paper check, routing first and account second. If you don’t have checks on hand, your online or mobile banking portal shows the numbers in the account details section, and many banks generate a prefilled direct deposit form you can download after logging in.3Nacha. Direct Deposit Without a Voided Check? Absolutely! You can also call your bank and ask for them after identity verification.

Before you send anything, ask what the other party plans to do with the information. In an ACH credit (a paycheck direct deposit, for example) the sender pushes money into your account. In an ACH debit (an autopay for a bill or subscription) the other party pulls money out. Giving your details for a credit means someone can deposit funds you weren’t expecting. Giving your details for a debit means you are authorizing withdrawals, which is inherently riskier. Federal law requires any preauthorized recurring debit from a consumer account to be authorized in writing or through an equivalent electronic signature, and the company must give you a copy of that authorization.4eCFR. 12 CFR 1005.10 – Preauthorized Transfers A verbal-only debit setup is a red flag.

Encrypt the Data Before You Send It

Never put your routing and account numbers in the body of a plain-text email or an unprotected attachment. Emails pass through multiple servers on the way to the recipient, and any one of them can be a point of interception. The goal is to make the data unreadable to anyone but the person you intended to reach.

Password-Protected PDF

The simplest method is to place your account details in a PDF and apply password protection using AES encryption. Adobe Acrobat and free alternatives both offer this under the Security or Protect menu before saving. Send the file through one channel, such as email, and share the password through a completely different channel, such as a phone call or text. Someone who intercepts the email still cannot open the file.

Secure Portals and SFTP

Many employers, banks, and vendors offer client portals or Secure File Transfer Protocol connections built for sensitive data. These platforms encrypt information at rest and in transit. You typically receive an invitation link to create an account with multi-factor authentication, and you upload the document directly inside the portal. No email attachment is involved.

End-to-End Encrypted Email

End-to-end encrypted email services such as ProtonMail or Tutanota keep messages unreadable on every server between you and the recipient, because only the two of you hold the decryption keys. This works when both sides use a compatible service. Standard Gmail and Outlook accounts do not provide end-to-end encryption by default, so a routine attachment on a regular email is not a secure delivery method.

NACHA’s data security rules require large payment originators and third-party processors handling more than two million ACH entries per year to render stored account numbers unreadable through encryption, truncation, or tokenization. Passwords alone do not satisfy the rule.5Nacha. Supplementing Data Security Requirements That standard applies to processors rather than to you as an individual, but it is the baseline you should expect from any company asking for your banking information.

Verify the Recipient Before You Hit Send

Encryption does nothing if the file lands in the wrong hands. Business Email Compromise schemes, in which a fraudster impersonates a vendor, employer, or business partner to redirect payments, are one of the most common ways ACH information gets stolen.

Confirm Through a Separate Channel

If someone emails you a request for ACH information, do not reply to that email with your data. Call the person or company at a phone number you already have on file, not one supplied in the email itself. For an employer or vendor request, confirm the details through your accounts payable department or HR portal. This out-of-band check is the single most effective step against impersonation fraud.

Red Flags in the Request Itself

A 2016 FinCEN advisory developed with the FBI and U.S. Secret Service identified warning signs that an emailed payment request may be fraudulent:6FinCEN. FinCEN Advisory – FIN-2016-A003

  • A sender address that closely resembles a known contact’s but has a character added, changed, or deleted (for example, john_doe@abc.com in place of john-doe@abc.com).
  • A request that names a familiar recipient but directs payment to bank account information different from what you’ve used before.
  • Messages marked “Urgent,” “Secret,” or “Confidential,” or that pressure you to act before you can verify.
  • A payment to a beneficiary you have no prior history with, in an amount similar to what you normally pay a known vendor.
  • Instructions attributed to an executive or attorney that no one in the organization can independently confirm.

Wire fraud carries up to 20 years in federal prison, or up to 30 years if the scheme affects a financial institution.7Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television

If You’re the One Receiving the Information

When you’re on the collecting side, ask for a voided check, a bank verification letter, or a screenshot from the account holder’s online banking portal showing the routing and account numbers. The point is that the data comes directly from the account holder’s bank rather than from an unverified email address.

Send, Then Confirm

Once the file is encrypted and the recipient is verified, upload it to the portal or attach it to the secure email. Read the recipient address character by character before sending. A single typo can route your banking information to a stranger’s inbox.

After sending, contact the recipient through a separate channel to confirm they received the file and were able to open it. That closes the loop on delivery.

Micro-Deposits and Instant Verification

Many companies verify your account by sending micro-deposits, small credits of less than $1 each, and asking you to report the exact amounts back to them.8Nacha. Nacha Micro-Entry Rule These deposits may take up to five business days to appear, so check your statements during that window. NACHA rules require that micro-entry credits equal or exceed any offsetting debits and settle at the same time, so you should never see a net withdrawal during the process.

Instant account verification services are replacing micro-deposits at many providers. You log in to your bank through a secure API connection and the service confirms your routing and account numbers in seconds. If it’s offered, it is faster and involves less back-and-forth than test deposits. NACHA requires organizations that initiate online consumer debits to validate first-use account information before processing the payment, through micro-entries, a prenotification transaction, or a commercial validation service.9Nacha. Account Validation Resource Center

Know Your Liability Window

Even with precautions, unauthorized transactions can happen. How fast you catch and report one determines how much of the loss is yours.

For personal bank accounts, Regulation E caps your liability for unauthorized electronic transfers on a tiered schedule based on how quickly you report:10Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.6 Liability of Consumer for Unauthorized Transfers

  • Reported within 2 business days of learning of the unauthorized transfer: liability is capped at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
  • Reported after 2 business days but within 60 days of receiving your statement: liability can rise to $500.
  • Reported after 60 days: you may face unlimited liability for unauthorized transfers that occur after the 60-day window closes and before you notify the bank.

For unauthorized ACH debits that don’t involve a lost or stolen debit card or access device, the $50 and $500 tiers don’t apply. Report within 60 days of receiving the statement and you have zero liability. Miss that window and you can be responsible for any unauthorized transfers that happen afterward.10Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.6 Liability of Consumer for Unauthorized Transfers Regular statement monitoring is what preserves the protection.

To dispute an unauthorized transfer, notify your bank within 60 days of the date on the statement showing the error. The bank has 10 business days to investigate, or 20 business days for new accounts, and must provisionally credit your account if the investigation takes longer.11Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.11 Procedures for Resolving Errors

One boundary worth noting: Regulation E does not cover business accounts. Commercial fund transfers are governed by Uniform Commercial Code Article 4A, which gives banks and businesses more flexibility to allocate risk by contract.12Legal Information Institute. UCC – Article 4A – Funds Transfer (1989) Under Article 4A you generally have up to 90 days from notice of the transaction to report an unauthorized payment order, but the specifics depend on the security procedures your bank has in place and whether you agreed to follow them. If you’re sending ACH details for a business account, read the commercial account agreement.

If Your ACH Information Is Compromised

If you think your routing and account numbers have reached an unauthorized party, act fast. Time is the biggest factor in what you’re on the hook for.

  • Call your bank and ask about placing a block on ACH debits or closing the account and opening a new one.
  • Place a free fraud alert with any one of the three major credit bureaus (Equifax, Experian, or TransUnion). The alert lasts one year and requires creditors to take extra steps to verify your identity before opening new accounts.13Federal Trade Commission. Data Breach Response: A Guide for Business
  • Consider a free credit freeze, which prevents potential creditors from accessing your credit report at all.
  • Review your bank statements daily for at least 60 days. Reporting inside that window is what preserves your full rights under Regulation E.10Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.6 Liability of Consumer for Unauthorized Transfers
  • File a report at IdentityTheft.gov to get a personalized recovery plan. If funds were stolen, file with your local police department as well.

Financial institutions are required under the Gramm-Leach-Bliley Act to maintain safeguards that protect the security and confidentiality of your information.14eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information If a company that collected your ACH data failed to protect it, that failure can factor into any dispute over who bears the loss.