To send bank information securely, put the details in an encrypted channel or a trackable physical envelope, and confirm the recipient’s identity through a separate line of contact before you transmit anything. Routing numbers, account numbers, and voided checks change hands routinely when you start a job, close on a home, or set up a vendor payment, but a single intercepted email can cost you a lot of money. The methods below cover what to send, how to send it, and what to do if something goes wrong.
What to Gather Before You Send Anything
Two numbers do most of the work. Your routing number is the nine-digit code that identifies your bank or credit union. Your account number is the unique identifier for your specific account at that institution. Both appear at the bottom of a physical check, with the routing number on the left, followed by the account number and the check number. You can also pull them from your bank’s mobile app or online banking portal, usually on an account details or settings page.
When the recipient asks for a voided check, prepare one by writing “VOID” in large letters across the face of the check while keeping the routing and account numbers at the bottom legible.
Check the name too. The name on your account should match the name the recipient has on file for you. If a payment goes out with a mismatched name and account number, the receiving bank can rely on the account number alone and send the funds to the wrong person.
What You Should Never Share
Legitimate recipients of bank information — employers, lenders, title companies — will not ask for your online banking password, your debit card PIN, or the answers to your security questions. Those credentials open your account directly and are not part of any standard payment setup. Treat any such request as a red flag and verify it independently before responding.
The Safest Digital Ways to Send Bank Details
Digital delivery is the norm, but it only works when the platform encrypts your data both in transit and at rest. The point is simple: even if someone intercepts the file, they cannot read it.
Secure Document Portals
Many banks, employers, and law firms run secure upload portals with a unique login and two-factor authentication. Before you upload, check that the site address begins with “https://” — the “s” means the connection is encrypted. Log in, then upload your prepared PDF or image of the voided check directly. A portal is generally the safest digital option because the recipient controls both ends of the transfer.
Password-Protected Files
If there is no portal, encrypt the file itself. Most PDF software lets you set a password that encrypts the document’s contents, often using AES-256, the same standard used for classified government data. Attach the protected file to an email, then send the password through a completely different channel, such as a phone call or a text message. A single intercepted email cannot then expose both the document and the key.
Encrypted Email Services
Some organizations use encrypted email that scrambles the message and attachments so only the intended recipient can read them. The recipient gets a notification with a link to a secure viewer and logs in to open the content. If your recipient offers this, it is a strong alternative to a portal.
Verify the Recipient Before You Send
Wire fraud and business email compromise target exactly the moment you share bank details. Attackers either break into a real email account or create a nearly identical one by swapping a single letter in the address, easy to overlook on a busy day. Real estate closings are a favorite target because multiple parties trade wiring instructions by email.
The single most important step is verifying wiring instructions through a separate channel before you send money or share account details. If bank details arrive by email, call the sender at a phone number you already have on file — not a number pulled from that same email — and confirm the routing number, account number, and recipient name out loud. This out-of-band verification makes it far harder for an attacker to intercept both channels at once.
A few more precautions go a long way:
- Read the sender’s email address carefully for subtle misspellings, especially when instructions change late in a transaction.
- Be skeptical of last-minute changes. A sudden request to send funds to a different account is a hallmark of this scam.
- Turn on two-factor authentication for your own email so attackers cannot use it to impersonate you.
If you already sent funds to a fraudulent account, contact your bank immediately and ask for a wire recall or reversal, then file a complaint at ic3.gov, the FBI’s Internet Crime Complaint Center. The FBI’s Recovery Asset Team works with financial institutions to freeze fraudulent accounts before the money is moved.
When Offline Delivery Fits Better
Physical delivery gives you a paper trail and works without relying on the recipient’s digital setup.
USPS Certified Mail
Certified Mail gives you a mailing receipt at the time of sending and electronic verification that the item was delivered or attempted. You complete PS Form 3800 at the post office. For stronger proof, add Return Receipt service using PS Form 3811, the “green card.” The recipient signs it on delivery and you receive it back as proof of the date, the signature, and the actual delivery address if it differs from the one on the envelope.
USPS Registered Mail
Registered Mail is the higher-security option. Every transfer of the mailpiece is logged by USPS, it sits in locked storage while in transit, and it must be sealed with tamper-evident packaging. It costs more than Certified Mail, but the continuous chain of custody suits highly sensitive financial documents.
In-Person Delivery
Handing documents directly to a verified HR officer, bank representative, or attorney is the most straightforward method. Ask for a stamped “received” copy or written acknowledgment on official letterhead, and keep it in your files as your record of what was delivered and when.
What Changes for International Transfers
A domestic routing number and account number are not enough to move money across borders. International transfers usually require a SWIFT code, also called a Business Identifier Code or BIC, an 8- or 11-digit code that identifies the recipient’s bank globally. Many countries also require an International Bank Account Number (IBAN), a standardized format of up to 30 characters that includes the country code, bank identifier, and account number.
Some countries use their own identifiers alongside or instead of an IBAN:
- Canada: a five-digit branch transit number and a three-digit financial institution number.
- Mexico: an 18-digit CLABE (Clave Bancaria Estandarizada).
- India: an 11-digit IFSC (Indian Financial System Code).
- Australia: a six-digit BSB (Bank State Branch) number.
- China: a 12- or 14-digit CNAPS code.
Most international wires also require you to state the purpose of the payment, such as rent, salary, or a purchase. Your bank can confirm exactly which identifiers apply to the destination country. Gathering them before you initiate the transfer avoids delays and failed transactions.
After You Send: Confirm and Monitor
Ask the receiving party for written confirmation that your information was received and entered into their system. Then watch for the first automated deposit or withdrawal. A clean first transaction tells you the setup is working.
Keep monitoring your bank statements for at least two full cycles. Look for any transaction you do not recognize, however small. Fraudsters sometimes test a stolen account number with a minor charge before trying a larger one.
Your Liability Limits Under Federal Law
If an unauthorized electronic transfer appears on your account, the Electronic Fund Transfer Act caps your liability, but the cap depends on how fast you report it:
- Within 2 business days of learning about the problem: liability is capped at $50.
- After 2 business days but within 60 days of the statement being sent: liability can rise to $500.
- After 60 days: you could be liable for the full amount of unauthorized transfers that occur after the 60-day window, with no cap.
The 60-day clock starts when your financial institution sends the statement on which the unauthorized transfer first appears, not when you open or read it.
If Your Bank Information Is Compromised
If your account details are exposed through a breach, a stolen document, or a phishing attack, move quickly. Call your bank’s fraud department and report the exposure. Ask about closing the compromised account and opening a new one with fresh numbers. If unauthorized transactions have already posted, request a reversal and file a formal dispute. Prompt reporting is what preserves the liability caps above.
Then protect your credit. Contact any one of the three major credit bureaus — Equifax, Experian, or TransUnion — and place a free fraud alert on your file. That bureau must notify the other two. A fraud alert lasts one year and requires businesses to verify your identity before opening new credit in your name. For stronger protection, place a free credit freeze with each bureau; a freeze blocks new creditors from accessing your report at all, and you can lift it temporarily when you need to apply for credit.
File a report at IdentityTheft.gov, the FTC’s identity theft portal, which generates a personalized recovery plan based on what was exposed. If a wire transfer or online scam was involved, also file at ic3.gov. Pull your free credit reports from AnnualCreditReport.com and review them for accounts or inquiries you do not recognize.