Is a Bank Account Number Sensitive Information?

Yes, a bank account number is sensitive information. Federal law places it in a protected category alongside Social Security numbers, health records, and biometric data, and it gets that treatment for a practical reason: someone who knows your account and routing numbers can pull money out without ever touching your password, PIN, or two-factor code. That vulnerability is why the Gramm-Leach-Bliley Act restricts how banks share these numbers and why the Electronic Fund Transfer Act limits what you can lose when they’re misused.¹

Why Your Account Number Counts as Sensitive

An email address identifies you. A bank account number lets someone move your money. That’s the line federal regulations draw when they classify “personal financial data” as sensitive rather than ordinary identifying information.¹

The most common way stolen account numbers get used is an unauthorized ACH debit. The Automated Clearing House network was built around trusted participants, so someone who has your account and routing numbers can submit a debit request that pulls funds directly from your account. Fraudsters obtain these numbers through data breaches, phishing, intercepted mail, and discarded deposit slips. By the time you notice, the receiving account may already be closed.

Counterfeit checks are the other major threat. Modern printing makes convincing fakes easy to produce from stolen account information, and the FDIC has warned that these forgeries can fool even bank employees.² A criminal prints checks bearing your numbers, cashes them elsewhere, and your bank debits your account before the fraud is caught.

Neither attack needs your login credentials. The account and routing numbers alone are enough.

How Federal Law Protects the Number

The Gramm-Leach-Bliley Act classifies bank account numbers as “nonpublic personal information,” which covers any personally identifiable financial data you give a financial institution or that comes out of a transaction with one.³ That classification triggers three protections.

Your bank has to send you privacy notices explaining what it collects, who it shares data with, and how it safeguards that data. Notices go out when you open an account and at least once a year afterward.³ The law also flatly prohibits financial institutions from handing your account number to unrelated companies for marketing. No telemarketing, no direct mail, no promotional emails built on your account data. And every federal regulator that oversees financial institutions must set security standards covering administrative, technical, and physical safeguards for customer records.

For non-bank financial companies like mortgage brokers, payday lenders, auto dealers arranging financing, and tax preparers, the FTC enforces these obligations through the Safeguards Rule. That rule requires a written security program, a designated security officer, risk assessments, employee training, and encryption of all customer data both in storage and in transmission.⁴ Password protection alone doesn’t satisfy the rule; the data itself has to be unreadable.

All 50 states also have data breach notification laws. If a business suffers a breach involving your bank account number, it has to tell you. About 20 states set fixed deadlines between 30 and 60 days, and the rest require notification without unreasonable delay.

What You Can Lose If Your Account Number Is Misused

Federal law caps what you can lose to unauthorized electronic transfers, but only if you report quickly. The Electronic Fund Transfer Act sets liability in tiers.⁵

Report within 2 business days of learning your account was compromised, and your maximum liability is $50.
Report after 2 business days but within 60 days of receiving a statement showing the unauthorized transfer, and liability caps at $500.
Miss the 60-day window, and you face unlimited liability for transfers that occurred after the deadline, as long as the bank can show those transfers would not have happened if you had reported sooner.

The 60-day rule is where most people get hurt. A $200 unauthorized debit buried on your March statement that you don’t catch until June means the bank has no obligation to cover later fraud that an earlier report would have prevented.⁶ Extenuating circumstances like hospitalization or extended travel can extend the deadline, but you’ll need to show why the delay was reasonable.

When you do report on time, the bank has to investigate within 10 business days. If the investigation runs longer, the bank must provisionally credit your account with the disputed amount and give you full access to those funds while it keeps investigating for up to 45 days.⁷ The bank may hold back up to $50 of that provisional credit if it reasonably believes an unauthorized transfer occurred and you had some role in the exposure.

What to Do If Your Account Number Is Exposed

If you learn your account number was compromised through a breach, a scam, or lost documents, move fast. The two-business-day window starts when you learn of the problem, not when the fraud actually happens.

Call your bank immediately and ask to close the compromised account and open a new one. Use the number on your bank statement or debit card, not a number from any email or text. Scammers routinely impersonate banks right after a breach.⁸
Review recent transactions and report anything you don’t recognize to your bank’s fraud department.⁸
Update automatic payments. Recurring bills, direct deposits, and subscriptions tied to the old account will need your new details. Miss this step and you’ll get bounced payments and late fees weeks after the initial compromise.
File a report at IdentityTheft.gov if someone has already used your information. The site generates a personalized recovery plan with step-by-step instructions.⁸
Monitor your credit reports. A stolen bank account number doesn’t directly affect your credit score, but criminals who have one piece of your financial data often have others. A fraud alert or credit freeze adds another layer.

Sharing Your Number When You Have To

Sensitive doesn’t mean secret. Several routine activities require you to hand over your account and routing numbers, and knowing which situations are normal helps you spot the ones that aren’t.

Direct deposit is the most common example. Your employer needs both numbers to route your paycheck, usually through a voided check or a deposit authorization form. The IRS uses the same information to send tax refunds directly to your account and encourages taxpayers to choose direct deposit as the fastest refund method.⁹ Those deposits move through the ACH network via the Bureau of the Fiscal Service.¹⁰ Recurring bills for utilities, insurance, and subscriptions often pull funds the same way. Linking a new investment account, transferring money between banks, or connecting a payment app all involve the same exchange.

Here’s the reality worth sitting with: every paper check you write already displays your account and routing numbers in plain text at the bottom, and the routing number by itself is public information for every bank in the country. The risk isn’t in sharing the number when the situation calls for it. The risk is in not tracking how exposed the number already is, how quickly a compromise can turn into a withdrawal, and how tight the reporting windows are once something goes wrong.

1
eCFR. 28 CFR 202.249 – Sensitive Personal Data
2
FDIC. Beware of Fake Checks
3
Office of the Law Revision Counsel. 15 USC Ch. 94 – Privacy
4
eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
5
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
6
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
7
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
8
IdentityTheft.gov. When Information Is Lost or Exposed
9
Internal Revenue Service. Direct Deposit Is the Best Way to Get a Federal Tax Refund
10
Bureau of the Fiscal Service. Direct Deposit (Electronic Funds Transfer) Tax Refund Frequently Asked Questions