Giving your ACH information to a reputable employer, government agency, or established business is generally safe. Federal law caps what you can lose from unauthorized electronic withdrawals at as little as $50 when you report quickly, and your bank is legally required to investigate disputes on a tight timeline. The real question of whether it is safe to give ACH information turns less on the numbers themselves and more on who is receiving them: a verified counterparty is low risk, while an unfamiliar or unverified one can initiate withdrawals you never approved.
Why Your Routing and Account Number Aren’t Really Secrets
Your routing and account numbers appear at the bottom of every paper check you write. They are not confidential in the way a PIN or password is. The risk is not that someone sees these numbers but that someone uses them to pull money from your account without your authorization.
That distinction matters because it reframes the question. A company cannot legally debit your account through ACH without your authorization, and the ACH system has rules about how that authorization has to be captured — written signature for in-person recurring bills, a recorded verbal consent or confirmation letter for phone setups, and a digital authorization capturing your identity and the transaction terms for online payments. Sharing the numbers is not the same as consenting to a charge.
When It’s Safe and When It Isn’t
ACH credits, where money flows into your account, carry essentially no withdrawal risk. Payroll direct deposit, Social Security and other federal benefits, and tax refunds all use the same routing and account numbers, but funds are moving in, not out. These are the lowest-risk situations.
ACH debits, where a company pulls money from your account, deserve more care. The risk is not uniform. Giving your details to a utility company, a mortgage servicer, an insurer, or an established subscription service you have independently verified is routine and well protected. Giving the same details to an unfamiliar party you cannot verify is where problems start. Even with Regulation E on your side, disputing an unauthorized transaction costs time and attention you would rather not spend.
Red Flags Before You Share
Several patterns should make you stop before handing over account details:
- Unsolicited contact. A caller, emailer, or texter you did not initiate asks for your bank information. Legitimate companies do not cold-call to collect account numbers.
- Pressure to act immediately. Scammers create urgency by threatening account closure, legal action, or a missed deadline. The FTC flags high-pressure payment demands as a reliable warning sign.1FTC. How to Avoid a Scam
- Unverifiable companies. If you cannot independently confirm the company’s identity, address, and phone number, do not provide account details.
- Insistence on one payment method. A legitimate business typically offers several ways to pay. Someone who will only accept a direct bank transfer is a reason for caution.
- Overpayment schemes. A buyer or employer sends you a check, asks you to deposit it, and requests you send part of the money back via ACH. The original check bounces days later, leaving you responsible for the full amount.
When in doubt, slow down. Call the company back using a number you looked up yourself, not one provided by the person contacting you.
Your Legal Protection if Something Goes Wrong
The Electronic Fund Transfer Act and its implementing rule, Regulation E, set hard caps on your liability for unauthorized ACH withdrawals from a consumer account. How much you can lose depends on how fast you report.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Report within two business days: your loss is capped at the lesser of $50 or the total unauthorized amount.
- Report after two business days but within 60 days of your statement: your loss can rise to $500, but only for transfers the bank can show would not have happened had you reported sooner.
- Report after 60 days from your statement: you can be held responsible for the full amount of any unauthorized transfers that occur after the 60-day window closes and before you finally notify the bank.
The 60-day clock starts when your bank sends or makes the statement available, not when you open it. Reviewing statements promptly is one of the simplest ways to preserve these protections.
An “unauthorized electronic fund transfer” is one initiated by someone other than you, without your permission, from which you received no benefit. If you voluntarily give someone access — sharing login credentials with a friend, for example — transfers that person makes are not treated as unauthorized unless you have already told your bank to cut off their access.3Office of the Law Revision Counsel. 15 USC 1693a – Definitions The liability caps apply only to truly unauthorized activity.
How Your Bank Handles a Dispute
Once you report a suspected unauthorized ACH transfer, your bank must follow a federally mandated timeline.4CFPB. 12 CFR 1005.11 – Procedures for Resolving Errors
- Standard investigation: 10 business days to complete the review and report findings.
- Extended investigation with provisional credit: up to 45 days, but only if the bank credits your account provisionally within 10 business days so you have use of the disputed funds during the review.
- 90 days: the extended deadline for international transfers, point-of-sale debit card transactions, and transactions on accounts within 30 days of the first deposit.
When the bank finds that an error occurred, it must correct it within one business day and notify you of the results within three business days. If it concludes no error occurred, it must explain its findings in writing, return any provisional credit, and provide the documents it relied on if you ask. New accounts get a longer initial window of 20 business days rather than 10 for transfers in the first 30 days after your first deposit.
Stopping Recurring ACH Payments
If you have authorized a company to pull recurring ACH debits — a gym membership, a subscription, a loan payment — you have the right to stop those payments at any time. Notify your bank at least three business days before the next scheduled withdrawal, by phone or in writing.5eCFR. 12 CFR 1005.10 – Preauthorized Transfers
If you call, your bank may require written confirmation within 14 days. The bank has to tell you about that requirement and give you the address when you call. If you miss the 14-day window, the oral stop-payment order expires and subsequent withdrawals may go through.6Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Stop-payment fees commonly run from $15 to $36, sometimes less if you file the request online. Contact the company directly to revoke the authorization as well; doing both reduces the chance of a disputed charge later.
What to Do After an Unauthorized Transfer
Speed matters. If you see an ACH withdrawal you did not authorize:
- Contact your bank immediately. Call the number on your debit card or your bank’s website. Reporting within two business days keeps your maximum liability at $50.
- Follow up in writing. Even if the bank accepts an oral report, send a written notice confirming the date, amount, and reason you believe the transfer was unauthorized. This protects you if a dispute later arises about when you reported.
- Keep watching the account. Report each additional unauthorized transfer you spot separately as the investigation continues.
- File a complaint with the CFPB if your bank misses the required timelines or refuses to issue a provisional credit.
If the unauthorized transfer appeared on your statement but you still have your card and PIN, you must notify your bank within 60 days of the statement date, or you could be responsible for the full amount of any transfers that occur after that window closes.7CFPB. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account Unusual circumstances such as extended hospitalization or lengthy travel may extend the deadlines.
Why ACH Is Safer Than a Wire Transfer
ACH and wire transfers both move money electronically between banks, but their safety profiles differ.
- Reversibility. ACH transfers can be reversed if you report an error or unauthorized transaction promptly. Wire transfers are generally irrevocable; once the funds leave your account, recovering them is difficult or impossible.
- Consumer protections. ACH transfers to and from consumer accounts fall under Regulation E, with the liability caps and investigation requirements above. Consumer-initiated wire transfers do not have the same federal protections.
- Fraud window. ACH batches process over hours or a business day, which gives fraud detection time to work. Wires settle in near-real time, which is why many fraud schemes prefer them.
If someone asks you to wire money rather than pay through ACH, consider why. Wires are appropriate for time-sensitive, high-value transactions such as real estate closings. For routine payments, ACH is both cheaper and better protected.
Business Accounts Don’t Get the Same Protections
The liability caps and investigation timelines in this article apply to consumer accounts. If you share ACH information from a business account, the rules are different and significantly less protective.
Business ACH transactions are generally governed by UCC Article 4A, which excludes transfers already covered by the Electronic Fund Transfer Act.8Legal Information Institute. UCC Article 4A – Funds Transfer Under Article 4A, a business must report an unauthorized payment order within a reasonable time, not exceeding 90 days after the bank notified it of the transaction. There are no $50 or $500 caps; loss allocation depends on whether the bank used commercially reasonable security procedures and whether the business followed them. Many business account agreements impose even shorter reporting deadlines. If you run a business, read your account agreement carefully and consider adding ACH debit blocks or filters that restrict which companies can pull from your account.