Is It Safe to Give My Account and Routing Number?

Giving out your bank account and routing number is generally safe when the recipient is someone you can verify — an employer, a government agency, or an established company — and you’re sending the information through a channel you control, like a signed form or a secure portal. Those two numbers already appear on the bottom of every personal check you’ve ever written, so they were never truly secret. And if something does go wrong, federal law caps your liability for unauthorized electronic transfers at $50 as long as you report the problem within 60 days of your statement. The real risk isn’t the numbers themselves. It’s who you give them to and how.

Your Account and Routing Numbers Aren’t Really Secrets

The routing number is a nine-digit code that identifies your bank, not you. It’s searchable in a public database maintained by the American Bankers Association.¹ Your account number is more sensitive because it points to your specific account, but it’s printed in plain text on every check you write. Every landlord, contractor, or business you’ve paid by check already has both numbers on file.

That context matters. Treating these numbers like a Social Security number or a debit card PIN gets the risk wrong. They’re identifiers for where money moves, not credentials that unlock spending.

When You’re Expected to Share Them

Modern financial life runs on these numbers. Refusing to give them out would mean opting out of most of it.

Direct deposit for your paycheck. About 93% of American workers are paid this way.
Tax refunds from the IRS. Eight in ten taxpayers choose direct deposit, and the IRS issues more than nine in ten refunds within 21 days when direct deposit is paired with e-filing.²
Autopay for utilities, insurance, and subscriptions, which pull funds through the ACH network each cycle.
Peer-to-peer apps like Zelle and Venmo when you link a bank account. These transfers are covered by the same federal protections as other electronic fund transfers.³

What all of these have in common: you initiated the exchange, you know who’s on the other side, and the numbers travel through a secure form or portal.

What Someone Can Actually Do With Just These Numbers

A thief holding only your account and routing numbers cannot log into your online banking, use an ATM, or swipe at a checkout. Those require a card, a PIN, or your login credentials.

What a thief can do is initiate ACH debits against your account, essentially asking the banking system to pull money as if you’d authorized a payment. The ACH network processes billions of transactions and relies partly on the honor system for authorization, which is why this type of fraud exists. Someone can also print counterfeit checks using your numbers, and those checks can clear at retail before you notice. In rarer cases, stolen numbers get used to open fraudulent accounts or reroute legitimate payments.

The upside is that ACH fraud is far easier to reverse than a cash withdrawal. The banking system has error-resolution procedures built for exactly this situation, and the law puts most of the burden on your bank rather than on you.

How to Spot a Fraudulent Request

The difference between a real request and a scam almost always comes down to who started the conversation and how the numbers travel.

A legitimate request comes through a channel you control: your employer’s HR portal, an IRS filing, a utility company’s website, a signed paper form. You have time to review it. Nothing about it feels rushed.

A fraudulent request usually arrives uninvited. A text says your account is frozen. An email that looks close to your utility company’s asks you to “verify” your banking details through a link. A caller insists they need your account number in the next few minutes to release a refund or stop a penalty. The tells are consistent:

Manufactured urgency. Real businesses and agencies don’t demand banking information on the spot.
Unsecured channels. Text messages, social media DMs, and plain email are not how legitimate companies collect banking details.
No paper trail. If nothing is being signed and no confirmation is being generated, treat it as a red flag.
Odd payment context. A buyer on an online marketplace asking for your account and routing numbers to “send payment” is not planning to send anything. Legitimate buyers use the platform.

When in doubt, hang up and call the company back using the number on its official website or on your statement. Don’t reuse a number the suspicious message gave you.

Federal Law Limits What You Can Lose

The Electronic Fund Transfer Act, at 15 U.S.C. § 1693, and its implementing rules under Regulation E give consumers a strong safety net for unauthorized electronic transfers.⁴ For the specific situation this article addresses — someone using your account and routing numbers without also stealing a card or access device — the protection is at its strongest.

If an unauthorized ACH debit or forged check hits your account and no debit card or other access device was lost or stolen, your liability is capped at $50, provided you report the transfer within 60 days of the bank sending the statement that shows it.⁵ In practice, many banks absorb the $50 to keep customers.

Miss that 60-day window, though, and the protection erodes. If you fail to report unauthorized transfers within 60 days of the statement, you can be held liable for any additional unauthorized transfers the bank can show timely notice would have prevented, with no dollar cap.⁶ Reviewing your statements every month is the single most important thing you can do to keep the legal protections working.

Extenuating circumstances such as hospitalization or extended travel can extend these deadlines to a reasonable period.⁵

What Your Bank Has to Do After You Report

Once you notify your bank, federal regulations put the clock on the bank, not you. It has 10 business days to investigate and decide whether an error occurred, then three business days after the investigation to tell you the result. If it confirms an error, it must correct the account within one business day.⁷

The bank can take up to 45 days to finish investigating, but only if it provisionally credits your account within 10 business days of receiving your notice, so you have access to the disputed funds while the review continues. The bank may withhold up to $50 from that provisional credit if it reasonably believes an unauthorized transfer occurred and has met the identification requirements in the rule.⁷

If your bank stalls or denies a claim you believe is legitimate, you can file a complaint with the Consumer Financial Protection Bureau, which supervises Regulation E compliance.⁸

Business Accounts Don’t Get the Same Protection

Everything above applies to personal accounts. Regulation E defines a covered account as one established primarily for personal, family, or household purposes, and a consumer as a natural person.⁹ Business accounts fall outside that definition.

Unauthorized transfers from business accounts are governed instead by UCC Article 4A, which puts more responsibility on the account holder to maintain adequate security procedures.¹⁰ There is no $50 cap, no mandatory provisional credit, and no CFPB complaint process. If you own a business, share business account numbers more sparingly than you would personal ones.

If Your Numbers Are Compromised, Move Fast

Every liability protection above turns on how quickly you report. If you spot an unauthorized transaction or think your account information has been stolen, work through this list in order.

Call your bank right away. A phone call is valid notice under Regulation E and is the fastest way to start the clock on the bank’s investigation duties. Ask about stopping payment on any pending ACH debits.⁶
Report even small charges. Thieves often run a tiny test debit first to see if it clears before pulling a larger amount.¹¹
Put it in writing. If your bank asks for written confirmation, send a letter describing the unauthorized charges within 10 business days of your call and keep a copy.¹¹
Ask for a new account number. A compromised account number is harder to shut down than a stolen card because it may be tied to your direct deposit, autopay, and tax filings. Expect to update every service linked to the old one.
Change your online banking password and PIN, even if you think only the numbers were exposed.
Watch your statements closely for the next few months. The 60-day reporting window runs from the date each statement is sent, so staying alert through the next full cycle keeps your liability position intact.

Sharing your account and routing numbers with a verified employer, the IRS, or an established company through a secure channel is a routine part of financial life, and the legal system is built around that reality. The numbers on the bottom of your checks aren’t a vault combination. What actually determines whether you lose money is who you gave them to, how you gave them, and how quickly you catch it when something goes wrong.

1
American Bankers Association. ABA Routing Number: Find Your Number, and Search Database
2
Internal Revenue Service. Get Your Refund Faster: Tell IRS to Direct Deposit Your Refund to One, Two, or Three Accounts
3
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
4
Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose
5
GovInfo. 15 USC 1693g – Consumer Liability
6
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
7
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
8
Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
9
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
10
Legal Information Institute. UCC Article 4A – Funds Transfer (2012)
11
Consumer Financial Protection Bureau. Report Suspicious Charges if Account Data Is Hacked