Putting bank details on an invoice is safe enough that millions of businesses do it every day, and no federal law prohibits it. The numbers themselves are not the vulnerability. The vulnerability is what happens to the invoice between your outbox and your client’s accounts payable inbox, and the fact that if something goes wrong, a business checking account does not get the same fraud reimbursement a personal one does. Whether it is safe for you comes down to how you deliver the document and what controls you have set at your bank.
Your account and routing numbers already appear on every paper check you write, so the information is not secret in the way a password is. For a domestic ACH transfer or wire, a client needs four things: the account holder’s name as it appears on the account, the bank’s name, the nine-digit routing number, and the account number.1Consumer Financial Protection Bureau. What Is an ACH Transaction? International payments add a SWIFT/BIC code and often an IBAN of 22 to 34 characters.2U.S. Bank. Crack the Swift Code for Sending International Wires Those are the only banking fields that belong on the invoice. One boundary worth stating up front: never put your Social Security number on an invoice. Use your Employer Identification Number as the tax identifier on business documents. Bank details plus an SSN or date of birth is the combination that lets a criminal open credit lines and file fraudulent tax returns in your name.3Social Security Administration. Identity Theft and Your Social Security Number
The Two Real Threats You Are Guarding Against
The first and by far the largest is business email compromise. A fraudster intercepts or spoofs the email carrying your invoice, swaps the payment details for their own, and forwards it along. The client pays in good faith, the money lands in a criminal account, and by the time anyone notices, the funds are gone. The FBI’s Internet Crime Complaint Center logged $2.77 billion in BEC losses in 2024 alone, and that figure only counts reports it received.4FBI. 2024 IC3 Annual Report This is where the overwhelming majority of invoice-related loss actually comes from, not from someone independently discovering your account number.
The second threat is an unauthorized ACH debit. Someone with your routing and account number cannot log into your bank or reset a password with them, but they can attempt to pull money out of your account by submitting a debit and claiming you authorized it. Doing so is bank fraud under 18 USC 1344, punishable by up to 30 years and a fine up to $1,000,000.5Office of the Law Revision Counsel. 18 USC 1344 Bank Fraud The prison time does not help you get your money back.
Business Accounts Do Not Get Consumer Fraud Protections
This is the single most important thing to understand before you decide how careful to be. The Electronic Fund Transfer Act and Regulation E cap a consumer’s liability for unauthorized electronic transfers at $50 if reported within two business days, and $500 within 60 days. After 60 days of silence, a consumer can lose everything.6Office of the Law Revision Counsel. 15 USC 1693g Consumer Liability
Those caps apply only to accounts held primarily for personal, family, or household purposes. Business accounts are explicitly excluded from Regulation E.7Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs If a fraudulent ACH debit hits your business checking account, your bank may help you recover the funds, but it has no legal duty to reimburse you. Your rights depend on your deposit agreement and on UCC Article 4A, which generally places the burden on the business to detect and report unauthorized transactions quickly. Every precaution in this article matters more because of that gap.
How to Send Invoices Without Getting Burned
The invoice PDF is not the weak link. Email is. A document sitting in an unencrypted inbox is trivial for a compromised email account to intercept and alter. A few habits close most of the exposure.
- Password-protect the PDF and send the password by a different channel, such as a text message or a phone call. If an attacker gets into the email, they still cannot open the file.
- Send through an authenticated portal when your accounting software supports it. The recipient logs in to view the invoice, and the platform records when it was opened.
- Verify by voice before the first payment. Call the client at a number you already have on file, not one taken from the invoice email, and read the bank details out loud. This one step defeats most BEC attacks, because the fraudster cannot join a live phone call.
- Share bank details once, at onboarding, through a secure channel. Tell the client to call you if they ever receive an invoice from you showing different payment information. Repeat clients should never need to update your account details by email.
Verbal confirmation sounds low-tech, and that is why it works. Fraud operations count on busy people not picking up the phone.
Bank Controls That Block the Debit Risk
Most banks offer tools that stop unauthorized withdrawals before they land, and most small businesses never turn them on.
An ACH debit block is a blanket rejection of all incoming ACH debits. If you use your business account only to receive deposits and send outgoing payments, a full block eliminates the unauthorized-debit risk entirely. An ACH debit filter is the flexible version: you give the bank a list of companies allowed to pull from your account, and everything else is rejected automatically.
If you still take payment by check, Positive Pay is worth activating. You upload the list of checks you have issued with the check number, amount, and date, and the bank only pays checks that match. Anything else is held as an exception item until you approve or reject it, which stops forged and altered checks before they clear.
When It Makes Sense to Skip Bank Details Entirely
If the security overhead feels like too much, payment processors offer a clean alternative. You send an invoice with a payment link, the client pays by card or bank transfer inside the processor’s interface, and your actual account numbers never appear on the document.
The trade-off is cost. PayPal charges 3.49% plus $0.49 per domestic invoice paid through PayPal Checkout, or 2.99% plus $0.49 for standard card payments. ACH through PayPal runs 1%, capped at $10 per transaction.8PayPal. Merchant Fees Stripe charges 2.9% plus $0.30 for standard online card payments. On a $5,000 invoice, that is $145 to $175 in fees depending on platform and method. For a small one-time client or a payer whose email security you cannot vouch for, that is often worth it. For a repeat client paying a large invoice by ACH, sharing your bank details once through a verified channel is far cheaper.
Zelle sits in between for domestic payments and is offered free to many business account holders, though daily limits apply; Bank of America business clients, for example, can send up to $15,000 per day. Zelle transfers are near-instant and generally irreversible, so the same verification steps apply on the sending side.
If Something Goes Wrong, Move Fast
Recovery odds fall the longer you wait.
- Call your bank immediately. If you sent money to a fraudulent account, ask your bank to contact the receiving institution to freeze or recall the funds. If someone pulled money from your account, ask the bank to initiate a return. For ACH debits, the return window is generally 60 days from settlement for transactions where authorization existed but something was wrong.9Nacha. Differentiating Unauthorized Return Reasons
- File a report at ic3.gov. The FBI uses these reports to track BEC operations and, in some cases, to initiate recovery through its Recovery Asset Team.10FBI. Business Email Compromise
- Tell your client. If your invoice was intercepted and altered, they need to know at once so they can attempt a recall from their side.
- Change your account numbers. Open a new account and update your payment information with every active client through a verified channel.
Commercial crime insurance or a cyber policy with a social engineering fraud endorsement can cover funds voluntarily transferred on fraudulent instructions from someone impersonating a vendor. Read the endorsement before you need it. The short answer to the original question is yes, it is safe to put bank details on an invoice, on the condition that you treat the delivery channel as the real security surface and that you have set your bank’s controls to catch what slips past you.