Sending your bank account number over standard email is not safe. The account and routing numbers themselves already appear on every paper check you write, so the digits aren’t secret. The problem is that email keeps them in a searchable form, on servers you don’t control, often for years — long enough for a breach or a compromised inbox to hand them to someone who will use them.
Why Email Is a Poor Place for Account Numbers
Standard email runs on a protocol built decades before online security mattered. When you hit send, the message usually passes through several intermediate servers on the way to the recipient. Providers like Gmail and Outlook encrypt messages in transit using TLS, which scrambles the data while it moves between servers. That helps, but the gaps are real.
TLS only protects the message while it’s moving. Once it lands on a server, it sits there as stored data, readable to anyone who breaches that server. If either provider doesn’t support TLS, part of the trip may happen in plain text. And inboxes themselves are constant targets. A hacker who gets into your account, or the recipient’s, can read every message ever sent, including the one from two years ago with your banking details in it.
A useful way to picture email with TLS: a sealed envelope that gets opened and resealed at each post office along the route. The carriers can’t read it while carrying it, but every sorting facility gets a look, and every sorting facility keeps a copy.
What Someone Can Do With Your Account and Routing Numbers
The most common fraud tied to stolen account and routing numbers is unauthorized ACH debits. ACH is the electronic payment network that handles direct deposits, bill payments, and online purchases. Legitimate ACH debits need your authorization. Criminals skip that step, submitting fraudulent debit requests with your numbers to pay their own bills or make online purchases.
Small, irregular debits are the real danger. A criminal pulling $15 here and $40 there blends into a busy statement and reads like a forgotten subscription. The pattern can run for months before you notice, and the longer it runs, the weaker your legal protections get.
Stolen numbers can also feed counterfeit check schemes. The routing number, account number, and check number printed at the bottom of every check are encoded in a machine-readable format called MICR, and basic desktop publishing tools can reproduce them on fake checks, sometimes with a scanned signature attached.1Office of the Comptroller of the Currency. Check Fraud: A Guide to Avoiding Losses Counterfeit checks often don’t surface in your online banking until they clear, which is late.
Bank fraud carries fines up to $1 million and prison sentences up to 30 years.2Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud That’s cold comfort when the person draining your account is never identified, which is the usual outcome. Prevention does more than prosecution.
Safer Ways to Send Your Account Details
Several options handle the same information without leaving it parked in an inbox.
- Secure client portals. Many banks, accountants, and payroll providers offer encrypted portals that protect data both in transit and at rest. If the person requesting your account details offers a portal upload, use it.
- Password-protected files sent across two channels. Put your banking details in a document, protect it with a password, then send the file by email and the password by text or phone call. A hacker who intercepts one channel gets nothing usable.
- End-to-end encrypted messaging. Apps like Signal encrypt messages so only you and the recipient can read them. There’s no readable copy sitting on an intermediate server, unlike standard email.
- A phone call. Reading your account number to the recipient takes thirty seconds and leaves no searchable trail in anyone’s inbox.
- Bank-initiated transfers. If someone needs your details to pay you, ask whether they can send funds through their bank’s bill pay or transfer system instead. That keeps your number inside banking infrastructure rather than in an email thread.
The common thread is separating sensitive data from easily compromised channels. Any method that avoids storing your full account and routing numbers together in a single searchable message is a large step up from plain email.
If You Already Sent It
Act quickly. Your legal protections are strongest when you respond fast, and the account is easiest to defend before anything has been stolen.
Call your bank’s fraud department first. Explain what happened and ask whether they recommend closing the account and issuing a new number. Closing the account is the most effective block against unauthorized debits. It means updating every automatic payment tied to that account, which is a nuisance, but far cheaper than absorbing fraudulent withdrawals. While you’re on the phone, turn on multi-factor authentication for online banking and set up real-time transaction alerts. Most banks can push a notification to your phone for every withdrawal, which lets you catch unauthorized activity within hours instead of waiting for a monthly statement.
Delete the original email from both your sent folder and your trash, and ask the recipient to do the same. This doesn’t undo any interception that already happened, but it shrinks the number of places the information sits waiting to be found.
How Fast You Have to Report Matters
Federal law caps your liability for unauthorized electronic transfers on personal bank accounts, and the cap depends entirely on how quickly you report.
Notify your bank within two business days of discovering an unauthorized transfer and your liability is capped at $50, or the actual loss if it’s less.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section: 1005.6 Liability of Consumer for Unauthorized Transfers Wait longer than two business days but catch the problem within 60 days of receiving the statement that shows the fraudulent transaction and your liability can reach $500.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Miss the 60-day window and you lose the right to reimbursement for unauthorized transfers happening after the deadline, if the bank can show it could have stopped them had you reported sooner.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section: 1005.6 Liability of Consumer for Unauthorized Transfers Someone draining an account through small debits that goes unnoticed for months can cause losses you’ll never recover. That’s where most people get hurt: not a dramatic heist, but a slow bleed and a late look at the statement.
If You Think Your Wider Identity Was Exposed
If the risk feels broader than one account number, you can place a fraud alert on your credit file for free. An initial fraud alert lasts at least one year and only requires a good-faith suspicion. Contact one of the three major credit bureaus and it’s required to notify the other two. An extended fraud alert runs seven years but requires a formal identity theft report.5Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts To build that report, start at the FTC’s IdentityTheft.gov, which generates an Identity Theft Affidavit and a personalized recovery plan.6Federal Trade Commission. What To Do Right Away
A Note for Business Accounts
The liability caps above apply to personal accounts. Business accounts are not covered by Regulation E; they fall under Article 4A of the Uniform Commercial Code, and the protections are much weaker. If your bank offered a “commercially reasonable” security procedure — multi-factor authentication for wire transfers, for example — and you agreed to use it, the bank can shift liability to you for unauthorized payment orders the procedure would have caught.7Legal Information Institute. UCC 4A-202 – Authorized and Verified Payment Orders The reporting window is also longer on paper but shorter in practice: Article 4A gives you one year from when a statement is made available to challenge an unauthorized transaction,8Legal Information Institute. UCC Article 4A – Funds Transfer and many banks impose contractual deadlines of 30 to 90 days in their account agreements. Business owners should treat email transmission of account details as a risk with no consumer safety net underneath it.