Giving someone your ACH information is generally safe when you know and trust the recipient, because your routing and account numbers are not secrets in the way a PIN is, and federal law caps your liability for unauthorized withdrawals at as little as $50 if you report the problem quickly. Whether it is safe to give ACH information in any specific case comes down to one question: do you have a real reason to trust the party asking, and can you verify who they are independently?
The Numbers Themselves Are Not Secret
Your routing number and account number appear at the bottom of every paper check you write. They identify your bank and your account inside it. Anyone you have ever paid by check has seen them. That is why the security model for ACH does not rely on keeping the numbers hidden — it relies on the requirement that a company have your authorization before it can pull money from your account, and on your right to dispute a debit that you did not approve.
Federal law defines an unauthorized electronic fund transfer as one initiated by someone other than you, without your permission, and from which you received no benefit. If you voluntarily give someone access to your account, transfers that person makes are not treated as unauthorized unless you have already told your bank to cut off their access.1Office of the Law Revision Counsel. 15 USC 1693a – Definitions The distinction matters, because your legal protections only cover activity that was genuinely unauthorized.
When Sharing ACH Details Is Risky
The danger is rarely the ACH system. It is who you hand your account details to. Giving your routing and account number to an unfamiliar party gives them the ability to attempt a withdrawal, and while you can usually reverse an unauthorized debit, disputing one takes time and effort you would rather avoid.
Treat these signals as reasons to stop and verify before sharing anything:
- Unsolicited contact. A caller, email, or text you did not initiate asks for your bank information. Legitimate companies do not cold-call to collect account numbers.
- Pressure to act immediately. Scammers manufacture urgency — threatening account closure, legal action, or a lost opportunity — to keep you from thinking. The FTC treats any payment demand paired with high-pressure tactics as a red flag.2FTC. How to Avoid a Scam
- A company you cannot independently verify. If you cannot confirm the business’s identity, physical address, and phone number on your own, do not hand over account details.
- Insistence on one payment method. A real business usually offers more than one way to pay. Someone who will only accept a direct bank debit is telling you something.
- Overpayment schemes. A buyer or “employer” sends you a check, asks you to deposit it, then requests that you send part of the money back by ACH. Days later the original check bounces and you are on the hook for the full amount.
One useful distinction: ACH debits, where a company pulls money from your account, carry the risk. ACH credits, where money is deposited into your account, do not. Giving your employer your account details for direct deposit or the IRS your account details for a refund involves the same numbers, but no one is withdrawing anything. Be most cautious when authorizing a new company to debit you.
What the Law Does for You If Something Goes Wrong
The Electronic Fund Transfer Act and Regulation E set hard caps on how much you can lose from an unauthorized ACH withdrawal on a consumer account. Your exposure depends on how quickly you notify your bank:
- Within two business days of discovering the problem, your loss is capped at the lesser of $50 or the unauthorized amount.
- After two business days but within 60 days of the statement, your loss can rise to $500, and only for transfers the bank can show would not have happened had you reported sooner.
- After 60 days from the statement, you can be held responsible for the full amount of any unauthorized transfers that occur after that 60-day window closes and before you finally notify the bank.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
The 60-day clock starts when your bank sends or makes the statement available, not when you open it. Checking statements regularly is one of the simplest things you can do to protect yourself.
When you report a suspected unauthorized transfer, your bank has to investigate on a federally mandated timeline. It has 10 business days to complete the investigation, or up to 45 days if it provisionally credits your account within the first 10 business days so you have use of the disputed funds during the review. That deadline stretches to 90 days for international transfers, point-of-sale debit card transactions, and transfers within 30 days of the first deposit to a new account. Once the bank confirms an error, it must correct it within one business day and notify you of the results within three business days.4CFPB. 12 CFR 1005.11 – Procedures for Resolving Errors If the bank concludes no error occurred, it must explain its findings in writing and, if you ask, provide the documents it relied on.
Stopping a Recurring ACH Payment You Already Authorized
If you authorized a company to pull recurring ACH payments from your account and want to shut that off, you have the legal right to do so at any time. Notify your bank at least three business days before the next scheduled withdrawal. You can do this by phone or in writing.5eCFR. 12 CFR 1005.10 – Preauthorized Transfers
If you call, your bank may require written confirmation within 14 days. The bank has to tell you about that requirement and give you the address at the time of your call. If you miss the 14-day deadline, the oral stop-payment order expires and future withdrawals may go through.6Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Many banks charge a stop-payment fee, typically $15 to $36, sometimes less if you file the request online. Contact the company directly to revoke the authorization as well; doing both reduces the chance of a disputed charge later.
ACH Transfers Compared to Wire Transfers
ACH and wire transfers both move money between banks electronically, but the safety picture differs sharply, and searchers often confuse the two.
- Reversibility. ACH transfers can be reversed if you report an error or unauthorized transaction promptly. Wire transfers are generally irrevocable; once the money leaves your account, recovering it is difficult or impossible.
- Consumer protections. ACH transfers on consumer accounts are covered by Regulation E, with the liability caps and investigation rules above. Consumer-initiated wire transfers do not have the same federal protections.
- Speed and fraud risk. ACH transactions process in batches over hours or a business day, creating a window for fraud detection. Wires settle in near real time, which is why they are the preferred tool for many fraud schemes.
If someone pressures you to wire money instead of using ACH, ask yourself why. Wires make sense for time-sensitive, high-value transactions like real estate closings. For routine payments, ACH is cheaper and safer.
Business Accounts Do Not Get These Protections
Everything above applies to consumer accounts — personal checking, savings, and prepaid accounts. If you use a business checking account, the rules are different and much less protective. Business ACH transactions are generally governed by UCC Article 4A, which explicitly excludes transfers already covered by the Electronic Fund Transfer Act.7Legal Information Institute. UCC Article 4A – Funds Transfer Under Article 4A, a business must report an unauthorized payment order within a reasonable time, not exceeding 90 days after the bank notified it. There are no $50 or $500 caps; loss allocation depends on whether the bank used commercially reasonable security procedures and whether the business followed them. Many business banking agreements impose even shorter reporting deadlines. If you run a business, read your account agreement and consider adding ACH debit blocks or filters that restrict which companies can pull from your account.
What to Do the Moment You See an Unauthorized Transfer
Speed matters more than anything else here.
- Call your bank immediately. Use the number on the back of your debit card or on the bank’s website. Reporting within two business days keeps your maximum liability at $50.
- Follow up in writing. Even if the bank takes an oral report, send a written notice with the date, amount, and reason. It protects you if a dispute arises later about when you reported.
- Keep watching the account. Report each additional unauthorized transaction separately as you find it.
- Escalate to the CFPB. If your bank misses the investigation timeline or refuses to provide provisional credit, file a complaint with the Consumer Financial Protection Bureau.
If the unauthorized activity shows up on a statement but you still have your card and PIN, you have 60 days from the statement date to notify the bank. Wait longer and you can be held responsible for the full amount of any transfers that occur after that window closes.8CFPB. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account In unusual circumstances, such as extended hospitalization or lengthy travel, those deadlines can be extended.
So: safe with a known employer, a government agency, or an established company you can verify. Risky with anyone who contacted you first, pressured you, or cannot be independently confirmed. The law gives you real recourse either way, but recourse takes work, and the best protection is deciding carefully who gets the numbers in the first place.