Yes, it is generally safe to give someone your bank account number when there’s a legitimate reason to share it. Employers, billers, government agencies, and payment platforms ask for your account and routing numbers as a matter of routine, and those same digits are printed on every paper check you write. If the numbers are ever misused, federal law shields you from unauthorized electronic withdrawals, usually with zero liability, as long as you report the problem within 60 days of the statement that shows the charge.
When Sharing Your Account Number Is Normal
A lot of everyday financial life runs on your account and routing numbers. Your employer needs them to set up direct deposit through the ACH network. Utility companies, insurers, and subscription services ask for them to run recurring payments. The IRS uses them to deposit tax refunds. Wire transfers, domestic or international, require the numbers along with a routing or SWIFT code.
Many apps now link to your account through third-party services that use encryption and multi-factor authentication, so you may never type the number into a form at all. And your account and routing numbers already appear in magnetic ink at the bottom of every personal check, meaning anyone who has ever handled one of your checks (a landlord, a contractor, a clerk) already has them. Those numbers were designed to move through regulated financial channels, not to function as passwords.
What Someone Can Actually Do With Your Account Number
An account number by itself is not enough to drain your account, but someone who has both the account and routing numbers can attempt several kinds of fraud.
Unauthorized ACH Debits
A thief can enter your account and routing numbers into an online payment portal and pull money from your checking account by pretending to be you. They might pay their own bills, fund purchases, or move money to accounts they control. ACH transactions do not require a physical card or a PIN, so they can be initiated from anywhere with an internet connection.
Remotely Created Checks and Counterfeits
Criminals can generate remotely created checks, which carry your account information but require no handwritten signature. Under the Uniform Commercial Code, the bank that processes one of these checks warrants that the person whose account is being debited actually authorized the payment, giving your bank a legal basis to recover the funds if you didn’t.1Legal Information Institute. UCC 3-417 – Presentment Warranties More sophisticated fraudsters manufacture counterfeit paper checks that look identical to yours and cash them at retail locations before the fraud surfaces.
Micro-Deposit Verification Exploits
Some platforms verify account ownership by sending tiny test deposits and asking the account holder to confirm the amounts. Fraudsters exploit this by linking strings of random account numbers to brokerage or payment accounts, hoping to hit a valid one, then use the verified link to withdraw larger sums.
Synthetic Identity Fraud
Stolen account numbers can also feed larger schemes. Criminals combine real data, such as a stolen Social Security number or bank account number, with fabricated details like a fake name and date of birth to build a new identity. These synthetic identities are used to open fraudulent accounts, apply for credit, and route stolen money through shell accounts.2United States Department of Justice. Two Men Who Allegedly Used Synthetic Identities Charged in Miami Federal Court
Your Federal Protection When Fraud Happens
The Electronic Fund Transfer Act (EFTA) and its implementing rule, Regulation E, cover almost every electronic debit from a consumer bank account, including ACH withdrawals, debit card charges, and real-time transfers through networks like FedNow.3Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose4eCFR. Subpart C – Funds Transfers Through the FedNow Service How much protection you receive depends on whether an “access device” like a debit card or PIN was involved, and how fast you report the problem.
When Only Your Account and Routing Numbers Were Used
This is the scenario that matters when you share your bank account number. If someone uses those digits to pull unauthorized ACH debits without stealing a debit card or PIN, the tiered $50 and $500 liability caps do not apply at all.5Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers Your only obligation is to report the unauthorized transfer within 60 days of the date your bank sends or makes available the statement showing the charge. Report inside that window and your liability is zero. The bank must return the full amount.
Miss the 60-day window and you can be held responsible for unauthorized transfers that happen after day 60 and before you notify the bank, but only to the extent the bank can prove those later transfers would not have occurred had you reported on time.6eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The original unauthorized charge on the statement you missed is still the bank’s problem.
When a Debit Card or PIN Was Also Stolen
A stricter, tiered system applies if the fraud involved a lost or stolen access device such as your debit card, PIN, or any code your bank issued to authenticate transactions.7Consumer Financial Protection Bureau. 1005.2 Definitions
- Report within 2 business days and your maximum liability is $50, or the amount taken before you notified the bank, whichever is less.8Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of your statement and liability can rise to $500, covering transfers between the end of the two-day window and the date you notified the bank.
- Fail to report within 60 days and you can face unlimited liability for transfers occurring after that window closes.
Extended travel, hospitalization, or similar circumstances can push these deadlines to a reasonable period under the situation.8Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Business Accounts Get Less
The EFTA and Regulation E protect consumer accounts only. If a business checking account is hit with an unauthorized ACH debit, your bank can file a warranty claim against the bank that originated the debit under ACH network rules, with a one-year deadline from the transaction’s settlement date.9Nacha. Limitation on Warranty Claims That recourse exists, but it does not come with the same provisional credit or investigation timelines consumers receive. Businesses should ask their bank about ACH debit blocks or positive-pay services.
How to Share Your Account Number Safely
A few habits sharply reduce your risk:
- Verify the recipient before you hand anything over. If a caller says they’re from your bank, hang up and dial the number on the back of your debit card or on the bank’s official website.
- Use secure connections. Skip public Wi-Fi when entering account numbers, and use your home network or a VPN.
- Do not send account and routing numbers by email or text message. Neither is encrypted end-to-end. Use your bank’s secure portal or share the numbers in person.
- Turn on transaction alerts. Most banks can push a notification for every ACH withdrawal or for transactions above a threshold you set, so you catch problems in hours rather than at month’s end.
- Review statements promptly. The 60-day clock in federal law starts when your bank sends the statement, not when you open it.
What to Do If Your Number Is Exposed or Misused
Speed matters more than paperwork. Call your bank’s fraud department the moment you spot an unauthorized charge. Oral notice is enough to start the process and lock in your protections.10Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution Follow up in writing with your name, account number, the disputed transaction, the amount, and why you believe it’s an error. Your bank can require that written confirmation within 10 business days.
What the Bank Must Do
Once your bank has your notice, it has 10 business days to investigate and tell you whether an error occurred. If it needs longer, it can take up to 45 days, but only if it provisionally credits your account for the disputed amount within the first 10 business days.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors You get full use of that money during the investigation. If the bank confirms the error, it must correct it within one business day. If it decides no error occurred, it must explain within three business days and may reverse the provisional credit.
Accounts less than 30 days old, international transfers, and point-of-sale debit card transactions get longer windows: 20 business days for provisional credit and up to 90 days for the full investigation.12eCFR. Part 1005 – Electronic Fund Transfers (Regulation E)
If Identity Theft Is Involved
File a report at IdentityTheft.gov to generate an FTC Identity Theft Affidavit. Print it before you leave the page, because you cannot retrieve it later. Combined with a police report, the affidavit creates a formal Identity Theft Report that strengthens your position when disputing fraud with your bank and other companies.13Federal Trade Commission. Identity Theft: What to Do Right Away
Whether to Close the Account
If you think your number has been exposed but no fraud has hit yet, ask the bank to freeze the account, close it, move your balance to a new account with a new number, and update any direct deposits, autopayments, and linked apps.
If unauthorized transactions have already occurred, do not close the account until the dispute is finished. Closing a compromised account mid-investigation can complicate recovery of the stolen funds. Ask the bank to freeze outgoing transactions instead, and keep watching the account until the bank issues its final determination.