You should not order food using only your bank account number
Food delivery services, restaurants, and grocery apps do not accept bank account numbers as a payment method. They require a debit card, credit card, digital wallet (Apple Pay, Google Pay), or a third-party service like PayPal. If a website or app asks for your account number to process a food order, it is not a legitimate payment system — it is a scam designed to steal your banking information.
The reason is straightforward: your bank account number alone cannot move money. A payment processor needs additional security layers — a card network (Visa, Mastercard), a digital signature, or a verified third-party intermediary. Handing over your account number without those layers leaves you vulnerable to unauthorized withdrawals and fraud.
Key Takeaways
- Legitimate food delivery and restaurant payment systems never ask for your bank account number alone — they use debit cards, credit cards, or digital wallets instead.
- If a site or app requests your account number to order food, it is a scam; stop and do not enter any information.
- Your bank account number is printed on your checks and is not secret; sharing it with the wrong person can lead to unauthorized ACH transfers and account drains.
- Safe payment methods for food orders include your debit card, credit card, PayPal, Apple Pay, Google Pay, or cash on delivery where offered.
- If you have already shared your account number with a suspicious food ordering site, contact your bank immediately to monitor for fraud.
Why account numbers are not used for food orders
Your bank account number is one half of the routing and account pair used for wire transfers and ACH (Automated Clearing House) payments. On its own, it is not encrypted, not verified by a card network, and not tied to fraud protections that credit and debit cards carry. A legitimate payment processor will never ask for it as a standalone piece of information.
Food delivery platforms and restaurants use payment gateways that tokenize your card data — they convert your card information into a secure token that cannot be reversed or reused. Your account number cannot be tokenized this way. It is also printed on every check you write, which means it is not treated as secret information by banks or merchants.
When you pay with a debit card at a restaurant or app, the merchant receives a token, not your actual card number. Your bank account number never leaves your bank's system. This separation is what makes the transaction safe.
How scammers use fake food ordering sites
Fraudsters create websites or apps that mimic real delivery services or local restaurants. They offer discounts, free delivery, or limited-time deals to lure you in. At checkout, instead of asking for a card number, they request your bank account number and routing number — claiming it is needed to "verify your account" or "process the order faster."
Once they have your account number, they can set up unauthorized ACH transfers directly from your bank account. Unlike a fraudulent credit card charge, which you can dispute within 60 days, ACH fraud can drain your account before you notice. Some scammers also sell your account information to other criminals.
These fake sites often use domain names that are one letter off from real services — for example, "doordash-delivery.com" instead of "doordash.com" — or they appear in search results as sponsored ads. Always verify the URL before entering any payment information.
Safe payment methods for food orders
Use a debit card or credit card for food orders. Both are protected by card networks and come with fraud dispute rights. If a charge is fraudulent, you can dispute it with your card issuer within 60 days (credit cards) or up to 120 days (debit cards, depending on your bank). The merchant never sees your full card number — only a token.
Digital wallets like Apple Pay and Google Pay add another layer of security. Your actual card number is not shared with the merchant; instead, a device-specific token is sent. If the merchant's system is breached, your card information is not exposed.
PayPal and similar third-party payment services also protect your bank account. PayPal holds your funding source information and sends only a confirmation to the merchant. Cash on delivery, where available, eliminates the need to share any financial information online.
What to do if you shared your account number with a suspicious site
Contact your bank immediately — do not wait. Tell them you shared your account number with an untrusted source and ask them to monitor your account for unauthorized ACH transfers. Many banks can flag your account for fraud alerts or place a temporary hold on outgoing transfers while they investigate.
Request a new account number and debit card if your bank offers it. Some banks will issue a new account number at no cost if fraud is suspected. Review your recent transactions and bank statements for any unauthorized charges or transfers. If you find fraudulent activity, file a dispute with your bank in writing and keep copies of all correspondence.
Report the fake site to the Federal Trade Commission at reportfraud.ftc.gov. Include the URL, the date you visited it, and any screenshots. If the scam involved a fake app, report it to the app store (Apple App Store or Google Play) where you found it.
How to spot a legitimate food ordering site
Check the URL carefully. Legitimate services use their official domain name — doordash.com, ubereats.com, grubhub.com, or the restaurant's own website. Look for the padlock icon in your browser's address bar, which indicates an encrypted connection (HTTPS). Fake sites often use HTTP without encryption.
Legitimate sites ask for a debit card, credit card, or digital wallet — never a bank account number. If you are unsure whether a site is real, go directly to the restaurant's website or call them by phone. Do not click links in emails or text messages; instead, open your browser and type the URL yourself.
Check reviews on Google Maps or Yelp for the restaurant or delivery service. Scam sites often have no reviews, very new reviews, or reviews that mention payment problems. If a deal seems too good to be true — 80% off delivery, free meals for new users — it probably is.
Frequently Asked Questions
Can I use my bank account number to pay for food delivery through a legitimate app?
No. Legitimate food delivery apps (DoorDash, Uber Eats, Grubhub) and restaurants do not accept bank account numbers as payment. They use debit cards, credit cards, digital wallets, or PayPal. If an app asks for your account number, it is not legitimate.
What is the difference between giving my debit card number and my bank account number?
Your debit card number is tied to card network protections and fraud dispute rights. Your bank account number is not; it is a routing identifier used for ACH transfers. Sharing your account number allows someone to pull money directly from your account without authorization. Sharing your debit card number through a secure payment gateway does not.
If I accidentally entered my account number on a fake site, how long do I have to report it?
Contact your bank as soon as you realize the mistake. The sooner you report it, the sooner they can monitor your account and block unauthorized transfers. If unauthorized transfers do occur, you typically have 60 days from your bank statement to dispute them, but reporting immediately gives your bank time to prevent fraud before it happens.
Are there any food delivery services that use bank account numbers?
No major food delivery service uses bank account numbers for payment. Some smaller local services or restaurants may offer ACH payment as an option for recurring orders or catering, but they will be transparent about it and will ask for authorization through a secure, verified process — not a casual checkout form.
What should I do if I see a food delivery ad that asks for my account number?
Do not click it. Report it to the platform where you saw it (Google, Facebook, Instagram) and to the FTC at reportfraud.ftc.gov. If it is a sponsored search result, report it to Google Ads. These platforms take fraud reports seriously and remove scam ads when they are flagged.