Email is not a secure way to send banking information
Email travels through multiple servers and is stored on those servers indefinitely. Anyone with access to your email account, your recipient's email account, or the servers in between can read what you send. Banks, payment processors, and government agencies that handle refunds will never ask you to email your account number, routing number, or PIN.
When you email sensitive banking details, you create a permanent record that sits in inboxes and backup systems. Even if you delete the message, it remains on the recipient's server and in email archives. A data breach at any point in that chain exposes your information to someone who can use it to drain your account or commit fraud in your name.
The risk is especially high when you are waiting for a refund. Scammers know people are expecting money and will impersonate refund programs, tax agencies, or insurance companies to trick you into sending account details via email. Once they have your information, they can set up unauthorized transfers or create fraudulent accounts.
Key Takeaways
- Email is not encrypted by default and passes through multiple servers where it can be intercepted or stored indefinitely.
- No legitimate government agency, bank, or refund program will ask you to email your account number, routing number, or other banking details.
- Scammers posing as refund programs specifically target people waiting for money by requesting account information via email.
- Secure methods for providing banking details include phone calls to verified numbers, secure online portals with login credentials, and in-person visits to a bank or office.
- If someone asks you to email banking information, do not do it — contact the organization directly using a phone number or website you find yourself, not one they provided.
How legitimate refund programs collect your banking information
When a government agency, insurance company, or business needs your checking account details to send a refund, they use one of three methods: a secure online portal where you log in with a password, a phone call to a verified number you find yourself, or an in-person visit to an office or bank branch.
The IRS, for example, never asks for banking details by email. If you are receiving a tax refund by direct deposit, you provide your account and routing numbers on your tax return itself — a document you file, not one they send you. If the IRS needs to contact you about your account, they mail a letter to your address on file. They do not email or call unsolicited.
State tax agencies, unemployment insurance programs, and disaster relief funds follow the same pattern. They may send you a letter telling you to log into a secure website, or they may call you at a number you provided when you first registered. They will never ask you to reply to an email with your account details.
What to do if someone asks you to email banking information
Stop and verify who is actually asking. Do not use any contact information they provided in the email or letter. Instead, go to the official website of the organization they claim to represent — type the URL directly into your browser — and look for a phone number or secure message portal listed there.
Call that number and ask whether the organization sent you the request. Describe what the email or letter said, but do not read your account details aloud. A legitimate organization will either confirm they sent it and direct you to a secure method, or they will tell you the request is fraudulent.
If the request came via email and the organization confirms it is fake, forward the email to the real organization's fraud department. Most agencies have a dedicated email address for reporting phishing attempts. Report it to the Federal Trade Commission at reportfraud.ftc.gov as well.
Red flags that signal a scam
Urgency is the most common warning sign. Scammers tell you your refund is delayed, your account is locked, or you must act today or lose the money. Real refund programs do not threaten you into providing information. They give you time to verify the request and contact them through official channels.
Requests for information you already provided are another red flag. If you filed a tax return or submitted an insurance claim, you already gave the organization your details. They do not need you to email them again. If an email claims your information is missing or outdated, call the organization directly using a number you find yourself.
Poor spelling, awkward phrasing, or a generic greeting like "Dear Customer" instead of your name suggests the sender is not who they claim. Government agencies and established businesses proofread their communications and address you by name. Scammers often send mass emails with obvious errors.
Links in the email are another danger. Even if the email looks legitimate, clicking a link may take you to a fake website designed to steal your login credentials. If an email directs you to log in or provide information, close the email and visit the organization's website directly instead.
Secure alternatives for sending banking information
| Method | How It Works | When to Use It |
|---|---|---|
| Secure online portal | You log in with a username and password to a website that encrypts your data. You enter your account details only on that secure page. | When an organization sends you a letter with login instructions or a link to their official website. |
| Phone call to a verified number | You call the organization using a phone number you find on their official website or in a mailed letter. You speak to a representative who can verify your identity before you share details. | When you need to confirm whether a request is real or when the organization offers phone support. |
| In-person at a bank or office | You visit a physical location and provide your information to someone who can verify your identity in real time. | When you need immediate help or want the highest level of security. |
| Certified mail | You mail a signed document containing your banking details using a postal service that tracks delivery and requires a signature. | Rarely necessary, but an option if an organization specifically requests it and provides a mailing address on their official website. |
What happens if your banking information is compromised
If you have already emailed your account number or routing number to someone you now believe is a scammer, contact your bank immediately. Call the number on the back of your debit card or on your bank's official website. Do not use a number from the suspicious email.
Tell your bank that your account information may have been compromised. They can flag your account for suspicious activity, monitor for unauthorized transfers, and issue you a new debit card and account number if necessary. The sooner you report it, the faster they can act.
File a report with the Federal Trade Commission at reportfraud.ftc.gov and with your state's attorney general. These reports help law enforcement track scam patterns and may prevent others from becoming victims. Keep copies of the suspicious email and any responses you received.
Monitor your account statements closely for the next several months. Check for transfers you did not authorize, unexpected fees, or new accounts opened in your name. If you spot fraud, report it to your bank and the FTC again with the specific details.
Frequently Asked Questions
Can I email my account information if I encrypt the email myself?
Encryption adds a layer of security, but it does not make email a safe channel for banking details. The encrypted message still travels through multiple servers and is stored in inboxes. If someone gains access to your email account or the recipient's account, they can read the decrypted message. Use secure portals or phone calls instead.
What if a government agency says they need my account information by email because of an emergency?
No legitimate government agency will ask for banking details by email, even in an emergency. If someone claims to represent a government office and is pressuring you to email sensitive information, it is a scam. Hang up or close the email and call the agency directly using a number you find on their official website.
Is it safe to email my account information to my own bank?
Your bank has secure systems for you to update your information. Use their online banking portal, call their customer service number, or visit a branch in person. Do not email your bank account details, even to an email address that appears to be from your bank. Scammers can spoof email addresses to look like they come from legitimate organizations.
What should I do if I see someone else asking for banking information via email?
Report the email to the organization being impersonated and to the Federal Trade Commission. Forward the suspicious message to the real organization's fraud department — most agencies list a phishing email address on their website. You can also report it to reportfraud.ftc.gov to help protect others.
Can I give my account information over the phone if I call the number in an email?
No. Do not use contact information from a suspicious email or letter. Instead, find the organization's phone number on their official website or on a document you received directly from them. Call that number and ask whether the request is real. This protects you from calling a scammer's number by mistake.