Never give your bank account details to someone who contacts you first
If someone calls, texts, emails, or messages you asking for your bank account number, routing number, or online banking password, do not give it to them — even if they claim to be from your bank, your employer, a government agency, or a company you do business with. Legitimate organizations never ask for this information unsolicited.
Your bank account details are the keys to your money. Once someone has your account number and routing number, they can set up unauthorized transfers, create fraudulent checks, or drain your account through ACH (Automated Clearing House) debits. If they also have your online banking password, they can lock you out of your own account and move money before you notice.
The only safe exception is when you initiate contact with a known organization — you call the number on your bank statement or official website, you log into your bank's app yourself, or you visit a physical branch. Even then, your bank will never ask for your full password or PIN.
Key Takeaways
- Never share your bank account number, routing number, or online banking password with anyone who contacts you first, regardless of who they claim to be.
- Scammers impersonate banks, employers, and government agencies to trick people into revealing account details; legitimate organizations do not ask this way.
- If you are unsure whether a request is real, hang up and call the organization directly using the number on your official statement or their verified website.
- Once someone has your account number and routing number, they can drain your account through unauthorized ACH transfers or fraudulent checks.
- Report suspicious requests to your bank immediately and to the Federal Trade Commission at reportfraud.ftc.gov if you believe you have been targeted.
How scammers use your bank account details
With your account number and routing number alone, a scammer can initiate ACH transfers out of your account without your permission. ACH is the system banks use to move money between accounts — it is how direct deposit works, how you pay bills online, and how peer transfers happen. The problem is that ACH transfers can take one to three business days to complete, and by the time your bank catches the fraud, the money may already be gone.
Scammers also use stolen account details to create fraudulent checks or to set up recurring bill payments to accounts they control. If they have your password as well, they can log into your online banking, change your contact information, set up new payees, and move money before you even know something is wrong.
Your bank may eventually reverse fraudulent transfers, but the process takes time — often two to four weeks — and you may be without that money in the meantime. Some transfers cannot be reversed at all, especially if the receiving account has already withdrawn the funds.
Common scams that ask for your bank details
Phishing scams impersonate your bank by sending emails or texts that look official, with logos and language copied from real bank websites. The message usually claims there is a problem with your account — suspicious activity, a failed payment, or an expired card — and asks you to "verify" your information by clicking a link and entering your details. That link goes to a fake website that looks identical to your real bank's site.
Impersonation scams involve someone calling and claiming to be from your bank's fraud department, your employer's payroll team, or a government agency like the IRS or Social Security Administration. They create urgency by saying your account has been compromised, your tax refund is delayed, or your benefits will be cut off unless you act immediately. They then ask you to "confirm" your account number or routing number to "verify" your identity.
Prize and overpayment scams tell you that you have won a contest, received a tax refund, or are owed money from a lawsuit settlement. To claim it, they say, you need to provide your bank account details so they can deposit the funds. Once they have your information, they disappear — or they deposit a fake check and ask you to wire back the "overage" before the check bounces days later.
Job offer scams promise remote work and ask for your bank account details to set up direct deposit for your first paycheck. The job is not real, and the scammer now has your account information.
What to do if you have already shared your details
Contact your bank immediately, even if it is after hours. Most banks have a fraud hotline that operates 24/7. Tell them what information you shared and when. Your bank can flag your account for suspicious activity, monitor for unauthorized transfers, and in some cases freeze your account temporarily to prevent fraud.
If you shared your online banking password, change it right away — but only by logging into your bank's official website or app, not through any link in an email or text. If you cannot log in, call your bank directly to report that your password may be compromised.
Check your account history for the past 30 days and look for any transfers or payments you did not authorize. If you find unauthorized activity, report it to your bank in writing (email or through your online banking portal) so there is a record. Your bank is required to investigate and may reverse the charges, though this process takes time.
File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates a record of the scam and helps law enforcement track patterns. You can also report the scam to your state's attorney general office.
How to verify a request is actually from your bank
If you receive a call, email, or text claiming to be from your bank, hang up or do not click any links. Instead, use the phone number on the back of your debit or credit card, or the number on your most recent bank statement. Call that number directly and ask to speak with someone about the message you received. Your bank's real customer service team can tell you whether the request was legitimate.
Your bank will never ask you to provide your full account number, routing number, or password over the phone or in an email. If someone claiming to be from your bank asks for these details, it is a scam. Your bank already has your account number — they do not need you to tell them.
Legitimate banks may ask you to confirm the last four digits of your account number or your date of birth to verify your identity, but they will not ask for your full account details or your password. If you are unsure, tell the caller you will call back using the number on your statement and hang up.
When you actually need to provide your bank details
You will need to share your account number and routing number in specific situations where you are the one initiating the transaction. These include setting up direct deposit with your employer, paying bills through your bank's bill pay service, receiving a tax refund from the IRS, or receiving a payment from a company you have done business with (like a refund or insurance payout).
In these cases, you are in control of the transaction. You are the one deciding where your money goes. You can verify the organization's legitimacy before you share your details, and you can monitor your account afterward to make sure the money arrived as expected.
Even in these legitimate situations, you should only provide your account details through secure channels — your bank's official website or app, a company's official website (look for "https://" and a lock icon in your browser), or in person at a bank branch. Never provide your details through a link in an unsolicited email or text, even if the message looks official.
Protecting your account from future scams
Enable two-factor authentication on your online banking account if your bank offers it. This means that even if someone has your password, they cannot log in without a code sent to your phone or generated by an authentication app. Check your bank's website or call customer service to turn this on.
Set up account alerts through your bank's app or website. You can ask your bank to notify you by text or email whenever a transfer over a certain amount is initiated, or whenever your account is accessed from a new device. These alerts give you a chance to catch fraud quickly.
Monitor your account regularly — at least weekly. Log into your bank's official app or website and review recent transactions. If you see something you do not recognize, report it to your bank immediately.
Be skeptical of unsolicited contact. If someone calls, texts, or emails you asking for financial information, assume it is a scam unless you can verify otherwise. Legitimate organizations contact you about problems you already know about or that you have asked them to contact you about — not out of the blue.
Frequently Asked Questions
Can my bank actually reverse a fraudulent ACH transfer?
Your bank can attempt to reverse an ACH transfer, but success depends on timing and whether the receiving bank cooperates. If the transfer is caught within one business day, reversal is more likely. After that, the money may have already been withdrawn, making reversal impossible. Report fraud to your bank immediately.
What if a scammer used my account details to open a new account in my name?
Contact your bank and tell them your identity may have been stolen. Ask them to review recent account openings. Also place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) by calling 1-800-525-6285 or visiting equifax.com. This makes it harder for scammers to open new accounts using your name.
Is my bank responsible if someone drains my account with my details?
Banks are required by federal law to investigate unauthorized transfers and may reverse them, though the process takes time. Your liability depends on how quickly you report the fraud — report within two business days and your liability is capped at $50; report within 60 days and it may be higher. Report immediately to minimize your risk.
How do I know if an email from my bank is real?
Real banks do not ask you to click links in emails to verify account information. If you receive an email claiming to be from your bank, do not click any links. Instead, call the number on your bank statement or debit card and ask whether the email is legitimate. Your bank can tell you in seconds.
What should I do if I gave my details to someone I thought was my employer?
Contact your actual employer's HR or payroll department immediately and tell them what happened. Then contact your bank's fraud line. If the person who contacted you was a scammer, your employer will know and can help you report it. Your bank can monitor your account and help reverse any unauthorized transfers.