The short answer: don't do it
Email is not encrypted by default, which means your bank account number, routing number, and other details travel across the internet in plain text. Anyone with access to email servers along the way—at your provider, the recipient's provider, or anywhere in between—can read it. Hackers also routinely intercept email, and once your account details are in someone's inbox, they stay there in backups and archives indefinitely.
If you need to share bank details with a legitimate business or person, use a phone call, a secure message through your bank's app, or an in-person meeting instead. If you must use email, call the recipient first to confirm their email address is correct, and never include your full account number in the message body.
Key Takeaways
- Email travels unencrypted by default, meaning anyone with access to email servers can read your bank details.
- Hackers regularly intercept email, and deleted messages remain in server backups and archives for months or years.
- A phone call is faster and safer than email for sharing account details with banks, employers, or service providers.
- If you must email account details, call first to verify the recipient's email address, and never include your full account number in the message body.
- Legitimate banks and government agencies will never ask you to email account details; they will ask you to log into a secure portal or call a verified number.
How email leaves your bank details exposed
When you send an email, it passes through multiple servers before reaching the recipient. Your email provider stores a copy, the recipient's provider stores a copy, and backup systems at both companies keep copies for weeks or months. Each of these systems is a potential point of entry for someone with bad intentions.
Standard email is not encrypted, which means the content is readable at every step. Some email providers offer end-to-end encryption (Gmail has this as an option, for example), but the recipient's provider may not support it, and many people do not turn it on. Even if encryption is enabled, your bank details are still visible to anyone who gains access to the recipient's email account—through a weak password, phishing, or a data breach.
Once a message is deleted, it is not gone. Email servers keep backups for disaster recovery, and those backups can persist for months. If a hacker breaks into an email account weeks after you sent your details, they can still retrieve the message from archives.
What happens if someone gets your account details
Your bank account number and routing number are enough for someone to set up unauthorized transfers or payments from your account. They cannot withdraw cash directly without your debit card or PIN, but they can drain your account by setting up ACH transfers to their own account, paying bills in your name, or signing up for recurring charges.
Your bank's fraud protection will cover most unauthorized transactions if you report them within a certain window—usually 60 days for ACH fraud. But you have to notice the fraud first, which can take weeks if you do not check your account regularly. In the meantime, your account may be overdrawn, and you may face overdraft fees or a negative balance that affects your credit.
If someone uses your account details to commit fraud in someone else's name, you may also be contacted by debt collectors or creditors. Cleaning this up takes time and documentation, even though you are not liable for the fraudulent charges.
Safe ways to share your bank details
A phone call is the fastest and safest option. Call your bank, your employer's payroll department, or the service provider directly using a number you find on their official website or statement. Read your account details aloud, and ask them to repeat the numbers back to you to confirm they have them right. This takes five minutes and leaves no digital trail.
If you are setting up direct deposit with an employer, many payroll systems now let you upload a voided check or a document from your bank instead of typing in your account number. A voided check shows your routing and account numbers in a format the payroll system can read automatically, and you control exactly which document you are sharing.
Your bank's mobile app or online portal often has a secure message feature. Log into your account, find the "contact us" or "secure message" section, and send your details through that channel. The message stays within your bank's encrypted system and does not travel across the open internet.
If you absolutely must use email, call the recipient first to confirm their email address, then send a message that includes only the last four digits of your account number. Ask them to call you back to confirm the full number over the phone. This way, the email does not contain enough information for someone to act on it alone.
Red flags: when someone is asking for trouble
Legitimate banks and government agencies never ask you to email account details. If your bank emails you asking for your account number, routing number, or PIN, it is a phishing scam. Do not reply. Instead, call your bank using the number on the back of your debit card.
Employers and service providers should have secure portals or phone lines for this information. If someone is pressuring you to email your details because "it is faster" or "the system is down," that is a sign something is wrong. Hang up and call the company back using a number you find independently.
Be especially cautious if someone asks for your account details via email after you have already given them to the company in person or over the phone. This is often how account takeover fraud starts: a scammer sends an email that looks like it came from a company you trust, asking you to "update" or "verify" your information.
What to do if you already sent your details by email
If you sent your full account number and routing number to someone you trust—an employer, your landlord, or a utility company—contact them by phone and ask them to delete the email. Then monitor your account for the next 30 to 60 days. Check your transactions at least once a week, and set up account alerts through your bank's app so you are notified of any transfers or large purchases.
If you sent your details to someone you do not know, or if you are not sure whether the email address was legitimate, contact your bank immediately. Tell them what information you shared and when. Your bank can flag your account for fraud monitoring and may issue you a new account number if the risk is high.
If you see unauthorized transactions on your account, report them to your bank within 60 days. Your bank will investigate and reverse the charges in most cases. Keep records of all communications with your bank about the fraud, including dates, times, and the names of the people you spoke with.
Frequently Asked Questions
Is it safe to email my account details if I use Gmail's confidential mode?
Gmail's confidential mode adds a layer of protection—the recipient cannot forward the message or take screenshots—but it does not encrypt the message in transit. Your bank details are still visible to Gmail's servers and the recipient's email provider. Confidential mode is better than nothing, but a phone call is still safer.
What if my bank asks me to email my account details?
Your bank will never ask you to email account details. If you receive an email claiming to be from your bank and asking for this information, it is a phishing scam. Do not reply. Call your bank using the number on your debit card or statement to report the email.
Can someone use just my account number and routing number to steal money?
Yes. Your account number and routing number are enough to set up ACH transfers from your account. They cannot withdraw cash without your debit card, but they can transfer money to another account or set up recurring payments. Your bank's fraud protection will cover most of these transactions if you report them within 60 days.
How long do email backups keep my bank details?
Email backups vary by provider, but most companies keep them for at least 30 days and often much longer. Gmail, Outlook, and other major providers keep backups for months. Even after you delete an email, it can be recovered from backups for a significant period of time.
What should I do if I need to send account details to someone I do not know well?
Call them first to verify their phone number and email address using contact information you find independently. Then call them back and read your account details aloud. Never email account details to someone you have not spoken to directly by phone.