Send your bank account details only through secure channels, and only to people or organisations you trust and have initiated contact with yourself.
Your bank account number and routing number are not secret in the way a password is — your checks print them at the bottom, and you give them out whenever you set up direct deposit or automatic bill pay. But sending them through email, text, or an unsecured form creates a record that can be intercepted or stored insecurely. The safest approach is to use the method the recipient provides: their secure online portal, a phone call to their verified number, or an in-person visit. If someone asks you to email or text these details unprompted, that is a sign to verify their identity before you send anything.
The risk is not that your account number itself will drain your account — that requires additional information like your name, address, and often a PIN or password. The risk is that the person or system receiving it may not protect it, or may not be who they claim to be. A scammer posing as your bank, your employer, or a government agency can collect account numbers from dozens of people and use them to attempt unauthorised withdrawals, set up fraudulent direct deposits, or sell the information to others.
Key Takeaways
- Use the recipient's secure online portal, phone line, or in-person method whenever possible rather than email or text.
- Verify the recipient's identity by calling a number you find yourself — not a number they provided — before sending account details.
- Never send account details in response to an unsolicited email, text, or call, even if the sender claims to be from your bank or employer.
- If you accidentally send your account details to the wrong person or a scammer, contact your bank immediately to monitor for fraud.
When you initiate the contact yourself
If you are the one reaching out — to set up direct deposit with your employer, to pay a bill, to transfer money to someone — use the method the organisation has published on their official website or document. For employers, this is usually an online payroll portal or a form you fill out in person with HR. For bills, it is the company's website, their mailed invoice, or a phone number you call yourself. For peer-to-peer transfers, use an app like Venmo, PayPal, or your bank's own transfer tool rather than sharing raw account details.
When you use an official channel, the organisation has built in security: encrypted connections, password protection, and audit trails. Your account details go into a system designed to handle them, not into someone's email inbox where they might sit unencrypted or get forwarded to the wrong person.
When someone asks you to send details
If a person or organisation contacts you first and asks for your account number, routing number, or both, stop and verify their identity. Do not use any contact information they provided. Instead, look up the organisation's main phone number on their official website or your statement, and call to confirm the request is legitimate.
Real banks, employers, and government agencies rarely ask you to email or text sensitive account information. They have secure portals, phone systems, or in-person processes. If someone is pushing you to send details by email or text, or if they are creating pressure ("we need this today" or "this is your last chance"), that is a strong signal the request is fraudulent.
Scammers often impersonate the IRS, Social Security Administration, your bank, or your employer because people trust these organisations. They may spoof the phone number so it looks official, or send an email that looks like it came from a real domain. Verify by calling the organisation's main line yourself.
Secure methods for sending account details
| Method | When to use it | Security level |
|---|---|---|
| Organisation's online portal or app | Direct deposit, bill pay, account transfers | Highest — encrypted, password-protected, audit trail |
| Phone call to organisation's verified number | Any request where you initiate the call | High — no written record, real-time verification possible |
| In-person at a branch or office | Opening accounts, setting up services, disputes | High — identity verification, paper trail |
| Secure message through your bank's app | Communication with your own bank only | High — encrypted, tied to your authenticated account |
| Email or text | Only if the recipient has no other option and you initiated contact | Low — unencrypted, easily forwarded, no verification |
What to do if you sent details to the wrong person
If you realise you sent your account number and routing number to a scammer, a wrong email address, or an unsecured channel, contact your bank immediately. Call the number on the back of your card or on your statement — not a number the scammer provided. Tell them what information you sent and when.
Your bank can monitor your account for suspicious activity and may place a temporary hold or flag unusual transactions. They can also issue you a new account number if needed, though this is usually a last resort because it requires updating direct deposits, automatic payments, and other services. In most cases, monitoring is enough because your account number alone cannot drain your account — a thief would also need your name, address, and often additional verification.
File a report with the Federal Trade Commission at reportfraud.ftc.gov if you believe you have been targeted by a scam. This creates a record and helps law enforcement track patterns. If the scammer is impersonating a specific organisation, also report it to that organisation's fraud department.
Red flags that a request is not legitimate
Do not send account details if any of these are true: the person or organisation contacted you unprompted; they are asking you to email or text the information; they are creating urgency or pressure; they will not provide a callback number you can verify independently; they are asking for additional information like your PIN, password, or Social Security number; or the email address or phone number looks slightly off from what you remember (like "payro1l.com" instead of "payroll.com").
Legitimate organisations understand that account security is important and will not pressure you or ask you to use insecure methods. If you are unsure, hang up or close the email, look up the organisation's main number yourself, and call to ask whether the request was real.
Frequently Asked Questions
Is my account number the same as my routing number?
No. Your routing number identifies your bank (nine digits), and your account number identifies your specific account at that bank (typically 10 to 12 digits). Both appear at the bottom of your checks. You need both to set up direct deposit or automatic payments, but they serve different purposes.
Can someone drain my account with just my account number?
Not easily. Your account number alone is not enough to withdraw money. A thief would typically also need your name, address, and often a PIN or password, or they would need to set up an unauthorised direct debit and wait for it to process. Your bank's fraud protections usually catch these before the money leaves. If you are worried, call your bank to monitor your account.
What if my employer asks for my account details by email?
Call your HR department using a number from your employee handbook or the company directory — not a number in the email — and confirm the request is real. Many employers do collect account details by email, but it is worth verifying, especially if the email looks unusual or came from an unfamiliar sender. If it is legitimate, your employer should be able to confirm immediately.
Is it safe to send account details through my bank's app?
Yes, if it is your own bank's official app and you are sending the message to your bank's verified support team. The app encrypts the message and ties it to your authenticated account. Do not send account details through third-party messaging apps like WhatsApp or email, even if the recipient claims to be from your bank.
What should I do if I think I was scammed?
Contact your bank immediately using the number on your card or statement. Monitor your account for unauthorised transactions. File a report with the Federal Trade Commission at reportfraud.ftc.gov. If the scammer impersonated a specific organisation, report it to that organisation's fraud department as well. Keep records of all communications with the scammer.