Send your bank details only through secure channels, and only to organisations you initiated contact with
When you need to pay someone by bank transfer, you will have to share some of your banking information. The safest approach is to send details only through encrypted channels—never by email, text, or social media—and only to a recipient you contacted yourself, not someone who contacted you. If a company asks for your details, verify their identity first by calling a phone number from their official website or statement, not from any message they sent you.
The information most payments require is minimal: your account number, routing number (for US transfers), and your name as it appears on the account. You do not need to share your PIN, password, or the full card number if you are making a bank transfer. A legitimate organisation will never ask for those.
Key Takeaways
- Send bank details only through secure channels like your bank's app, a company's secure portal, or encrypted email—never through regular email, text, or social media.
- Verify the recipient's identity by calling a phone number from their official website or your statement before you share any details.
- A legitimate organisation will never ask for your PIN, password, online banking login, or full card number.
- If you receive an unsolicited request for bank details, treat it as a fraud attempt and report it to your bank immediately.
- Keep a record of where you sent your details and when, so you can dispute the transaction if something goes wrong.
Secure channels for sending bank details
Your bank's mobile app or online portal is the safest place to initiate a transfer. Most banks let you add a recipient and send money directly without ever typing your account number into an email or form. If the recipient is already set up in your bank's system, you simply select them and enter the amount.
If you must send details outside your bank, use a secure method. Many companies offer a secure portal or messaging system within their website—log in to your account with them and look for a "Send Payment" or "Payment Methods" section. Some organisations provide an encrypted email address or a secure form on their website. Ask the organisation which method they prefer before you send anything.
Avoid email, text message, social media, or phone calls to share account numbers. These channels are not encrypted and leave a record that a scammer could intercept. If someone asks you to email your bank details, that is a red flag—ask them for a secure alternative or reconsider whether you should be doing business with them at all.
What information to share and what to withhold
For a standard bank transfer, you typically need your account number, routing number, and the name on your account. Some organisations also ask for your address or phone number for verification. That is normal and safe to provide.
Never share your PIN, password, online banking login credentials, or the full card number (the 16-digit number on the front of a debit or credit card). Your bank will never ask for these. If someone requests them, hang up or close the message immediately and contact your bank directly using a phone number from your statement or website.
If you are paying by ACH transfer (a direct bank-to-bank transfer), you do not need your card number at all. If you are paying by credit or debit card, the merchant will ask for the card number, expiration date, and CVV (the three-digit code on the back). That is different from sharing your bank account details, and it is safe to provide to legitimate merchants.
Verify the recipient before you send anything
Scammers often impersonate legitimate companies by sending emails or texts that look official. Before you send any bank details, confirm you are actually talking to the organisation you think you are. Do not click a link in an email or text message to reach them.
Instead, find the phone number or website on your own—use a statement you received in the mail, a bill, or a search for the company's official website. Call that number and ask whether they need your bank details. If they do, ask them to send you a secure link or portal where you can provide the information. If the person on the phone cannot explain why they need your details or seems uncertain, hang up and call back using the main customer service number.
This step takes five minutes and prevents most fraud. Scammers rely on urgency and fear to skip this step, so if you feel rushed, that is another reason to slow down and verify independently.
What to do if you sent details to the wrong person
If you realise you shared your bank account number with someone you should not have, contact your bank immediately. Call the number on the back of your card or in your statement—do not use a number from the message that prompted you to send the details. Tell them what information you shared and when.
Your bank can monitor your account for suspicious activity and may be able to block transfers before they happen. They can also issue you a new account number if necessary, though this is usually a last resort. The sooner you report it, the more time your bank has to protect you.
If money has already been taken from your account without your permission, report it as fraud or an unauthorised transfer. Your bank has a process for disputing these transactions, and federal law limits your liability depending on how quickly you report it. Report within two business days and your liability is capped at $50; report within 60 days and it may be higher, but you still have protection.
Keeping records of payments you initiate
After you send your bank details and make a payment, keep a record of the date, the amount, the recipient's name, and the method you used (bank transfer, ACH, wire, etc.). If you used a secure portal, take a screenshot of the confirmation page. If you received a confirmation email, save it.
This record helps you if there is a dispute later. If the payment does not arrive, or if you are charged twice, you can show your bank exactly what you did and when. It also helps you spot fraud—if you see a charge you did not initiate, you can report it quickly because you know what you actually sent.
Keep these records for at least three months, longer if the payment is for something important like a loan or tax payment. Most banks keep transaction records for seven years, but having your own copy means you do not have to wait for them to look it up.
Frequently Asked Questions
Is it safe to send my account number by email?
No. Email is not encrypted and can be intercepted. Use your bank's app, a company's secure portal, or an encrypted email address the organisation provides. If someone asks you to email your account number, ask for a secure alternative or reconsider whether to proceed.
What if a company says they need my full card number to set up a bank transfer?
They do not. A bank transfer (ACH) uses your account number and routing number, not your card number. If they are asking for your card number, they are processing a card payment, not a bank transfer. Ask them which method they are using and whether a bank transfer is an option.
Can I dispute a payment if I sent my bank details to a scammer?
Yes, but timing matters. Report it to your bank within 60 days of the unauthorised charge. Federal law limits your liability, though the exact amount depends on how quickly you report it. Report within two business days and you are usually liable for no more than $50.
What should I do if I get a text asking me to confirm my bank details?
Do not reply or click any links. Contact your bank directly using the number on your statement or card. Legitimate banks do not ask you to confirm details by text. This is almost always a phishing attempt.
Is it okay to give my bank details over the phone if I called the company?
Yes, if you initiated the call to a number you found independently (not from an email or text). Verify the company's name and ask to speak with someone in the payments department. If anything feels off, hang up and call back using the main customer service number.