Every direct deposit form, rent portal and tax refund screen asks for the same two numbers, and most of us type them without a second thought. Then a stranger asks for them, or a payment lands in the wrong place, and the difference suddenly matters. This guide explains what each number does, where each one is used, and what you can do if either gets out.
The short answer

Routing number vs account number comes down to what each one names. A routing number is a nine-digit code that identifies your bank or credit union, and it is printed on every check, so it is not a secret. An account number identifies your specific account at that institution, and it is the sensitive piece. Together, the two numbers let someone deposit money into your account or attempt to pull money out of it.

Your biggest variable is who asked and why. The main risk is giving both numbers to someone who contacted you first. Before you share them, confirm the request through a channel you started yourself.

One names the bank, one names you. The routing number points to the institution. The account number points to your account inside it.

The routing number is public. It appears on every check your bank issues and in federal payment directories. Knowing it alone gives nobody access to your money.

The pair is what carries risk. With both numbers, a payer can send you money, and a bad actor can try to originate a debit. Treat the account number as the guarded half.

Your protections depend on the payment type. Unauthorized debits are usually covered by Regulation E if you report within 60 days of the statement. Wire transfers sit largely outside that rule.

Your bank may use more than one routing number. The number on your checks may not be the one it wants for an incoming wire. Get wire instructions from the bank itself.

If either number leaks, act the same day. Call the bank, ask about a new account number, and document the contact. Time limits start running when the statement is sent.

Routing Number vs Account Number: What Each One Identifies

Think of the pair as a two-part address. The first part tells the payment system which institution should receive the instruction. The second tells that institution which account inside it. Neither part works without the other, which is why forms ask for both.

The routing number names the institution

A routing number is a nine-digit code assigned to a financial institution. The Treasury Department’s guide to federal ACH payments describes it as the number used to denote which financial institution will receive the deposit. The IRS explains it as the number that identifies the location of the bank’s branch where you opened your account, so wording varies a little between agencies.

Because it names a bank rather than a person, thousands of customers share the same routing number. That is by design. It lets payment networks sort millions of instructions by destination.

The account number names your account

The account number identifies your account within the institution. It is the number that tells the bank which balance to credit or debit. Its length varies by bank, and your debit card number is a separate identifier that is not printed on your checks.

This is the number to guard. Chase puts it plainly on its check routing number page: the account number provides access to the funds in your account, so you want to keep it safe. Access here has a specific meaning. It does not let anyone log in. It lets a payment instruction find your balance.

Side-by-side comparison

The table below puts the two numbers on the same criteria. The row that matters most is the last one. A routing number is shared across customers, while an account number is unique to you, and that difference drives how carefully you should hand each one out.

CriterionRouting numberAccount number
What it identifiesYour bank or credit unionYour account at that institution
LengthNine digitsVaries by institution
Same for every customer?Largely yes (a bank may have several)No, unique to your account
Printed on checks?Yes, along the bottomYes, next to the routing number
Publicly listed?Yes, in bank and federal directoriesNo
SensitivityLow on its ownHigh, especially with the routing number
Needed to receive a deposit?YesYes
Same everywhere you bank?Not always, because large banks may hold severalOne per account

Large banks may hold more than one routing number, so a number saved in an old payroll file may not match what your bank shows today. When a deposit is rejected, compare the saved number with the one in your banking app first.

Related numbers that cause confusion

People mix up several numbers that sit close together on a check or in an app. The terminology table below separates them.

TermPlain-English meaningWhy it mattersCommon confusion
Routing number (ABA number, routing transit number)Nine-digit code for the institutionRequired for ACH, checks and domestic wiresThought to be your account’s secret code
Account numberIdentifies your accountRequired alongside the routing numberConfused with the debit card number
Check numberSequence number of one paper checkHelps you match and stop a specific checkMistaken for part of the account number
Debit card numberCard network identifierUsed for card purchases, not bank transfersEntered into direct deposit forms by mistake
SWIFT code (BIC)Identifier used for international wiresReplaces the routing number for wires abroadUsed for domestic transfers by mistake
MICR lineMagnetic ink numbers at the bottom of a checkMachines read it to route the checkRead as one long number

One bank’s help page says it plainly: a SWIFT code is used instead of a routing number for international wire transfers. A domestic wire still uses a routing number, so do not swap them.

Where to Find Your Routing Number and Account Number

You have four reliable places to look. A paper check is the classic one, but your banking app, a statement or a call to your bank can all confirm the same numbers. The right choice depends on what you have in your hand.

Where to find the routing number on a check

Turn the check over to the front and look at the strip of numbers along the bottom edge. The government’s own vendor payment instructions for the U.S. House say the nine-digit routing transit number can be found on the bottom of a check or deposit ticket. Wells Fargo’s help page describes the account number as sitting to the right of the routing number and to the left of the check number.

That order is typical, not universal. Some banks print the check number first, or add extra characters. Count the digits instead of trusting position. The routing number is always the group of exactly nine digits.

Check bottom strip with a nine-digit routing number, a longer account number and a short check number labeled
The routing number is the nine-digit group, and the account number sits beside it.

Banking app and online banking

Your bank’s app or website is often the fastest source, especially if you have no checks. The IRS notes that your account number can usually be found by signing in to online banking or by calling your bank branch. It also says most banks list their routing numbers on their websites.

Screen labels vary. Look for an “account details” or “account information” section. If you cannot find it, ask the bank’s secure message center rather than a general search engine.

Statements and deposit slips

A deposit ticket carries the same information as a check. Statements show your account number, though banks often mask part of it for security. Masked numbers are no use for a direct deposit form, so switch to the app or a check.

Bank routing number lookup: what to trust

A bank routing number lookup is useful when you have a name and need a number, or the reverse. The safest lookup is your own bank’s website. The Federal Reserve also runs the E-Payments Routing Directory, which gives basic routing details for Fedwire and FedACH transactions and is refreshed daily. The Fed built it for financial institutions and other authorized users, and its terms bar commercial reuse.

Third-party lookup sites are another matter. They may carry outdated entries, and some wrap their results in ads. If a site gives you a number and your bank’s website lists a different one, trust the bank.

SourceWhat it showsHow reliableWatch for
Paper checkRouting, account and check numbersHigh, if it is your own checkOld checks from a closed or merged account
Banking appRouting and full account numberHighLabels differ by bank
Bank website or secure messageRouting number, wire instructionsHighLook-alike sites that copy a bank’s design
StatementAccount number, often maskedMediumMasked digits
Federal Reserve directoryInstitution routing detailsHigh for institutionsBuilt for institutions, not a personal lookup
Third-party lookup siteRouting numbers by nameVariesOutdated or ad-driven pages

The takeaway from the table is simple. The closer a source sits to your own bank, the less you need to double-check it. Cloned bank sites are a real risk, and our guide to fake bank websites shows how to spot them.

When your bank has more than one routing number

Many people assume each bank has exactly one number. Chase states that large national banks may have multiple routing numbers, while some banks and credit unions have only one. Wells Fargo’s help page asks whether you will receive a wire before it shows a number. It also notes that customers who opened accounts in one region may see a different number on their checks.

So which routing number do you give for direct deposit versus a wire? Start with the number on your own checks for direct deposit and ACH. For an incoming wire, ask your bank for its wire instructions in writing. Some banks use a separate wire routing number, and the wrong one can delay the money.

Prepaid cards, apps and cash accounts

Not every account that carries numbers sits in a traditional checking account. The IRS says reloadable prepaid cards often have their own account and routing numbers, and the account number may differ from the card number. For mobile apps, it tells taxpayers to confirm with the app provider or the financial institution which numbers to use.

Wells Fargo’s page also lists a different routing number for its brokerage cash services. The lesson applies broadly. If an account is not a plain checking account, ask the provider which numbers it wants for deposits and which for wires. Our checking account guide covers how ordinary accounts differ from these products.

Which Number Goes Where: Direct Deposit, ACH and Wire Transfers

Direct deposits, bill payments, checks and wires all ask for the routing and account numbers. They do not travel the same way, though, and the rules that protect you change with each route. Knowing which route a request uses tells you how much risk you are accepting.

Direct deposit and other ACH credits

The Automated Clearing House (ACH) network moves most direct deposits. Nacha, which governs the network, explains the chain: the sender’s bank (the ODFI) bundles instructions, an ACH operator sorts them, and the receiving bank (the RDFI) posts the money to your account. The two operators are the Federal Reserve and The Clearing House.

A credit is a push. Your employer sends money to you, which is why payroll needs your routing and account numbers. Nacha estimates that 80% of ACH payments settle in one banking day or less. Credits can settle the same day, the next banking day or in two banking days.

Settlement is not the same as availability. How soon you can spend the money depends on your bank’s own funds-availability policy. If a deposit shows as pending, our guide to a pending bank transfer explains why.

ACH debits and autopay

A debit is a pull. A landlord, utility or lender collects money from you, using the same two numbers you gave them. Nacha notes that debits settle the same day or the next banking day. Handing over your numbers for autopay is effectively giving the payee permission to pull.

Federal rules put guardrails on that permission. Under Regulation E, 12 CFR 1005.10, a recurring electronic transfer from your account must be authorized by a writing signed or similarly authenticated by you, and the payee must give you a copy. You can stop a preauthorized transfer by notifying your bank orally or in writing at least three business days before the scheduled date. The bank can ask for written confirmation within 14 days of an oral request.

Table of five payment types showing the routing and account numbers each uses and the main protection that applies
Each payment type asks for the same pair, but the rules around it differ.

Domestic wire transfers

A wire moves money through a system such as Fedwire, and a completed wire is hard to recall. The CFPB warns that if money goes to the wrong account, you may not be able to get it back.

Wires also sit mostly outside the main consumer dispute rule. Regulation E, section 1005.3(c)(3) excludes transfers through Fedwire or a similar wire system used primarily for transfers between financial institutions or between businesses. The practical reading for you is that the Regulation E error-resolution process generally does not apply to the wire itself. Your bank’s wire agreement matters more.

International wires

International wires use a SWIFT code in place of a routing number, as one large bank’s help page puts it. The receiving country may also require extra details, so ask the receiving bank for its exact instructions. Most consumer wires to other countries count as remittance transfers under federal law. The CFPB’s money transfer FAQ says you have 180 days from the date the money was supposed to be available to report an error. That protection covers errors and failed delivery. It does not make a payment you chose to send reversible.

Checks, converted checks and tax refunds

Every check you write displays both numbers, which is why a check in the wrong hands is a risk. A merchant can also convert your check into a one-time ACH debit. Regulation E allows that only with your authorization and requires the payee to tell you the payment may be processed electronically.

Tax refunds follow stricter rules. The IRS says you should not request a deposit into an account that is not in your own name. Accepted accounts are in your name, your spouse’s name or a joint account with your spouse. The IRS also limits electronic refunds to three per account or prepaid card. Our guide to tax refund direct deposit mistakes walks through what to do when one goes astray. If you receive federal payments, our guide to the end of federal paper checks explains why accurate bank details matter.

UseRouting numberAccount numberExtra detailMain protection
Direct deposit (ACH credit)YesYesEmployer’s authorization formBank policy, ACH network rules
Autopay or bill pay (ACH debit)YesYesYour signed or authenticated authorizationRegulation E, stop-payment right
Paper check you writeYes (printed)Yes (printed)Check number, signatureDeposit agreement, state law
Check converted to ACHYesYesNotice and your authorizationRegulation E
Domestic wireYes (wire number may differ)YesBeneficiary name, bank wire instructionsMostly your bank’s wire agreement
International wireSWIFT code insteadYes, or similarCountry-specific detailsRemittance rules for covered transfers
IRS tax refundYesYesAccount in your name, spouse or jointIRS procedures, Form 3911 trace

Read the last column first. A debit you authorized has a built-in stop-payment right, but a wire has almost none. That asymmetry is why the same request deserves a different level of caution depending on the route.

Is It Safe to Give My Account Number? A Risk Breakdown by Who Is Asking

The honest answer is that it depends on who asks and what they can do with it. Your routing number alone carries almost no risk. Your account number alone is more sensitive. The pair is what a payment system needs to move money, so the pair deserves the same care you would give a signed blank check.

What the two numbers can and cannot do

Together, the numbers let a payer deposit money into your account, and they let a payee request a debit. Whether a debit is legitimate depends on the authorization behind it. Fraudsters submit debit requests they have no right to make, and the numbers are all they need to try.

The numbers alone do not give anyone your online banking password, your debit card or your ATM access. That is why the risk is real but narrower than the panic version of the story.

Checks add a second route. A remotely created check is one that does not bear your signature, and the Federal Reserve’s check rules treat it specially. Under 12 CFR 229.34, the bank that transfers or presents the check warrants that the account holder authorized it in the amount and to the payee stated. In telemarketing, the FTC’s Telemarketing Sales Rule treats creating a remotely created payment order as an abusive practice.

Who is asking: a risk matrix

The risk level in this table is Banktimer’s editorial judgment, not a regulator’s rating. Use it as a starting point, then apply the four-question test below.

Who asksWhy they askNeeds both numbers?Risk levelSafer step
Your employer’s payroll teamTo send your payYesLow if you started the hireUse the company’s official portal or HR contact
Landlord or property managerTo collect rent by ACHYesMediumUse the management company’s own portal; keep the authorization copy
Utility, insurer or lenderTo set up autopayYesMediumEnter numbers on the provider’s own site, not through a link
Tax preparer or the IRSTo deposit a refundYesMediumConfirm both numbers with your bank before filing
A friend sending you moneyTo pay you backOften notLow to mediumAsk which payment method they prefer; share only if you want ACH
A buyer or seller on a marketplaceTo “complete” a saleRarelyHighUse the platform’s payment tools
A caller claiming to be your bankTo “verify” or “reverse” somethingNoHighHang up and call the number on your card
A new “employer” asking before hiringTo “set up payroll”No, not yetHighWait for a verified offer and a documented process

The pattern is consistent. Low-risk requests come after you started the relationship and arrive through a channel you can verify. High-risk requests arrive unprompted and carry urgency. For more on the second type, see our guide to the bank impersonation scam.

A four-question test before you share

This is the decision framework we suggest. It takes about thirty seconds.

  1. Did I start this contact? If someone called, texted or emailed you first, stop and verify the request independently.
  2. What permission am I granting? A deposit form lets money in. Autopay lets money out on a schedule. Know which one it is.
  3. Does the recipient really need both numbers? Many payers can use a link, a card or a payment app instead.
  4. Can I get proof? Ask for a written authorization copy. Regulation E requires the payee to give you one for recurring debits.

If any answer is uncertain, pause. A legitimate payee will wait while you confirm. A scammer will not.

Four numbered questions leading to three outcomes: share, verify first, or refuse a request for bank numbers
Four questions sort most requests into share, verify first, or refuse.

Everyday ways the numbers get exposed

Most exposure is mundane. A voided check emailed to a payroll mailbox, a photo of a check posted to ask a question, and a paper check dropped in a mailbox all show both numbers. Mobile deposit adds another copy: our guide to mobile check deposit covers how to store and destroy check images safely.

Mailed checks carry the most obvious risk. Our article on mail theft and stolen checks explains why a stolen check can be altered or copied.

What FDIC insurance does and does not do

Many people assume deposit insurance protects them if someone drains the account. It does not work that way. The FDIC describes deposit insurance as protection for your insured deposits if your bank fails, up to $250,000 per depositor, per insured bank, for each account ownership category. The OCC’s HelpWithMyBank site says deposit insurance does not cover losses due to theft or fraud. Protection from fraud comes from federal rules such as Regulation E and from your bank’s agreement. Our FDIC insurance limits guide explains the failure side in detail.

ACH Fraud With an Account Number: Your Rights and Deadlines

If someone debits your account without permission, federal law gives you real protection, and the clock matters. The rules differ depending on whether a card was stolen, only the numbers were taken, or you sent the payment yourself. This section separates those cases so you know which one you are in.

What counts as an unauthorized transfer

Regulation E defines an unauthorized electronic fund transfer as one initiated by a person other than the consumer without actual authority and from which the consumer receives no benefit. The CFPB’s electronic fund transfer FAQs go further. They say that when a consumer is fraudulently induced into sharing account access information, a transfer the scammer then makes with it is an unauthorized transfer under Regulation E.

That covers a caller who poses as your bank and talks you into reading out numbers. It does not cover a payment you start yourself. Regulation E counts only transfers initiated by someone other than you. On our reading, a transfer you send yourself, even while deceived, falls outside that definition. Your bank may still help, but the law does not require it. Our guide to the bank impersonation scam covers that gray zone.

Two liability ladders: stolen card versus stolen numbers

The deadlines differ depending on whether an access device was involved. Under 12 CFR 1005.6, if a card or code is lost or stolen and you tell the bank within two business days of learning of it, your liability is the lesser of $50 or the unauthorized transfers made before notice. Wait longer, and the cap rises to $500. After 60 days from the statement date, you can be liable for later transfers the bank shows would have been prevented by timely notice.

When no access device was used, the CFPB’s official interpretation of section 1005.6 says the first two tiers do not apply. The comment gives the example of a transfer made using only an account number. You are protected as long as you report within 60 days of the statement. If you miss the window, you may be liable for transfers that happen after day 60 and before you report.

Two columns comparing Regulation E liability for a stolen debit card with fraud that uses only an account number
Account-number fraud follows a 60-day rule, while a stolen card adds $50 and $500 tiers.

Two things that cannot raise your liability

Two additional rules help you. The CFPB comments say negligence by the consumer, such as writing a PIN on a card, cannot be the basis for imposing greater liability. They also say no agreement between you and the institution can impose greater liability than Regulation E allows. A deposit agreement that tries to shift more of the loss to you does not override the federal limits. If the delay was due to extenuating circumstances such as a long hospital stay, the bank must extend the time limits to a reasonable period.

Worked scenarios: card versus numbers

The numbers below are illustrative, and we computed them in a script. Each assumes you report the problem as described and that the bank meets its investigation duties.

ScenarioWhat happenedYour reportLiability under Regulation EWhy
A: numbers only, on time$187.00 debit on October 20, 2026; statement sent November 5, 2026By January 4, 2027$0Reported within 60 days of the statement
B: numbers only, lateSame $187.00 debit, then $312.40 on January 6, 2027; first report on January 8After day 60Up to $312.40Later debit fell after the 60-day window and before notice
C: card stolen, fast report$300.00 charged on day 1Within 2 business days$50.00Lesser of $50 or the loss before notice
D: card stolen, slow report$300.00 on day 1, $800.00 on day 4, reported on day 6After 2 business daysUp to $500.00Cap rises to $500 on late notice
E: numbers only, same debits as D$300.00 and $800.00Within 60 days of the statement$0No access device, so the $50 and $500 tiers do not apply

Scenarios B and E carry the lesson. Reporting inside the 60-day window is what decides the outcome when only your numbers were used. Scenario B also shows how the January 4, 2027 deadline came from counting 60 days from the November 5 statement date, not from the date of the debit.

Investigation and provisional credit

Once you report, the clock moves to your bank. Under 12 CFR 1005.11, it must determine whether an error occurred within 10 business days of receiving your notice. If it needs more time, it must provisionally credit the disputed amount within those 10 business days. It may then take up to 45 days from receipt of the notice to investigate. The period is 90 days for certain transfers, including point-of-sale debit transactions, transfers not initiated within a state and transfers within 30 days after the account’s first deposit. For new accounts the initial period is 20 business days.

The CFPB also notes a catch. A bank may skip the provisional credit if you reported by phone and did not confirm in writing within 10 business days when it asked you to. After the investigation, the bank must report the results within three business days.

StageTypical timingWho controls itYour action
Report the problemAs soon as you see itYouCall, then confirm in writing
Initial decisionWithin 10 business days (20 for new accounts)BankKeep your reference number
Provisional creditWithin 10 business days if the bank needs more timeBankCheck the credit posted
Full investigationUp to 45 days (90 in certain cases)BankAnswer requests fast
Written resultsWithin 3 business days of finishingBankSave the letter

If you report on Monday, November 9, 2026, 10 business days lands on November 23 when no holidays are counted. It lands a day later if your bank treats Veterans Day as a non-business day. Forty-five days from that report is December 24, 2026, and 90 days is February 7, 2027.

Checks and wires follow different rules

Check fraud runs on state law and your deposit agreement instead of Regulation E. The Uniform Commercial Code, as enacted in your state, expects you to examine statements with reasonable care and promptness. The New York version we read bars a customer who fails to report an unauthorized signature or alteration within one year, and it limits claims on repeat items to a shorter period. Other states differ, and your deposit agreement may set its own deadline, so read it.

For wires, move immediately. The FTC says to report it to your bank or credit union right away and ask them to reverse the payment. That request is worth making, but the bank is not required to succeed.

RuleApplies whenExceptionSourceYour action
60-day reporting windowUnauthorized debit appears on a statementExtended for extenuating circumstances12 CFR 1005.6(b)(3)Review each statement within days
$50 then $500 tiersA card or code is lost or stolenNot applicable to account-number-only fraud12 CFR 1005.6(b)(1), (2)Report a lost card within 2 business days
10-business-day investigationYou give notice of an error20 business days for new accounts12 CFR 1005.11Keep a reference number
Stop payment on recurring debitsPreauthorized transferNeeds notice 3 business days before the date12 CFR 1005.10(c)Call early, confirm in writing
Wire exclusionFedwire or similar wireRelated ACH credits may be covered12 CFR 1005.3(c)(3)Act the same day
Remittance error windowConsumer wire to another countryCovered providers onlyCFPB money transfer FAQReport within 180 days
Check statement dutyForged or altered checkVaries by state and agreementState UCC Article 4Read your agreement

Scams That Go After Your Routing and Account Numbers

Scammers rarely need to hack anything when you will hand over the numbers yourself. The pitch changes, but the ask is the same: get both numbers, or get you to deposit a check and send money back. Knowing the common scripts lets you spot the ask before you answer it.

“Payroll setup” and fake job offers

A new job needs your direct deposit details, so the ask sounds routine. That is the cover. The FTC warns that if you gave your personal information thinking it was for payroll, you may now have an identity theft problem. It also says no honest potential employer will send you a check to deposit and ask you to send part of the money back.

A real employer completes its hiring steps first. It gives you a formal offer, uses a verified HR or payroll system, and collects banking details after you accept. If the order is reversed, slow down.

Calls and texts from your “bank”

Impersonators claim a debit is pending, a deposit is flagged or your account is locked, and they need to “verify” your numbers. The FTC says honest organizations won’t call, email or text to ask for personal information, and it lists bank account numbers among the details to protect. The FDIC’s consumer newsletter says the agency would never contact you asking for personal details such as bank account information.

Your bank already has your numbers. A caller who asks you to read them back is the red flag. Hang up and call the number on the back of your card. Our guide to bank phishing texts shows what the messages usually look like.

Fake checks and overpayments

In a fake check scam, someone sends you a check, asks you to deposit it and wants part of the money returned by wire, gift card or app. The check may appear to clear. Later it bounces, and the bank can ask you to repay the full amount, as the FTC warns. For why a deposit can look available before it is final, see our explainer on check clearing time.

The FTC also names the payment methods scammers push: wire transfers, payment apps, gift cards and cryptocurrency. If a stranger insists on one of these, treat that as the warning. Our payment app scam guide covers the app variety.

Red flags and safer moves

The table pairs each red flag with a question to ask and a safer next step.

Red flagWhy it mattersWhat to askSafer next step
Unsolicited call or text asking you to “confirm” numbersYour bank already has themWho exactly are you, and what is your callback number?Hang up; call the number on your card
A new employer who needs numbers before a formal offerReal hiring comes firstIs there a written offer and official HR contact?Wait for a verified offer
A check you must deposit, then send back partThe check can bounce after you send moneyWhy can’t you keep the extra money?Do not deposit; report it
Insistence on a wire, gift card or cryptoHard to reverseCan I pay another way?Use a payment method with dispute rights
Pressure to act in minutesUrgency blocks verificationWhat happens if I call back tomorrow?Pause; verify independently
A link to a “secure” form that asks for full numbersCould be a look-alike siteIs the address one I typed myself?Go to the provider’s site directly
A request for a photo of a check “to verify”The image shows both numbersWhy do you need the image?Offer a bank-issued direct deposit form instead
Red flag: you did not start the contact

If someone called, texted or emailed you first and asks for your account number, assume it is unsafe until you verify them yourself. Using a number or link they supply defeats the verification. Look up the organization’s contact details independently, or use the app you already trust.

What a leak actually enables

Not every leak is equally serious. The next table shows what each exposed item can and cannot do, and how fast we suggest you act. The urgency column is Banktimer’s editorial judgment.

What leakedWhat it can enableWhat it cannot do aloneUrgencyFirst step
Routing number onlyNothing meaningful on its ownMove money or reach your accountLowNone needed
Account number onlyClose to the pair, because routing numbers are public and easy to match to your bankLog in or use your cardMedium to highWatch activity; ask about a new account number
Both numbersAttempted ACH debits, remotely created checksLog in or use your cardHighCall the bank the same day
Both numbers plus login detailsAccount takeover, transfers outLittle is off the tableVery highLock the account; change credentials
A photo of a checkBoth numbers plus your signatureLog in or use your cardHighCall the bank; ask about a new account number
Debit card numberCard purchasesDirect ACH debits by itselfHighFreeze or replace the card

Notice that your routing number alone sits at the bottom of the urgency scale. People often worry about the wrong half. Because routing numbers are public, an exposed account number deserves nearly the same response as the pair.

If Your Numbers Got Out: The First Hour, the First Day and the First Week

Exposure feels urgent because it is. You do not need to panic, though, because a short sequence of calls handles most cases. The priority is to put your bank on notice, because that starts the regulatory clock in your favor.

The first hour

Start with the bank, not the person who asked. Call the number on the back of your card or use the secure message center in your app. Tell the representative that you shared your routing and account numbers with someone you now doubt, or that you see a debit you did not authorize. Then ask four things.

  • Can you review pending and recent ACH activity on the account?
  • Can you block or flag incoming ACH debits while we sort this out?
  • Can you issue a new account number, and how long does it take?
  • What reference number or case ID will you give me?

Write down the date, time, name and reference number. If you have already sent money to a scammer by wire, say so right away and ask for a recall request. That call matters more than any other step.

The first day

Follow up in writing. The CFPB notes that a bank may skip the provisional credit if you reported by phone and did not confirm in writing within 10 business days after it asked. Send a short message through the secure channel, or mail a letter, describing the transactions.

If you gave a scammer your online login, the FTC advises changing your password right away and turning on two-factor authentication. Report the scam at ReportFraud.ftc.gov. If your Social Security number was involved, report at IdentityTheft.gov. Our identity theft recovery plan covers the next steps, and the debit card fraud recovery guide covers the card side.

Three-step flow: call the bank in the first hour, confirm in writing on day one, repair payments in week one
Call the bank first, confirm in writing, then fix the downstream payments.

The first week

Use the week to repair what the incident touched. Review every transaction since the exposure. Update autopay and payroll if your bank issues a new account number. Keep copies of everything. If the bank denies a claim, ask for the findings in writing, because Regulation E requires the bank to report its results.

TimingActionWhy it mattersEvidence to keep
Hour 1Call the bank; ask for review and a blockStarts the clock and limits new debitsDate, time, rep name, case ID
Hour 1If a wire went out, request a recallSpeed is the only chanceWire confirmation, recall request
Day 1Confirm in writingPreserves provisional credit rightsCopy of message or letter
Day 1Report to the FTC; change credentialsCreates a record and closes login gapsReport number
Day 2 to 3Review all activity; log disputed itemsBuilds the dispute listStatement excerpts, screenshots
Week 1Decide on a new account numberEnds exposure from the old pairBank confirmation of the change
Week 1Update payroll and autopayAvoids rejected deposits and late feesUpdated authorizations
Statement cycleRead the next statement closelyThe 60-day window runs from the statementMarked-up statement

Should you change your account number?

Often, yes, if both numbers were exposed to someone you cannot trust. A new number cuts off debits tied to the old one. The cost is the cleanup. Every employer, landlord and utility that holds the old number must get the new one, and checks you wrote against the old number may be returned.

Banks handle this differently. Some can reissue a number on the same account, while others ask you to open a new account and move your money. Ask which applies, how long it takes, and whether pending items carry over. Our overdraft fees guide explains what a returned payment can cost, so line up your payees before the old number stops working.

What a credit freeze does and does not do

People sometimes reach for a freeze. A credit freeze controls who can see your credit reports, so it helps against new credit accounts. It does not stop a debit from an existing bank account. Our comparison of a credit freeze and a fraud alert explains the difference.

Some banks also let you restrict ACH debits to payees you approve in advance. Features like that vary by institution, so ask what yours offers. If someone has already taken over the account itself, read our guide to bank account takeover for the harder cases.

Documents to keep

DocumentWhy it mattersWhere to get itHow long to keep it
Case or reference numberProves when you reportedThe bank rep or secure messageUntil the dispute closes
Written dispute confirmationKeeps provisional credit rightsYour letter or message copyUntil the dispute closes
Statements showing the debitsShows the 60-day timelineBank portalAt least until final resolution
Screenshots of messages from the scammerEvidence for the bank and the FTCYour phone or emailUntil the case closes
FTC reportOfficial record of the scamReportFraud.ftc.govKeep a copy permanently
Findings letter from the bankRequired at the end of the investigationBank mail or portalKeep permanently

Typos and Wrong-Account Mistakes That Cost Real Money

Not every loss involves a criminal. Plenty of money goes astray because someone typed a digit wrong or pasted the wrong number. Here is how those mistakes happen, which ones the system catches, and which ones it does not.

Why a mistyped routing number usually gets caught

The ninth digit of a routing number is a check digit. The Treasury’s ACH guide labels it as the ninth digit of the institution’s routing number. Systems use that digit to test whether the other eight look valid. Under the common weighting of 3, 7 and 1 across the nine digits, a valid number produces a total that ends in zero.

We ran the math on an invented number, 123456780, which does not belong to any bank. Its weighted total is 150, so it passes. Change any single digit and the total no longer ends in zero. Across 1.62 million single-digit errors we simulated, every one failed the test.

Swapped neighbors fare worse. About 89% of swaps of two different adjacent digits fail the test, but about 11% pass, because digits that differ by five can trade places without changing the total. A passing number can still be wrong.

Why an account number typo is riskier

Account numbers follow each bank’s own format, and there is no single check that works for all of them. A typo can therefore produce a number that is valid but belongs to someone else. The CFPB’s advice is blunt: double-check account and routing numbers before sending, because if money goes to the wrong account, you may not be able to get it back. It also tells senders to spell the recipient’s name exactly as it appears on their account.

How closely the receiving bank compares the name to the number varies by institution and payment type. Do not assume that a name mismatch will stop a payment.

Worked scenarios

Each example below is illustrative and uses invented amounts.

Illustrative example: a payroll deposit with one wrong digit

A new hire types her account number into the payroll portal with the last two digits swapped. Her net pay is $2,150 per paycheck, and she is paid 26 times a year, so one missed deposit is about 3.8% of her annual take-home of $55,900. The first deposit is either returned to the employer or posted somewhere unintended. She calls payroll the same day, confirms the number against her banking app and asks for a corrected deposit or a replacement check. Checking the number against the app before submitting would have avoided the delay.

Illustrative example: a $9,800 wire with the wrong account number

A buyer wires $9,800 for a deposit on a rental and later spots a transposed digit in the account number on her confirmation. She calls her bank that hour, reports the error and asks for a recall. The FTC’s advice for a transfer that went wrong is to contact the bank immediately and ask for the payment to be reversed. Whether the money returns depends on whether it has already posted to the other account and what the other bank agrees to do. A confirmation call to the payee, using a number she already trusted, would have caught the error before the wire.

Illustrative example: stopping a $1,450 rent debit

A tenant’s rent of $1,450 is scheduled to debit on Monday, December 14, 2026. He is moving rent autopay to a new account and wants the old debit stopped so the rent is not paid twice. Regulation E requires notice at least three business days before the scheduled date, so he must give it no later than Wednesday, December 9. If he calls on Tuesday, December 8, the bank can ask for written confirmation within 14 days, by December 22, and he should send it the same day.

MistakeWhat it can costBetter move
Typing numbers from memoryA rejected or misdirected paymentCopy them from your app or a check
Using the debit card number in a direct deposit formA rejected depositUse the routing and account numbers, not the card number
Using an old routing numberDelays, returned depositsRe-check the number against your bank’s current listing
Sending a wire without a call-back verificationIrreversible loss in some casesConfirm instructions by phone with a trusted number
Emailing a photo of a checkExposes both numbers and your signatureUse a bank-issued deposit form or a secure portal
Waiting for the next statement to report a debitLost time on the 60-day clockCheck activity weekly and report at once
Ignoring tiny unfamiliar debitsThey are still errors, and silence delays your reportDispute small unfamiliar debits too
Skipping the written follow-upPossible loss of provisional creditConfirm any phone report in writing

What to do if money lands in your account by mistake

Sometimes the error runs the other way and a stranger’s payment arrives in your account. Do not spend it. Contact your bank, explain what happened and let them handle the return. Our guide to money deposited by mistake covers your obligations and what to document.

Joint accounts, credit unions and the same numbers

Two people on a joint bank account share one account number, so either owner’s exposure affects both. Credit unions use routing numbers too. Chase’s description of a routing number covers a bank or a credit union, and our guide to credit unions versus banks explains where their rules differ.

Safer Alternatives to Handing Over Your Numbers

You can often avoid sharing both numbers at all. Whether you should depends on whether the other side needs to push money to you, pull money from you or simply get paid. The best alternative changes with that job.

Paying someone: ACH debit versus a card

When you pay by ACH debit, the money leaves your bank account. If something goes wrong, you are asking for money back. When you pay by credit card, the money is the card issuer’s until you pay the bill. Under Regulation Z, section 1026.13, a billing error notice must reach the issuer within 60 days of the first statement that shows the error. You need not pay the disputed portion while it investigates.

That is a structural difference, not a guarantee. It explains why a one-time online purchase from an unfamiliar seller is a better fit for a card than for your bank numbers. Our credit card basics guide covers how cards work.

Getting paid: forms, portals and payment links

If a payer only needs to send you money, offer the least you can. Many banks provide a pre-filled direct deposit form inside the app or online. A form from your own bank is cleaner than a voided check, which also shows your check number and the layout of your checks.

For one-time payments from a friend or a customer, a payment link or app avoids sharing your account number at all. Apps have their own scam patterns, so read our payment app scam guide first.

Comparing the alternatives

AlternativeCostFlexibilityMain riskBest fit
Give routing and account numbersUsually freeHigh for recurring paymentsExposes the pairPayroll, rent, trusted autopay
Bank-issued direct deposit formUsually freeGood for employersA copy of the form still shows your numbersNew job or benefits setup
Pay with a credit cardPossible interest if unpaidGood for one-time purchasesCard number exposure insteadOnline purchases from new sellers
Payment app or linkFees vary by providerGood for one-time transfersApp-specific scamsSplitting costs, small payments
Check by mailPostage and timeLowShows both numbers to everyone who touches itLast resort for small payees
WireFees vary by bankLimitedHard to recallLarge one-time payments to verified parties

The table shows a trade-off with no free lunch. Every method moves the exposure to another place. The lowest-risk choice is usually the method that keeps your account details with your own bank and puts a verified intermediary in the middle.

Setting up direct deposit safely

For a new job, use this sequence.

  1. Complete the offer and onboarding in the company’s official system.
  2. Open your banking app and copy the routing and account numbers yourself.
  3. Enter them in the employer’s portal, not in an email or a text.
  4. Review the confirmation screen for the last four digits.
  5. Ask payroll to confirm the first deposit date.
  6. Check your account on that date and keep the pay stub.

If your employer asks for a voided check, send it through the secure portal. Never email a photo of a check to an address you cannot verify.

Questions to Ask Before You Share Your Numbers

Specific questions beat general caution. Use this checklist whenever someone asks for your routing and account numbers.

Questions to ask before you share your routing and account numbers
  • ☐ Did I start this contact, or did they?
  • ☐ Am I giving permission to deposit, to withdraw, or both?
  • ☐ Is a one-time payment link or card an option instead?
  • ☐ Will I get a written copy of the authorization?
  • ☐ How do I cancel, and how much notice do I have to give?
  • ☐ Which routing number does my bank want for this use, a deposit or a wire?
  • ☐ Is the number I am copying from my own banking app or check?
  • ☐ Who else will see this form, email or image?
  • ☐ What will I do if the first transaction looks wrong?

Print the checklist or save it in your notes app. Run through it before every new autopay, new employer or wire. The questions take less than a minute, and they are cheaper than a dispute.

The “which number for which job” decision rule

We suggest one more rule of thumb. If the job is to receive money, give the least you can. If the job is to be paid on a schedule, give the numbers only to a payee you verified and hold the authorization copy. If the job is a large wire, call the recipient on a number you already trust before you send. When more than one rule fits, follow the stricter one.

Frequently Asked Questions

What is the difference between a routing number and an account number?

A routing number is a nine-digit code that identifies your bank or credit union. An account number identifies your specific account at that institution. Payments need both, because the first sends the instruction to the right institution and the second sends it to the right account. The routing number is shared and public, while the account number is unique to you and should be guarded. Our banking terms glossary defines the other words you will see on forms.

Where do I find the routing number on a check?

Look along the bottom edge of the check. The routing number is the group of exactly nine digits. The account number usually sits to its right, followed by the check number, though some banks print them in a different order. If the digits are hard to read or you have no checks, open your banking app or call your bank. Do not rely on a random website to tell you.

Is it safe to give my account number to an employer?

Usually yes, if you started the relationship and you are using the employer’s official payroll system. Direct deposit lets money in. The real risk is a fake employer that asks for the numbers before a verified offer. The FTC says no honest employer will send you a check to deposit and ask you to send part back. Confirm the offer, the contact and the portal before you type anything.

Can someone steal money with just my routing and account number?

They can try to originate a debit or write a check against your account, and sometimes that works for a short time. The numbers do not give anyone your online login or your card. Regulation E treats a debit you did not authorize as an unauthorized transfer. Report it within 60 days of the statement date and you are generally protected from liability for it. See our overview of ACH transfer problems for the process.

Is the routing number the same for direct deposit and for a wire?

Not always. The number on your checks is usually the one to give an employer or biller for direct deposit and ACH. Some banks publish a separate routing number for incoming wires, and large banks may hold several numbers. Ask your bank for wire instructions in writing before you give them to a sender. International wires use a SWIFT code instead of a routing number.

Is a routing number a secret?

No. A routing number is printed on every check the bank issues, listed on bank websites and included in Federal Reserve directories. It identifies the institution, not you. Knowing it by itself does not let anyone reach your account. Keep your attention on the account number, and on any request that asks for both numbers together.

How do I do a bank routing number lookup safely?

Use your own bank’s website, your banking app or a check. The Federal Reserve’s E-Payments Routing Directory is updated daily, but it is designed for financial institutions and other authorized users. Third-party lookup sites can be outdated, so cross-check any number against your bank before you use it. If two sources disagree, trust the bank.

What should I do if I gave my account number to a scammer?

Call your bank right away, using a number you trust. Ask it to review activity, block ACH debits and issue a new account number. Follow up in writing, because a bank can skip provisional credit if you do not confirm a phone report in writing when asked. Then report the scam at ReportFraud.ftc.gov. Our identity theft recovery plan covers the later steps.

Will my bank refund an unauthorized ACH debit?

If you report it in time, it generally must investigate under Regulation E. The bank has 10 business days to decide or provisionally credit you, and up to 45 days to finish, or 90 days in certain cases. When only your numbers were used, the key deadline is 60 days from the statement. Our summary of Regulation E explains the rules in more depth.

Is my debit card number the same as my account number?

No. The debit card number is a card-network identifier used for purchases. The account number, with the routing number, is used for transfers and checks. Prepaid cards can blur the line, since the IRS notes that the account number may differ from the card number. If you are filling out a direct deposit form, use the routing and account numbers, not the card number. If the card number was exposed, see our guide to debit card fraud.

Can I change my account number without closing my account?

Some banks can reissue a number on the same account, and others require you to open a new account. Policies and timing vary, so ask before you commit. Update every payroll, autopay and deposit instruction at the same time, and keep the old account open until pending items clear. Otherwise a returned payment can add fees on top of the bill.

Can I get money back from a wire sent to the wrong account?

Sometimes, but not reliably. Call your bank immediately and ask it to request a recall. The CFPB warns that if money goes to the wrong account you may not be able to get it back, and Regulation E’s dispute process generally does not cover a Fedwire transfer. Speed and documentation are your best tools. Most consumer wires abroad follow separate remittance rules with a 180-day error window.

Your next step

Open your banking app today and copy your routing and account numbers into a secure note. Compare them with what each employer and biller holds. That check takes ten minutes and tells you whether any old payee is still using a number that has changed.

Banktimer Bottom Line

The variable that decides how safe your numbers are is who asked and who started the conversation, not which number you hand over. The routing number is public and identifies only your bank. The account number identifies you, and together the two let a payee try to pull money from your account. Share them only with payers and payees you verified through a channel you opened yourself, and keep a copy of any authorization you sign. If either number leaks, call your bank the same day, confirm in writing and watch the 60-day statement window. This guide does not cover how your own bank handles wires, funds holds or account number changes, because those policies vary by institution, so ask for the terms in writing before you rely on any of them.

Methodology

We built this guide from primary and official sources and checked each cited page on October 15, 2026. The liability and investigation rules come from the CFPB’s text and official interpretations of Regulation E (12 CFR part 1005). ACH mechanics come from Nacha and the Treasury’s federal ACH guide. Refund rules come from the IRS. Scam guidance comes from the FTC, and deposit insurance wording comes from the FDIC and the OCC’s HelpWithMyBank site.

Two bank help pages (Chase and Wells Fargo) are cited only for how large banks describe their own routing numbers. All dollar scenarios, the payroll and wire examples, the invented routing number and the 60-day dates are illustrative assumptions computed in a script, not quotes or real accounts. The check digit weighting is the common industry method, shown as our own calculation on an invented number. State law, deposit agreements and bank wire practices vary, and each bank sets its own rules for account number changes. We did not test any bank, form or lookup tool.

Sources

About this article

By the Banktimer Editorial Team · Published

Banktimer is an independent U.S. consumer-finance publication. Our editors draw on primary and official sources first, such as the CFPB, FDIC, Federal Reserve, and FTC, along with statutes, regulations, and providers’ own agreements and fee schedules. Then we add worked examples and decision tools. Our goal is the most useful, best-supported explanation the sources available to us at the time of writing allow.

This article is general information, not legal, tax, investment, insurance, or financial advice, and reading it does not create a professional relationship with Banktimer. Rates, fees, limits, and rules change, and they vary by state, provider, and contract, so confirm current terms with your bank, lender, insurer, or the agency named in the article before you act. Examples are illustrative unless labeled otherwise. Banktimer is not a bank, lender, insurer, or financial advisor, and we are not responsible for decisions or losses that result from relying on this content. For advice about your own situation, talk to a licensed professional.