Routing number vs account number comes down to what each one names. A routing number is a nine-digit code that identifies your bank or credit union, and it is printed on every check, so it is not a secret. An account number identifies your specific account at that institution, and it is the sensitive piece. Together, the two numbers let someone deposit money into your account or attempt to pull money out of it.
Your biggest variable is who asked and why. The main risk is giving both numbers to someone who contacted you first. Before you share them, confirm the request through a channel you started yourself.
One names the bank, one names you. The routing number points to the institution. The account number points to your account inside it.
The routing number is public. It appears on every check your bank issues and in federal payment directories. Knowing it alone gives nobody access to your money.
The pair is what carries risk. With both numbers, a payer can send you money, and a bad actor can try to originate a debit. Treat the account number as the guarded half.
Your protections depend on the payment type. Unauthorized debits are usually covered by Regulation E if you report within 60 days of the statement. Wire transfers sit largely outside that rule.
Your bank may use more than one routing number. The number on your checks may not be the one it wants for an incoming wire. Get wire instructions from the bank itself.
If either number leaks, act the same day. Call the bank, ask about a new account number, and document the contact. Time limits start running when the statement is sent.
Routing Number vs Account Number: What Each One Identifies
Think of the pair as a two-part address. The first part tells the payment system which institution should receive the instruction. The second tells that institution which account inside it. Neither part works without the other, which is why forms ask for both.
The routing number names the institution
A routing number is a nine-digit code assigned to a financial institution. The Treasury Department’s guide to federal ACH payments describes it as the number used to denote which financial institution will receive the deposit. The IRS explains it as the number that identifies the location of the bank’s branch where you opened your account, so wording varies a little between agencies.
Because it names a bank rather than a person, thousands of customers share the same routing number. That is by design. It lets payment networks sort millions of instructions by destination.
The account number names your account
The account number identifies your account within the institution. It is the number that tells the bank which balance to credit or debit. Its length varies by bank, and your debit card number is a separate identifier that is not printed on your checks.
This is the number to guard. Chase puts it plainly on its check routing number page: the account number provides access to the funds in your account, so you want to keep it safe. Access here has a specific meaning. It does not let anyone log in. It lets a payment instruction find your balance.
Side-by-side comparison
The table below puts the two numbers on the same criteria. The row that matters most is the last one. A routing number is shared across customers, while an account number is unique to you, and that difference drives how carefully you should hand each one out.
| Criterion | Routing number | Account number |
|---|---|---|
| What it identifies | Your bank or credit union | Your account at that institution |
| Length | Nine digits | Varies by institution |
| Same for every customer? | Largely yes (a bank may have several) | No, unique to your account |
| Printed on checks? | Yes, along the bottom | Yes, next to the routing number |
| Publicly listed? | Yes, in bank and federal directories | No |
| Sensitivity | Low on its own | High, especially with the routing number |
| Needed to receive a deposit? | Yes | Yes |
| Same everywhere you bank? | Not always, because large banks may hold several | One per account |
Large banks may hold more than one routing number, so a number saved in an old payroll file may not match what your bank shows today. When a deposit is rejected, compare the saved number with the one in your banking app first.
Related numbers that cause confusion
People mix up several numbers that sit close together on a check or in an app. The terminology table below separates them.
| Term | Plain-English meaning | Why it matters | Common confusion |
|---|---|---|---|
| Routing number (ABA number, routing transit number) | Nine-digit code for the institution | Required for ACH, checks and domestic wires | Thought to be your account’s secret code |
| Account number | Identifies your account | Required alongside the routing number | Confused with the debit card number |
| Check number | Sequence number of one paper check | Helps you match and stop a specific check | Mistaken for part of the account number |
| Debit card number | Card network identifier | Used for card purchases, not bank transfers | Entered into direct deposit forms by mistake |
| SWIFT code (BIC) | Identifier used for international wires | Replaces the routing number for wires abroad | Used for domestic transfers by mistake |
| MICR line | Magnetic ink numbers at the bottom of a check | Machines read it to route the check | Read as one long number |
One bank’s help page says it plainly: a SWIFT code is used instead of a routing number for international wire transfers. A domestic wire still uses a routing number, so do not swap them.
Where to Find Your Routing Number and Account Number
You have four reliable places to look. A paper check is the classic one, but your banking app, a statement or a call to your bank can all confirm the same numbers. The right choice depends on what you have in your hand.
Where to find the routing number on a check
Turn the check over to the front and look at the strip of numbers along the bottom edge. The government’s own vendor payment instructions for the U.S. House say the nine-digit routing transit number can be found on the bottom of a check or deposit ticket. Wells Fargo’s help page describes the account number as sitting to the right of the routing number and to the left of the check number.
That order is typical, not universal. Some banks print the check number first, or add extra characters. Count the digits instead of trusting position. The routing number is always the group of exactly nine digits.

Banking app and online banking
Your bank’s app or website is often the fastest source, especially if you have no checks. The IRS notes that your account number can usually be found by signing in to online banking or by calling your bank branch. It also says most banks list their routing numbers on their websites.
Screen labels vary. Look for an “account details” or “account information” section. If you cannot find it, ask the bank’s secure message center rather than a general search engine.
Statements and deposit slips
A deposit ticket carries the same information as a check. Statements show your account number, though banks often mask part of it for security. Masked numbers are no use for a direct deposit form, so switch to the app or a check.
Bank routing number lookup: what to trust
A bank routing number lookup is useful when you have a name and need a number, or the reverse. The safest lookup is your own bank’s website. The Federal Reserve also runs the E-Payments Routing Directory, which gives basic routing details for Fedwire and FedACH transactions and is refreshed daily. The Fed built it for financial institutions and other authorized users, and its terms bar commercial reuse.
Third-party lookup sites are another matter. They may carry outdated entries, and some wrap their results in ads. If a site gives you a number and your bank’s website lists a different one, trust the bank.
| Source | What it shows | How reliable | Watch for |
|---|---|---|---|
| Paper check | Routing, account and check numbers | High, if it is your own check | Old checks from a closed or merged account |
| Banking app | Routing and full account number | High | Labels differ by bank |
| Bank website or secure message | Routing number, wire instructions | High | Look-alike sites that copy a bank’s design |
| Statement | Account number, often masked | Medium | Masked digits |
| Federal Reserve directory | Institution routing details | High for institutions | Built for institutions, not a personal lookup |
| Third-party lookup site | Routing numbers by name | Varies | Outdated or ad-driven pages |
The takeaway from the table is simple. The closer a source sits to your own bank, the less you need to double-check it. Cloned bank sites are a real risk, and our guide to fake bank websites shows how to spot them.
When your bank has more than one routing number
Many people assume each bank has exactly one number. Chase states that large national banks may have multiple routing numbers, while some banks and credit unions have only one. Wells Fargo’s help page asks whether you will receive a wire before it shows a number. It also notes that customers who opened accounts in one region may see a different number on their checks.
So which routing number do you give for direct deposit versus a wire? Start with the number on your own checks for direct deposit and ACH. For an incoming wire, ask your bank for its wire instructions in writing. Some banks use a separate wire routing number, and the wrong one can delay the money.
Prepaid cards, apps and cash accounts
Not every account that carries numbers sits in a traditional checking account. The IRS says reloadable prepaid cards often have their own account and routing numbers, and the account number may differ from the card number. For mobile apps, it tells taxpayers to confirm with the app provider or the financial institution which numbers to use.
Wells Fargo’s page also lists a different routing number for its brokerage cash services. The lesson applies broadly. If an account is not a plain checking account, ask the provider which numbers it wants for deposits and which for wires. Our checking account guide covers how ordinary accounts differ from these products.
Which Number Goes Where: Direct Deposit, ACH and Wire Transfers
Direct deposits, bill payments, checks and wires all ask for the routing and account numbers. They do not travel the same way, though, and the rules that protect you change with each route. Knowing which route a request uses tells you how much risk you are accepting.
Direct deposit and other ACH credits
The Automated Clearing House (ACH) network moves most direct deposits. Nacha, which governs the network, explains the chain: the sender’s bank (the ODFI) bundles instructions, an ACH operator sorts them, and the receiving bank (the RDFI) posts the money to your account. The two operators are the Federal Reserve and The Clearing House.
A credit is a push. Your employer sends money to you, which is why payroll needs your routing and account numbers. Nacha estimates that 80% of ACH payments settle in one banking day or less. Credits can settle the same day, the next banking day or in two banking days.
Settlement is not the same as availability. How soon you can spend the money depends on your bank’s own funds-availability policy. If a deposit shows as pending, our guide to a pending bank transfer explains why.
ACH debits and autopay
A debit is a pull. A landlord, utility or lender collects money from you, using the same two numbers you gave them. Nacha notes that debits settle the same day or the next banking day. Handing over your numbers for autopay is effectively giving the payee permission to pull.
Federal rules put guardrails on that permission. Under Regulation E, 12 CFR 1005.10, a recurring electronic transfer from your account must be authorized by a writing signed or similarly authenticated by you, and the payee must give you a copy. You can stop a preauthorized transfer by notifying your bank orally or in writing at least three business days before the scheduled date. The bank can ask for written confirmation within 14 days of an oral request.

Domestic wire transfers
A wire moves money through a system such as Fedwire, and a completed wire is hard to recall. The CFPB warns that if money goes to the wrong account, you may not be able to get it back.
Wires also sit mostly outside the main consumer dispute rule. Regulation E, section 1005.3(c)(3) excludes transfers through Fedwire or a similar wire system used primarily for transfers between financial institutions or between businesses. The practical reading for you is that the Regulation E error-resolution process generally does not apply to the wire itself. Your bank’s wire agreement matters more.
International wires
International wires use a SWIFT code in place of a routing number, as one large bank’s help page puts it. The receiving country may also require extra details, so ask the receiving bank for its exact instructions. Most consumer wires to other countries count as remittance transfers under federal law. The CFPB’s money transfer FAQ says you have 180 days from the date the money was supposed to be available to report an error. That protection covers errors and failed delivery. It does not make a payment you chose to send reversible.
Checks, converted checks and tax refunds
Every check you write displays both numbers, which is why a check in the wrong hands is a risk. A merchant can also convert your check into a one-time ACH debit. Regulation E allows that only with your authorization and requires the payee to tell you the payment may be processed electronically.
Tax refunds follow stricter rules. The IRS says you should not request a deposit into an account that is not in your own name. Accepted accounts are in your name, your spouse’s name or a joint account with your spouse. The IRS also limits electronic refunds to three per account or prepaid card. Our guide to tax refund direct deposit mistakes walks through what to do when one goes astray. If you receive federal payments, our guide to the end of federal paper checks explains why accurate bank details matter.
| Use | Routing number | Account number | Extra detail | Main protection |
|---|---|---|---|---|
| Direct deposit (ACH credit) | Yes | Yes | Employer’s authorization form | Bank policy, ACH network rules |
| Autopay or bill pay (ACH debit) | Yes | Yes | Your signed or authenticated authorization | Regulation E, stop-payment right |
| Paper check you write | Yes (printed) | Yes (printed) | Check number, signature | Deposit agreement, state law |
| Check converted to ACH | Yes | Yes | Notice and your authorization | Regulation E |
| Domestic wire | Yes (wire number may differ) | Yes | Beneficiary name, bank wire instructions | Mostly your bank’s wire agreement |
| International wire | SWIFT code instead | Yes, or similar | Country-specific details | Remittance rules for covered transfers |
| IRS tax refund | Yes | Yes | Account in your name, spouse or joint | IRS procedures, Form 3911 trace |
Read the last column first. A debit you authorized has a built-in stop-payment right, but a wire has almost none. That asymmetry is why the same request deserves a different level of caution depending on the route.
Is It Safe to Give My Account Number? A Risk Breakdown by Who Is Asking
The honest answer is that it depends on who asks and what they can do with it. Your routing number alone carries almost no risk. Your account number alone is more sensitive. The pair is what a payment system needs to move money, so the pair deserves the same care you would give a signed blank check.
What the two numbers can and cannot do
Together, the numbers let a payer deposit money into your account, and they let a payee request a debit. Whether a debit is legitimate depends on the authorization behind it. Fraudsters submit debit requests they have no right to make, and the numbers are all they need to try.
The numbers alone do not give anyone your online banking password, your debit card or your ATM access. That is why the risk is real but narrower than the panic version of the story.
Checks add a second route. A remotely created check is one that does not bear your signature, and the Federal Reserve’s check rules treat it specially. Under 12 CFR 229.34, the bank that transfers or presents the check warrants that the account holder authorized it in the amount and to the payee stated. In telemarketing, the FTC’s Telemarketing Sales Rule treats creating a remotely created payment order as an abusive practice.
Who is asking: a risk matrix
The risk level in this table is Banktimer’s editorial judgment, not a regulator’s rating. Use it as a starting point, then apply the four-question test below.
| Who asks | Why they ask | Needs both numbers? | Risk level | Safer step |
|---|---|---|---|---|
| Your employer’s payroll team | To send your pay | Yes | Low if you started the hire | Use the company’s official portal or HR contact |
| Landlord or property manager | To collect rent by ACH | Yes | Medium | Use the management company’s own portal; keep the authorization copy |
| Utility, insurer or lender | To set up autopay | Yes | Medium | Enter numbers on the provider’s own site, not through a link |
| Tax preparer or the IRS | To deposit a refund | Yes | Medium | Confirm both numbers with your bank before filing |
| A friend sending you money | To pay you back | Often not | Low to medium | Ask which payment method they prefer; share only if you want ACH |
| A buyer or seller on a marketplace | To “complete” a sale | Rarely | High | Use the platform’s payment tools |
| A caller claiming to be your bank | To “verify” or “reverse” something | No | High | Hang up and call the number on your card |
| A new “employer” asking before hiring | To “set up payroll” | No, not yet | High | Wait for a verified offer and a documented process |
The pattern is consistent. Low-risk requests come after you started the relationship and arrive through a channel you can verify. High-risk requests arrive unprompted and carry urgency. For more on the second type, see our guide to the bank impersonation scam.
A four-question test before you share
This is the decision framework we suggest. It takes about thirty seconds.
- Did I start this contact? If someone called, texted or emailed you first, stop and verify the request independently.
- What permission am I granting? A deposit form lets money in. Autopay lets money out on a schedule. Know which one it is.
- Does the recipient really need both numbers? Many payers can use a link, a card or a payment app instead.
- Can I get proof? Ask for a written authorization copy. Regulation E requires the payee to give you one for recurring debits.
If any answer is uncertain, pause. A legitimate payee will wait while you confirm. A scammer will not.

Everyday ways the numbers get exposed
Most exposure is mundane. A voided check emailed to a payroll mailbox, a photo of a check posted to ask a question, and a paper check dropped in a mailbox all show both numbers. Mobile deposit adds another copy: our guide to mobile check deposit covers how to store and destroy check images safely.
Mailed checks carry the most obvious risk. Our article on mail theft and stolen checks explains why a stolen check can be altered or copied.
What FDIC insurance does and does not do
Many people assume deposit insurance protects them if someone drains the account. It does not work that way. The FDIC describes deposit insurance as protection for your insured deposits if your bank fails, up to $250,000 per depositor, per insured bank, for each account ownership category. The OCC’s HelpWithMyBank site says deposit insurance does not cover losses due to theft or fraud. Protection from fraud comes from federal rules such as Regulation E and from your bank’s agreement. Our FDIC insurance limits guide explains the failure side in detail.
ACH Fraud With an Account Number: Your Rights and Deadlines
If someone debits your account without permission, federal law gives you real protection, and the clock matters. The rules differ depending on whether a card was stolen, only the numbers were taken, or you sent the payment yourself. This section separates those cases so you know which one you are in.
What counts as an unauthorized transfer
Regulation E defines an unauthorized electronic fund transfer as one initiated by a person other than the consumer without actual authority and from which the consumer receives no benefit. The CFPB’s electronic fund transfer FAQs go further. They say that when a consumer is fraudulently induced into sharing account access information, a transfer the scammer then makes with it is an unauthorized transfer under Regulation E.
That covers a caller who poses as your bank and talks you into reading out numbers. It does not cover a payment you start yourself. Regulation E counts only transfers initiated by someone other than you. On our reading, a transfer you send yourself, even while deceived, falls outside that definition. Your bank may still help, but the law does not require it. Our guide to the bank impersonation scam covers that gray zone.
Two liability ladders: stolen card versus stolen numbers
The deadlines differ depending on whether an access device was involved. Under 12 CFR 1005.6, if a card or code is lost or stolen and you tell the bank within two business days of learning of it, your liability is the lesser of $50 or the unauthorized transfers made before notice. Wait longer, and the cap rises to $500. After 60 days from the statement date, you can be liable for later transfers the bank shows would have been prevented by timely notice.
When no access device was used, the CFPB’s official interpretation of section 1005.6 says the first two tiers do not apply. The comment gives the example of a transfer made using only an account number. You are protected as long as you report within 60 days of the statement. If you miss the window, you may be liable for transfers that happen after day 60 and before you report.

Two things that cannot raise your liability
Two additional rules help you. The CFPB comments say negligence by the consumer, such as writing a PIN on a card, cannot be the basis for imposing greater liability. They also say no agreement between you and the institution can impose greater liability than Regulation E allows. A deposit agreement that tries to shift more of the loss to you does not override the federal limits. If the delay was due to extenuating circumstances such as a long hospital stay, the bank must extend the time limits to a reasonable period.
Worked scenarios: card versus numbers
The numbers below are illustrative, and we computed them in a script. Each assumes you report the problem as described and that the bank meets its investigation duties.
| Scenario | What happened | Your report | Liability under Regulation E | Why |
|---|---|---|---|---|
| A: numbers only, on time | $187.00 debit on October 20, 2026; statement sent November 5, 2026 | By January 4, 2027 | $0 | Reported within 60 days of the statement |
| B: numbers only, late | Same $187.00 debit, then $312.40 on January 6, 2027; first report on January 8 | After day 60 | Up to $312.40 | Later debit fell after the 60-day window and before notice |
| C: card stolen, fast report | $300.00 charged on day 1 | Within 2 business days | $50.00 | Lesser of $50 or the loss before notice |
| D: card stolen, slow report | $300.00 on day 1, $800.00 on day 4, reported on day 6 | After 2 business days | Up to $500.00 | Cap rises to $500 on late notice |
| E: numbers only, same debits as D | $300.00 and $800.00 | Within 60 days of the statement | $0 | No access device, so the $50 and $500 tiers do not apply |
Scenarios B and E carry the lesson. Reporting inside the 60-day window is what decides the outcome when only your numbers were used. Scenario B also shows how the January 4, 2027 deadline came from counting 60 days from the November 5 statement date, not from the date of the debit.
Investigation and provisional credit
Once you report, the clock moves to your bank. Under 12 CFR 1005.11, it must determine whether an error occurred within 10 business days of receiving your notice. If it needs more time, it must provisionally credit the disputed amount within those 10 business days. It may then take up to 45 days from receipt of the notice to investigate. The period is 90 days for certain transfers, including point-of-sale debit transactions, transfers not initiated within a state and transfers within 30 days after the account’s first deposit. For new accounts the initial period is 20 business days.
The CFPB also notes a catch. A bank may skip the provisional credit if you reported by phone and did not confirm in writing within 10 business days when it asked you to. After the investigation, the bank must report the results within three business days.
| Stage | Typical timing | Who controls it | Your action |
|---|---|---|---|
| Report the problem | As soon as you see it | You | Call, then confirm in writing |
| Initial decision | Within 10 business days (20 for new accounts) | Bank | Keep your reference number |
| Provisional credit | Within 10 business days if the bank needs more time | Bank | Check the credit posted |
| Full investigation | Up to 45 days (90 in certain cases) | Bank | Answer requests fast |
| Written results | Within 3 business days of finishing | Bank | Save the letter |
If you report on Monday, November 9, 2026, 10 business days lands on November 23 when no holidays are counted. It lands a day later if your bank treats Veterans Day as a non-business day. Forty-five days from that report is December 24, 2026, and 90 days is February 7, 2027.
Checks and wires follow different rules
Check fraud runs on state law and your deposit agreement instead of Regulation E. The Uniform Commercial Code, as enacted in your state, expects you to examine statements with reasonable care and promptness. The New York version we read bars a customer who fails to report an unauthorized signature or alteration within one year, and it limits claims on repeat items to a shorter period. Other states differ, and your deposit agreement may set its own deadline, so read it.
For wires, move immediately. The FTC says to report it to your bank or credit union right away and ask them to reverse the payment. That request is worth making, but the bank is not required to succeed.
| Rule | Applies when | Exception | Source | Your action |
|---|---|---|---|---|
| 60-day reporting window | Unauthorized debit appears on a statement | Extended for extenuating circumstances | 12 CFR 1005.6(b)(3) | Review each statement within days |
| $50 then $500 tiers | A card or code is lost or stolen | Not applicable to account-number-only fraud | 12 CFR 1005.6(b)(1), (2) | Report a lost card within 2 business days |
| 10-business-day investigation | You give notice of an error | 20 business days for new accounts | 12 CFR 1005.11 | Keep a reference number |
| Stop payment on recurring debits | Preauthorized transfer | Needs notice 3 business days before the date | 12 CFR 1005.10(c) | Call early, confirm in writing |
| Wire exclusion | Fedwire or similar wire | Related ACH credits may be covered | 12 CFR 1005.3(c)(3) | Act the same day |
| Remittance error window | Consumer wire to another country | Covered providers only | CFPB money transfer FAQ | Report within 180 days |
| Check statement duty | Forged or altered check | Varies by state and agreement | State UCC Article 4 | Read your agreement |
Scams That Go After Your Routing and Account Numbers
Scammers rarely need to hack anything when you will hand over the numbers yourself. The pitch changes, but the ask is the same: get both numbers, or get you to deposit a check and send money back. Knowing the common scripts lets you spot the ask before you answer it.
“Payroll setup” and fake job offers
A new job needs your direct deposit details, so the ask sounds routine. That is the cover. The FTC warns that if you gave your personal information thinking it was for payroll, you may now have an identity theft problem. It also says no honest potential employer will send you a check to deposit and ask you to send part of the money back.
A real employer completes its hiring steps first. It gives you a formal offer, uses a verified HR or payroll system, and collects banking details after you accept. If the order is reversed, slow down.
Calls and texts from your “bank”
Impersonators claim a debit is pending, a deposit is flagged or your account is locked, and they need to “verify” your numbers. The FTC says honest organizations won’t call, email or text to ask for personal information, and it lists bank account numbers among the details to protect. The FDIC’s consumer newsletter says the agency would never contact you asking for personal details such as bank account information.
Your bank already has your numbers. A caller who asks you to read them back is the red flag. Hang up and call the number on the back of your card. Our guide to bank phishing texts shows what the messages usually look like.
Fake checks and overpayments
In a fake check scam, someone sends you a check, asks you to deposit it and wants part of the money returned by wire, gift card or app. The check may appear to clear. Later it bounces, and the bank can ask you to repay the full amount, as the FTC warns. For why a deposit can look available before it is final, see our explainer on check clearing time.
The FTC also names the payment methods scammers push: wire transfers, payment apps, gift cards and cryptocurrency. If a stranger insists on one of these, treat that as the warning. Our payment app scam guide covers the app variety.
Red flags and safer moves
The table pairs each red flag with a question to ask and a safer next step.
| Red flag | Why it matters | What to ask | Safer next step |
|---|---|---|---|
| Unsolicited call or text asking you to “confirm” numbers | Your bank already has them | Who exactly are you, and what is your callback number? | Hang up; call the number on your card |
| A new employer who needs numbers before a formal offer | Real hiring comes first | Is there a written offer and official HR contact? | Wait for a verified offer |
| A check you must deposit, then send back part | The check can bounce after you send money | Why can’t you keep the extra money? | Do not deposit; report it |
| Insistence on a wire, gift card or crypto | Hard to reverse | Can I pay another way? | Use a payment method with dispute rights |
| Pressure to act in minutes | Urgency blocks verification | What happens if I call back tomorrow? | Pause; verify independently |
| A link to a “secure” form that asks for full numbers | Could be a look-alike site | Is the address one I typed myself? | Go to the provider’s site directly |
| A request for a photo of a check “to verify” | The image shows both numbers | Why do you need the image? | Offer a bank-issued direct deposit form instead |
If someone called, texted or emailed you first and asks for your account number, assume it is unsafe until you verify them yourself. Using a number or link they supply defeats the verification. Look up the organization’s contact details independently, or use the app you already trust.
What a leak actually enables
Not every leak is equally serious. The next table shows what each exposed item can and cannot do, and how fast we suggest you act. The urgency column is Banktimer’s editorial judgment.
| What leaked | What it can enable | What it cannot do alone | Urgency | First step |
|---|---|---|---|---|
| Routing number only | Nothing meaningful on its own | Move money or reach your account | Low | None needed |
| Account number only | Close to the pair, because routing numbers are public and easy to match to your bank | Log in or use your card | Medium to high | Watch activity; ask about a new account number |
| Both numbers | Attempted ACH debits, remotely created checks | Log in or use your card | High | Call the bank the same day |
| Both numbers plus login details | Account takeover, transfers out | Little is off the table | Very high | Lock the account; change credentials |
| A photo of a check | Both numbers plus your signature | Log in or use your card | High | Call the bank; ask about a new account number |
| Debit card number | Card purchases | Direct ACH debits by itself | High | Freeze or replace the card |
Notice that your routing number alone sits at the bottom of the urgency scale. People often worry about the wrong half. Because routing numbers are public, an exposed account number deserves nearly the same response as the pair.
If Your Numbers Got Out: The First Hour, the First Day and the First Week
Exposure feels urgent because it is. You do not need to panic, though, because a short sequence of calls handles most cases. The priority is to put your bank on notice, because that starts the regulatory clock in your favor.
The first hour
Start with the bank, not the person who asked. Call the number on the back of your card or use the secure message center in your app. Tell the representative that you shared your routing and account numbers with someone you now doubt, or that you see a debit you did not authorize. Then ask four things.
- Can you review pending and recent ACH activity on the account?
- Can you block or flag incoming ACH debits while we sort this out?
- Can you issue a new account number, and how long does it take?
- What reference number or case ID will you give me?
Write down the date, time, name and reference number. If you have already sent money to a scammer by wire, say so right away and ask for a recall request. That call matters more than any other step.
The first day
Follow up in writing. The CFPB notes that a bank may skip the provisional credit if you reported by phone and did not confirm in writing within 10 business days after it asked. Send a short message through the secure channel, or mail a letter, describing the transactions.
If you gave a scammer your online login, the FTC advises changing your password right away and turning on two-factor authentication. Report the scam at ReportFraud.ftc.gov. If your Social Security number was involved, report at IdentityTheft.gov. Our identity theft recovery plan covers the next steps, and the debit card fraud recovery guide covers the card side.

The first week
Use the week to repair what the incident touched. Review every transaction since the exposure. Update autopay and payroll if your bank issues a new account number. Keep copies of everything. If the bank denies a claim, ask for the findings in writing, because Regulation E requires the bank to report its results.
| Timing | Action | Why it matters | Evidence to keep |
|---|---|---|---|
| Hour 1 | Call the bank; ask for review and a block | Starts the clock and limits new debits | Date, time, rep name, case ID |
| Hour 1 | If a wire went out, request a recall | Speed is the only chance | Wire confirmation, recall request |
| Day 1 | Confirm in writing | Preserves provisional credit rights | Copy of message or letter |
| Day 1 | Report to the FTC; change credentials | Creates a record and closes login gaps | Report number |
| Day 2 to 3 | Review all activity; log disputed items | Builds the dispute list | Statement excerpts, screenshots |
| Week 1 | Decide on a new account number | Ends exposure from the old pair | Bank confirmation of the change |
| Week 1 | Update payroll and autopay | Avoids rejected deposits and late fees | Updated authorizations |
| Statement cycle | Read the next statement closely | The 60-day window runs from the statement | Marked-up statement |
Should you change your account number?
Often, yes, if both numbers were exposed to someone you cannot trust. A new number cuts off debits tied to the old one. The cost is the cleanup. Every employer, landlord and utility that holds the old number must get the new one, and checks you wrote against the old number may be returned.
Banks handle this differently. Some can reissue a number on the same account, while others ask you to open a new account and move your money. Ask which applies, how long it takes, and whether pending items carry over. Our overdraft fees guide explains what a returned payment can cost, so line up your payees before the old number stops working.
What a credit freeze does and does not do
People sometimes reach for a freeze. A credit freeze controls who can see your credit reports, so it helps against new credit accounts. It does not stop a debit from an existing bank account. Our comparison of a credit freeze and a fraud alert explains the difference.
Some banks also let you restrict ACH debits to payees you approve in advance. Features like that vary by institution, so ask what yours offers. If someone has already taken over the account itself, read our guide to bank account takeover for the harder cases.
Documents to keep
| Document | Why it matters | Where to get it | How long to keep it |
|---|---|---|---|
| Case or reference number | Proves when you reported | The bank rep or secure message | Until the dispute closes |
| Written dispute confirmation | Keeps provisional credit rights | Your letter or message copy | Until the dispute closes |
| Statements showing the debits | Shows the 60-day timeline | Bank portal | At least until final resolution |
| Screenshots of messages from the scammer | Evidence for the bank and the FTC | Your phone or email | Until the case closes |
| FTC report | Official record of the scam | ReportFraud.ftc.gov | Keep a copy permanently |
| Findings letter from the bank | Required at the end of the investigation | Bank mail or portal | Keep permanently |
Typos and Wrong-Account Mistakes That Cost Real Money
Not every loss involves a criminal. Plenty of money goes astray because someone typed a digit wrong or pasted the wrong number. Here is how those mistakes happen, which ones the system catches, and which ones it does not.
Why a mistyped routing number usually gets caught
The ninth digit of a routing number is a check digit. The Treasury’s ACH guide labels it as the ninth digit of the institution’s routing number. Systems use that digit to test whether the other eight look valid. Under the common weighting of 3, 7 and 1 across the nine digits, a valid number produces a total that ends in zero.
We ran the math on an invented number, 123456780, which does not belong to any bank. Its weighted total is 150, so it passes. Change any single digit and the total no longer ends in zero. Across 1.62 million single-digit errors we simulated, every one failed the test.
Swapped neighbors fare worse. About 89% of swaps of two different adjacent digits fail the test, but about 11% pass, because digits that differ by five can trade places without changing the total. A passing number can still be wrong.
Why an account number typo is riskier
Account numbers follow each bank’s own format, and there is no single check that works for all of them. A typo can therefore produce a number that is valid but belongs to someone else. The CFPB’s advice is blunt: double-check account and routing numbers before sending, because if money goes to the wrong account, you may not be able to get it back. It also tells senders to spell the recipient’s name exactly as it appears on their account.
How closely the receiving bank compares the name to the number varies by institution and payment type. Do not assume that a name mismatch will stop a payment.
Worked scenarios
Each example below is illustrative and uses invented amounts.
A new hire types her account number into the payroll portal with the last two digits swapped. Her net pay is $2,150 per paycheck, and she is paid 26 times a year, so one missed deposit is about 3.8% of her annual take-home of $55,900. The first deposit is either returned to the employer or posted somewhere unintended. She calls payroll the same day, confirms the number against her banking app and asks for a corrected deposit or a replacement check. Checking the number against the app before submitting would have avoided the delay.
A buyer wires $9,800 for a deposit on a rental and later spots a transposed digit in the account number on her confirmation. She calls her bank that hour, reports the error and asks for a recall. The FTC’s advice for a transfer that went wrong is to contact the bank immediately and ask for the payment to be reversed. Whether the money returns depends on whether it has already posted to the other account and what the other bank agrees to do. A confirmation call to the payee, using a number she already trusted, would have caught the error before the wire.
A tenant’s rent of $1,450 is scheduled to debit on Monday, December 14, 2026. He is moving rent autopay to a new account and wants the old debit stopped so the rent is not paid twice. Regulation E requires notice at least three business days before the scheduled date, so he must give it no later than Wednesday, December 9. If he calls on Tuesday, December 8, the bank can ask for written confirmation within 14 days, by December 22, and he should send it the same day.
| Mistake | What it can cost | Better move |
|---|---|---|
| Typing numbers from memory | A rejected or misdirected payment | Copy them from your app or a check |
| Using the debit card number in a direct deposit form | A rejected deposit | Use the routing and account numbers, not the card number |
| Using an old routing number | Delays, returned deposits | Re-check the number against your bank’s current listing |
| Sending a wire without a call-back verification | Irreversible loss in some cases | Confirm instructions by phone with a trusted number |
| Emailing a photo of a check | Exposes both numbers and your signature | Use a bank-issued deposit form or a secure portal |
| Waiting for the next statement to report a debit | Lost time on the 60-day clock | Check activity weekly and report at once |
| Ignoring tiny unfamiliar debits | They are still errors, and silence delays your report | Dispute small unfamiliar debits too |
| Skipping the written follow-up | Possible loss of provisional credit | Confirm any phone report in writing |
What to do if money lands in your account by mistake
Sometimes the error runs the other way and a stranger’s payment arrives in your account. Do not spend it. Contact your bank, explain what happened and let them handle the return. Our guide to money deposited by mistake covers your obligations and what to document.
Joint accounts, credit unions and the same numbers
Two people on a joint bank account share one account number, so either owner’s exposure affects both. Credit unions use routing numbers too. Chase’s description of a routing number covers a bank or a credit union, and our guide to credit unions versus banks explains where their rules differ.
Safer Alternatives to Handing Over Your Numbers
You can often avoid sharing both numbers at all. Whether you should depends on whether the other side needs to push money to you, pull money from you or simply get paid. The best alternative changes with that job.
Paying someone: ACH debit versus a card
When you pay by ACH debit, the money leaves your bank account. If something goes wrong, you are asking for money back. When you pay by credit card, the money is the card issuer’s until you pay the bill. Under Regulation Z, section 1026.13, a billing error notice must reach the issuer within 60 days of the first statement that shows the error. You need not pay the disputed portion while it investigates.
That is a structural difference, not a guarantee. It explains why a one-time online purchase from an unfamiliar seller is a better fit for a card than for your bank numbers. Our credit card basics guide covers how cards work.
Getting paid: forms, portals and payment links
If a payer only needs to send you money, offer the least you can. Many banks provide a pre-filled direct deposit form inside the app or online. A form from your own bank is cleaner than a voided check, which also shows your check number and the layout of your checks.
For one-time payments from a friend or a customer, a payment link or app avoids sharing your account number at all. Apps have their own scam patterns, so read our payment app scam guide first.
Comparing the alternatives
| Alternative | Cost | Flexibility | Main risk | Best fit |
|---|---|---|---|---|
| Give routing and account numbers | Usually free | High for recurring payments | Exposes the pair | Payroll, rent, trusted autopay |
| Bank-issued direct deposit form | Usually free | Good for employers | A copy of the form still shows your numbers | New job or benefits setup |
| Pay with a credit card | Possible interest if unpaid | Good for one-time purchases | Card number exposure instead | Online purchases from new sellers |
| Payment app or link | Fees vary by provider | Good for one-time transfers | App-specific scams | Splitting costs, small payments |
| Check by mail | Postage and time | Low | Shows both numbers to everyone who touches it | Last resort for small payees |
| Wire | Fees vary by bank | Limited | Hard to recall | Large one-time payments to verified parties |
The table shows a trade-off with no free lunch. Every method moves the exposure to another place. The lowest-risk choice is usually the method that keeps your account details with your own bank and puts a verified intermediary in the middle.
Setting up direct deposit safely
For a new job, use this sequence.
- Complete the offer and onboarding in the company’s official system.
- Open your banking app and copy the routing and account numbers yourself.
- Enter them in the employer’s portal, not in an email or a text.
- Review the confirmation screen for the last four digits.
- Ask payroll to confirm the first deposit date.
- Check your account on that date and keep the pay stub.
If your employer asks for a voided check, send it through the secure portal. Never email a photo of a check to an address you cannot verify.
Specific questions beat general caution. Use this checklist whenever someone asks for your routing and account numbers.
- ☐ Did I start this contact, or did they?
- ☐ Am I giving permission to deposit, to withdraw, or both?
- ☐ Is a one-time payment link or card an option instead?
- ☐ Will I get a written copy of the authorization?
- ☐ How do I cancel, and how much notice do I have to give?
- ☐ Which routing number does my bank want for this use, a deposit or a wire?
- ☐ Is the number I am copying from my own banking app or check?
- ☐ Who else will see this form, email or image?
- ☐ What will I do if the first transaction looks wrong?
Print the checklist or save it in your notes app. Run through it before every new autopay, new employer or wire. The questions take less than a minute, and they are cheaper than a dispute.
The “which number for which job” decision rule
We suggest one more rule of thumb. If the job is to receive money, give the least you can. If the job is to be paid on a schedule, give the numbers only to a payee you verified and hold the authorization copy. If the job is a large wire, call the recipient on a number you already trust before you send. When more than one rule fits, follow the stricter one.
Frequently Asked Questions
What is the difference between a routing number and an account number?
A routing number is a nine-digit code that identifies your bank or credit union. An account number identifies your specific account at that institution. Payments need both, because the first sends the instruction to the right institution and the second sends it to the right account. The routing number is shared and public, while the account number is unique to you and should be guarded. Our banking terms glossary defines the other words you will see on forms.
Where do I find the routing number on a check?
Look along the bottom edge of the check. The routing number is the group of exactly nine digits. The account number usually sits to its right, followed by the check number, though some banks print them in a different order. If the digits are hard to read or you have no checks, open your banking app or call your bank. Do not rely on a random website to tell you.
Is it safe to give my account number to an employer?
Usually yes, if you started the relationship and you are using the employer’s official payroll system. Direct deposit lets money in. The real risk is a fake employer that asks for the numbers before a verified offer. The FTC says no honest employer will send you a check to deposit and ask you to send part back. Confirm the offer, the contact and the portal before you type anything.
Can someone steal money with just my routing and account number?
They can try to originate a debit or write a check against your account, and sometimes that works for a short time. The numbers do not give anyone your online login or your card. Regulation E treats a debit you did not authorize as an unauthorized transfer. Report it within 60 days of the statement date and you are generally protected from liability for it. See our overview of ACH transfer problems for the process.
Is the routing number the same for direct deposit and for a wire?
Not always. The number on your checks is usually the one to give an employer or biller for direct deposit and ACH. Some banks publish a separate routing number for incoming wires, and large banks may hold several numbers. Ask your bank for wire instructions in writing before you give them to a sender. International wires use a SWIFT code instead of a routing number.
Is a routing number a secret?
No. A routing number is printed on every check the bank issues, listed on bank websites and included in Federal Reserve directories. It identifies the institution, not you. Knowing it by itself does not let anyone reach your account. Keep your attention on the account number, and on any request that asks for both numbers together.
How do I do a bank routing number lookup safely?
Use your own bank’s website, your banking app or a check. The Federal Reserve’s E-Payments Routing Directory is updated daily, but it is designed for financial institutions and other authorized users. Third-party lookup sites can be outdated, so cross-check any number against your bank before you use it. If two sources disagree, trust the bank.
What should I do if I gave my account number to a scammer?
Call your bank right away, using a number you trust. Ask it to review activity, block ACH debits and issue a new account number. Follow up in writing, because a bank can skip provisional credit if you do not confirm a phone report in writing when asked. Then report the scam at ReportFraud.ftc.gov. Our identity theft recovery plan covers the later steps.
Will my bank refund an unauthorized ACH debit?
If you report it in time, it generally must investigate under Regulation E. The bank has 10 business days to decide or provisionally credit you, and up to 45 days to finish, or 90 days in certain cases. When only your numbers were used, the key deadline is 60 days from the statement. Our summary of Regulation E explains the rules in more depth.
Is my debit card number the same as my account number?
No. The debit card number is a card-network identifier used for purchases. The account number, with the routing number, is used for transfers and checks. Prepaid cards can blur the line, since the IRS notes that the account number may differ from the card number. If you are filling out a direct deposit form, use the routing and account numbers, not the card number. If the card number was exposed, see our guide to debit card fraud.
Can I change my account number without closing my account?
Some banks can reissue a number on the same account, and others require you to open a new account. Policies and timing vary, so ask before you commit. Update every payroll, autopay and deposit instruction at the same time, and keep the old account open until pending items clear. Otherwise a returned payment can add fees on top of the bill.
Can I get money back from a wire sent to the wrong account?
Sometimes, but not reliably. Call your bank immediately and ask it to request a recall. The CFPB warns that if money goes to the wrong account you may not be able to get it back, and Regulation E’s dispute process generally does not cover a Fedwire transfer. Speed and documentation are your best tools. Most consumer wires abroad follow separate remittance rules with a 180-day error window.
Open your banking app today and copy your routing and account numbers into a secure note. Compare them with what each employer and biller holds. That check takes ten minutes and tells you whether any old payee is still using a number that has changed.
The variable that decides how safe your numbers are is who asked and who started the conversation, not which number you hand over. The routing number is public and identifies only your bank. The account number identifies you, and together the two let a payee try to pull money from your account. Share them only with payers and payees you verified through a channel you opened yourself, and keep a copy of any authorization you sign. If either number leaks, call your bank the same day, confirm in writing and watch the 60-day statement window. This guide does not cover how your own bank handles wires, funds holds or account number changes, because those policies vary by institution, so ask for the terms in writing before you rely on any of them.
Methodology
We built this guide from primary and official sources and checked each cited page on October 15, 2026. The liability and investigation rules come from the CFPB’s text and official interpretations of Regulation E (12 CFR part 1005). ACH mechanics come from Nacha and the Treasury’s federal ACH guide. Refund rules come from the IRS. Scam guidance comes from the FTC, and deposit insurance wording comes from the FDIC and the OCC’s HelpWithMyBank site.
Two bank help pages (Chase and Wells Fargo) are cited only for how large banks describe their own routing numbers. All dollar scenarios, the payroll and wire examples, the invented routing number and the 60-day dates are illustrative assumptions computed in a script, not quotes or real accounts. The check digit weighting is the common industry method, shown as our own calculation on an invented number. State law, deposit agreements and bank wire practices vary, and each bank sets its own rules for account number changes. We did not test any bank, form or lookup tool.
Sources
- 12 CFR 1005.6, Liability of consumer for unauthorized transfers, eCFR
- Official interpretation of section 1005.6, CFPB
- 12 CFR 1005.3, Coverage, CFPB
- 12 CFR 1005.10, Preauthorized transfers, CFPB
- 12 CFR 1005.11, Procedures for resolving errors, CFPB
- Electronic Fund Transfers FAQs, CFPB
- Sent money with information that did not match, CFPB
- How ACH payments work, Nacha
- A Guide to Federal Government ACH Payments (Green Book), U.S. Treasury
- Direct deposit of your refund, IRS
- What to do if you were scammed, FTC
- Job scams, FTC
- Check fraud and deposit insurance, HelpWithMyBank.gov (OCC)
- E-Payments Routing Directory, Federal Reserve Financial Services
By the Banktimer Editorial Team · Published
Banktimer is an independent U.S. consumer-finance publication. Our editors draw on primary and official sources first, such as the CFPB, FDIC, Federal Reserve, and FTC, along with statutes, regulations, and providers’ own agreements and fee schedules. Then we add worked examples and decision tools. Our goal is the most useful, best-supported explanation the sources available to us at the time of writing allow.
This article is general information, not legal, tax, investment, insurance, or financial advice, and reading it does not create a professional relationship with Banktimer. Rates, fees, limits, and rules change, and they vary by state, provider, and contract, so confirm current terms with your bank, lender, insurer, or the agency named in the article before you act. Examples are illustrative unless labeled otherwise. Banktimer is not a bank, lender, insurer, or financial advisor, and we are not responsible for decisions or losses that result from relying on this content. For advice about your own situation, talk to a licensed professional.
