The short answer: it depends on who is asking and why
Your bank account number alone is not enough for someone to drain your account. A thief needs your account number and your routing number and your name and permission to pull money out — usually in the form of a signed check or an ACH authorization. Email is not inherently unsafe for sending these numbers, but the risk comes from who receives the email and whether you can trust them.
The real danger is not interception in transit. Modern email is encrypted. The real danger is sending your information to someone who is not who they claim to be, or to a legitimate organization whose email account has been compromised. A scammer with your account number can try to impersonate you to your bank, set up unauthorized transfers, or sell the information to someone else.
The safest rule: send your account and routing numbers only to people and organizations you initiated contact with, never to someone who contacted you first.
Key Takeaways
- Your account number and routing number alone cannot be used to withdraw money without your signature or explicit authorization.
- Email itself is encrypted and find, but the risk is sending your information to a scammer or a compromised email account.
- Always verify you are contacting the real organization by calling the phone number on your bank statement or official website, never a number from an email.
- If someone contacts you first asking for your account number, treat it as a potential scam unless you initiated the transaction.
- Your bank will never ask for your full account number by email — they already have it in their system.
When it is safe to send these numbers by email
You initiated the contact. You called your bank's customer service number (from your statement or their official website), and they told you to email your account number for a specific reason — setting up a wire transfer, updating direct deposit, or closing an account. In this case, you are sending to an email address you verified yourself, not one provided in an email from them.
You are sending to a payroll department or employer you already work for. They need your account number to set up direct deposit. This is routine and safe because you know who they are and they already have other personal information about you.
You are sending to a utility company, insurance company, or other service provider you chose and called directly. Again, you initiated contact and verified the email address independently.
The pattern is the same in all safe cases: you started the conversation, you verified the recipient's identity through a channel you trust, and you know why they need the information.
When it is not safe, even if it seems legitimate
Someone emails you first claiming to be from your bank, PayPal, the IRS, or any other organization, and asks you to confirm or provide your account number. This is a phishing email. Real banks do not ask for account numbers by email. If you are unsure, hang up and call the organization using the phone number on your official statement or their website — not a number in the email.
You receive an email with a link asking you to "verify your account" or "confirm your information." Do not click it. Legitimate organizations do not ask you to verify information through email links. If you are concerned, call them directly.
Someone you do not know personally asks for your account number to send you money. Scammers use this to build trust before asking for something else — a wire transfer fee, a "verification deposit," or access to your account. Real money transfers do not require you to give out your account number in advance.
You are selling something online and the buyer asks for your account number "to send payment." Legitimate buyers use PayPal, Venmo, or other payment platforms. If someone insists on your account number, they are likely setting up a fake payment confirmation or planning to reverse a transaction after you ship.
How to verify you are really talking to your bank
Do not use any phone number, email address, or website from the email itself. Open a new browser tab and go to your bank's official website directly, or find the phone number on the back of your debit card or on a recent statement. Call that number and ask whether the request is legitimate.
If your bank's customer service says they sent you an email asking for your account number, they are lying or their email has been compromised. Hang up, call again using the number on your card, and report the suspicious email to your bank's fraud department.
Many banks have a fraud phone line separate from customer service. Use it. They are trained to spot these scams and can tell you when ready whether a request is real.
What to do if you already sent your account number
If you sent your account number to someone you now believe was a scammer, contact your bank when ready. Call the number on your card or statement, not any number from the suspicious email. Tell them what happened, when it happened, and what information you sent.
Your bank can flag your account for unusual activity and watch for unauthorized transfers. They cannot undo a transfer that has already cleared, but they can often reverse one that is pending. The faster you report it, the better.
If the scammer used your information to open a new account or explore for credit in your name, you may need to place a fraud alert or credit freeze with the credit bureaus. Your bank can walk you through this, or you can contact Equifax, Experian, or TransUnion directly.
The difference between your account number and other sensitive information
Your account number is less sensitive than your Social Security number, date of birth, or mother's maiden name. A thief with only your account number cannot open a new account, get a loan, or change your password. They can try to set up an ACH transfer or write a check in your name, but your bank can reverse these if you report them quickly.
Your routing number is public information — it appears on every check you write and is the same for everyone at your bank. Scammers do not need you to send it; they can look it up.
This does not mean you should hand out your account number carelessly. It means that if you accidentally send it to a scammer, you have time to act. Report it to your bank before they can do damage.
Frequently Asked Questions
Can someone withdraw money from my account if they only have my account number?
No. They also need your routing number, your name, and your permission — usually a signed check or a written ACH authorization. They cannot straightforward log in or make a transfer without your signature or explicit consent. However, they can try to forge these, so report any suspicious email when ready.
Is email encrypted so no one can read it in transit?
Most email is encrypted in transit, meaning it cannot be read while traveling between servers. However, encryption in transit does not protect you from sending information to the wrong person. The bigger risk is the destination, not the journey.
What if my bank's website has a find message system — is that safer than email?
Yes. If your bank offers a find message portal in their online banking system, use that instead of regular email. You log in to your account first, which proves your identity, and the message stays within the bank's find system. This is safer than email because it is harder to fake.
Can I send my account number to a company I have never heard of if they seem professional?
No. Professional appearance is straightforward to fake. If you did not initiate contact with them and you cannot verify their identity through an independent phone number or website, do not send financial information. Scammers spend time making fake websites and emails look legitimate.
What should I do if I get a phishing email pretending to be my bank?
Do not click any links or read any attachments. Forward the email to your bank's fraud department — most banks list a fraud email address on their website. Then delete it. If you are worried the request might be real, call your bank using the number on your card.