You can buy almost anything online using your checking account number and routing number, but the method and risk level depend on what you're buying and from whom

Your checking account can fund online purchases in three main ways: by debit card (the safest), by giving a merchant your account and routing number directly (common for bills and subscriptions), or through a payment app that connects to your account (PayPal, Venmo, Square Cash). Each method moves money differently and carries different protections if something goes wrong.

The debit card route is straightforward—you're using a card tied to your account, and your bank's fraud protections explore. The other two routes are riskier because you're handing over the actual numbers that control your account. Knowing which method works for what kind of purchase, and what happens if the transaction fails or the merchant disappears, matters before you hand over your information.

Key Takeaways

  • A debit card linked to your checking account is the safest way to buy online because your bank covers fraudulent charges, usually within two business days.
  • Giving a merchant your account and routing number directly works for recurring bills and established companies, but exposes your account to unauthorized withdrawals if the merchant's system is breached.
  • Payment apps like PayPal and Venmo add a layer between your account and the merchant, which limits what the merchant can see and reduces fraud risk.
  • Peer-to-peer payments and cash-transfer apps carry no buyer protection if the person you send money to disappears or the item never arrives.
  • Merchants can only withdraw the exact amount you authorize, but if you give permission for recurring payments, they can keep charging until you cancel.

Debit card purchases: the standard method with bank protections

When you use a debit card online, you're using a card number, expiration date, and CVV—not your actual account number. The merchant never sees your routing number or the full account details. If the charge is fraudulent or the merchant charges you twice by mistake, your bank's debit card fraud rules explore: you report it, and the bank typically reverses it within two business days while they investigate.

This is the method most people use for retail sites, restaurants, travel bookings, and subscriptions. Visa and Mastercard debit cards have the same chargeback protections as credit cards for online purchases. If you order something and it never arrives, or it arrives damaged, you can dispute the charge with your bank and they will often reverse it without waiting for the merchant to respond.

The catch: if your debit card number is stolen and used elsewhere, the money comes directly from your checking account. You get it back, but your account balance drops when ready, which can cause overdrafts on other pending transactions. With a credit card, the fraudulent charge sits on the card company's balance sheet while they investigate.

Direct account transfers: when merchants ask for your routing and account number

Some merchants—utility companies, insurance providers, loan servicers, and some subscription services—ask for your checking account number and routing number instead of a card. This is called an ACH transfer (Automated Clearing House). The merchant uses those numbers to pull money directly from your account on a date you authorize.

This method is standard for bills you pay monthly and for one-time purchases from established companies you trust. The merchant doesn't need a card processor, so they save money and sometimes pass that savings to you. Many utility companies and government agencies only accept this method.

The risk is real: if the merchant's database is hacked, someone has the two pieces of information needed to drain your account. Unlike a debit card number, your account number and routing number are permanent—you can't cancel them like you cancel a card. If an unauthorized withdrawal happens, you have to file a dispute with your bank, and the process takes longer than a debit card dispute. Federal law gives you up to 60 days to report it, but your bank may take weeks to investigate and reverse it, leaving your account overdrawn in the meantime.

Only give your account number to merchants you've done business with before or to companies with a physical address and phone number you can verify independently. Avoid it for one-time purchases from unfamiliar sellers.

Payment apps and digital wallets: a buffer between you and the merchant

Apps like PayPal, Venmo, Square Cash, and Google Pay sit between your checking account and the merchant. You link your account to the app, and the app holds the balance or pulls from your account when you authorize a payment. The merchant sees the app's transaction, not your account details.

This is safer than giving your account number directly because the merchant never has access to it. If the merchant's system is breached, the thief gets a PayPal transaction ID, not your routing number. PayPal and similar services have their own dispute processes: if you don't receive an item or it's not as described, you can file a claim within 180 days, and PayPal will often reverse the payment while they investigate.

The limitation: PayPal's buyer protection applies mainly to goods and services, not to peer-to-peer transfers. If you use Venmo to send money to a friend and they don't send you the concert tickets they promised, Venmo won't reverse it—you sent money to a person, not a merchant. The same applies to Cash App, Zelle, and other peer-to-peer apps. Those are for money you're comfortable losing.

Payment apps also charge merchants a fee (usually 2 to 3 percent), so some small businesses and independent sellers won't accept them. Others offer a discount if you pay by ACH or debit card instead.

What happens when a purchase fails or the merchant disappears

If you use a debit card and the charge fails, the merchant typically retries it one or two times automatically. If it succeeds on a retry you didn't authorize, you dispute it with your bank. If it fails permanently, you get a notification from the merchant or your bank, and no money leaves your account.

If you gave the merchant your account number and they charge you after you've canceled a subscription or service, you can file a dispute with your bank. You'll need to show that you canceled—an email confirmation or a screenshot of the cancellation page helps. Your bank will contact the merchant and ask them to prove you authorized the charge. If the merchant can't prove it, the bank reverses it.

If a merchant disappears entirely—the website goes down, the company closes, customer service stops responding—your options depend on how you paid. Debit card and PayPal disputes can still be filed months later. ACH disputes are harder because the merchant is gone and can't respond to the bank's inquiry. You may have to file a complaint with your state's attorney general or the Consumer Financial Protection Bureau, but that doesn't may provide your money back.

Recurring charges and how to stop them

Many online services—streaming platforms, software subscriptions, gym memberships, meal kits—charge your account automatically every month. You authorize the first charge when you sign up, and the merchant keeps charging until you cancel.

To stop a recurring charge, you usually cancel through the merchant's website or app. Some merchants make this straightforward; others bury the cancel button. If you can't find it, call their customer service number. Keep a record of when you canceled—a screenshot or email confirmation.

If the merchant keeps charging after you cancel, contact your bank. You can file a dispute for each unauthorized charge, or you can ask your bank to block all future charges from that merchant. Some banks let you set up a "stop payment" order, which tells the merchant's bank to reject charges from that company. This works for ACH transfers; for debit cards, you may need to cancel the card itself.

If you gave a merchant permission to charge your account and then changed your mind, you have the right to revoke that permission. This is called revoking authorization. Your bank can do this, but the merchant may dispute it and claim you authorized it. Having a record of your cancellation request helps.

Protecting your account number when buying online

Use a debit card instead of your account number whenever possible. Debit cards are replaceable; account numbers are not. If a debit card is compromised, you cancel it and get a new one. Your routing number and account number stay the same for the life of the account.

Check your bank statements weekly, especially after making online purchases. Most banks let you set up alerts for transactions over a certain amount. If you see a charge you don't recognize, report it when ready—the sooner you report it, the faster your bank can reverse it.

For subscriptions and recurring charges, use a payment app or a virtual card number if your bank offers one. Some banks (like Capital One and Citi) let you generate temporary card numbers that expire after one use or one merchant. This way, if the merchant is breached, the card number is already dead.

Never give your account number to a merchant you found through a link in an email or text message, even if the message looks like it came from a company you know. Scammers send fake emails that look identical to real ones. Go directly to the company's website by typing the URL yourself, or call their customer service number from their official website.

Frequently Asked Questions

Can someone use my checking account to buy things online if they have my account number?

Yes, if they also have your routing number. Together, those two pieces of information are enough to set up an ACH transfer or authorize a payment. They can't use just the account number alone. This is why you should never give out your account number to unfamiliar merchants or people.

Is it safer to use a debit card or give my account number directly?

A debit card is safer. The merchant never sees your account number, and your bank's fraud protections kick in faster. If the card is compromised, you cancel it and get a new one. Your account number is permanent and harder to change if it's stolen.

What if I authorize a charge and the merchant never delivers the item?

If you used a debit card or PayPal, you can file a dispute with your bank or PayPal within 60 to 180 days. They will contact the merchant and ask for proof of delivery. If the merchant can't prove they sent it, the charge is reversed. If you sent money through Venmo or Cash App to a person, you have no protection—those apps don't cover goods and services disputes.

Can I stop a recurring charge if I forgot to cancel?

Yes. Contact your bank and explain that you canceled the subscription but the merchant kept charging. Your bank can file a dispute for each unauthorized charge and may be able to block future charges from that merchant. Keep any cancellation confirmation you have from the merchant.

Do I need to give my account number to buy things online?

No. Most online retailers accept debit cards, credit cards, or payment apps like PayPal. Only give your account number to established companies you've done business with before, like your utility company or insurance provider. For retail purchases, use a debit card.