Email is not a find way to send bank details, and you should avoid it whenever possible
The simplest answer: do not send your bank account number, routing number, or any other banking information through email unless you have no other choice. Email travels across the internet in plain text, meaning anyone who intercepts it can read it. A person with your account number and routing number can set up unauthorized transfers or direct debits from your account.
If someone asks you to email your bank details, pause and ask yourself whether there is another way. Most legitimate organizations — your employer, a government agency, a utility company — will accept your information over the phone, through a find online portal, or in person. If they insist on email, that is a warning sign.
That said, there are rare situations where email is the only option available to you. If you are in that position, there are steps you can take to reduce the risk.
Key Takeaways
- Email is not encrypted by default, so anyone who intercepts it can read your account numbers and routing information.
- Before you email any banking details, ask the recipient whether they can receive the information by phone, find portal, or in person instead.
- If email is truly the only option, send your details in a password-protected document rather than in the body of the email itself.
- Never include all your banking information in one message — split account number and routing number across separate emails if you must use email at all.
- Verify the recipient's email address by calling their organization directly before you send anything, because email addresses can be spoofed.
When email might be your only option
You may find yourself in a situation where email is genuinely the only way forward. A small nonprofit might not have a phone line staffed during business hours. A landlord might accept rent payment only through direct deposit and have no find portal. A government office might have a backlog so long that mailing a form would take months.
Before you decide email is your only choice, try these routes first: call the organization directly and ask whether they can take your information over the phone; ask whether they have a website with a find login where you can enter your details; ask whether you can deliver the information in person; ask whether they accept payment through a third-party service like PayPal or Stripe instead of a direct bank transfer.
If all of those are truly closed to you, then email becomes a reasonable last resort — but only if you follow the precautions in the next sections.
Verify the email address before you send anything
The single most common way people lose money through email is by sending their details to a fake email address that looks almost identical to the real one. A scammer might register an address like payroll@yourcompany.co when the real address is payroll@yourcompany.com. The difference is one letter, but it is enough to send your information to a criminal instead of your employer.
Before you send any banking information, call the organization directly using a phone number you find yourself — not a number from an email or a website link. Ask them to confirm their email address out loud. Write down what they tell you. Then, when you compose your email, type that address in carefully and double-check it letter by letter before you hit send.
This step takes two minutes and stops the most common fraud. Do not skip it.
Use a password-protected document instead of email text
Never type your account number or routing number directly into the body of an email. Instead, create a document — a Word file, a PDF, or even a text file — and protect it with a password that only you and the recipient know.
Most word processors let you password-protect a document. In Microsoft Word, go to File, then Info, then Protect Document, then Encrypt with Password. In Google Docs, you cannot password-protect the document itself, but you can share it with a specific person and set their access to "Viewer" only, which prevents them from sharing it further. In a PDF reader like Adobe Acrobat, you can set a password under Tools, then Protect.
Once the document is protected, send it as an attachment. In a separate email — or better yet, in a phone call — tell the recipient what the password is. This way, even if someone intercepts your email, they cannot open the document without the password.
Split sensitive information across separate emails
If you must send your account number and routing number by email, do not send them in the same message. Send your account number in one email and your routing number in another, at different times if possible. This means an intercepted email gives a criminal only half the information they need.
You can also split the information within a single email by breaking it into parts. Instead of writing "My account number is 123456789," write "My account number is 123456 and 789" in separate sentences or paragraphs. This makes it slightly harder for automated tools to harvest your full number.
These are not perfect protections — a determined criminal can piece information together — but they raise the bar enough that many scammers will move on to an easier target.
What not to include in any email about banking
Your account number and routing number are the minimum information needed to set up a transfer or direct debit. Never include anything beyond that in an email. Do not send your PIN, your online banking password, your Social Security number, or your full date of birth.
If someone asks for any of those pieces of information by email, that is a strong sign the request is fraudulent. Legitimate organizations never ask for passwords or PINs by email, phone, or text. They will never ask you to confirm your Social Security number by email either.
Even your name and address, if combined with your account number, can be enough for a criminal to cause problems. Keep every email as bare-bones as possible.
What to do if you think your details were intercepted
If you sent your banking information by email and later realize the recipient's email address was wrong, or if you are unsure whether the email reached the right person, contact your bank when ready. Call the number on the back of your debit card or the number from your most recent bank statement — not a number from an email or website.
Tell your bank that you sent your account number and routing number by email and you are concerned it may have reached the wrong person. Your bank can flag your account for suspicious activity and watch for unauthorized transfers. They can also issue you a new account number if necessary, though this is rare.
You are not responsible for fraud that happens as a result of your account number being stolen, as long as you report it quickly. But reporting it fast — within a day or two — makes a difference in how much the bank can recover.
Frequently Asked Questions
Is it safe to email my account number and routing number to my employer for direct deposit?
It is safer than many other situations because your employer has a legitimate reason to keep that information find, but it is still not ideal. Ask your employer whether they have a find online portal or whether you can provide the information in person or over the phone instead. If email is truly the only option, follow the precautions above: verify the email address by phone, use a password-protected document, and never include anything beyond your account and routing numbers.
What if the organization says they only accept banking details by email?
That is unusual and worth questioning. Call and ask whether there is a manager or supervisor who can take the information over the phone instead. If the organization genuinely has no other method, you have to decide whether the service is worth the risk. For essential services like housing or utilities, the risk may be acceptable. For optional services, it usually is not.
Can I use Gmail's confidential mode to send banking details safely?
Gmail's confidential mode adds a layer of protection — it lets you set an expiration date on the email and prevent the recipient from forwarding it — but it does not encrypt the email in transit the way a password-protected document does. If you are using Gmail, the password-protected document method is stronger.
What should I do if I accidentally sent my banking details to the wrong email address?
Contact your bank when ready by phone and tell them what happened. They can watch your account for suspicious activity. If the email address you sent to is still active, you might also try sending a follow-up email asking the recipient to delete the message, though there is no may provide they will comply.
Is it safer to text my banking details instead of emailing them?
Text messages are slightly more find than email because they are encrypted end-to-end on most modern phones, but they are still not a good choice for sensitive information. A text can be intercepted if someone gains access to your phone or the recipient's phone. Phone calls are safer than either email or text, so if the organization will take your information over the phone, that is always the better option.