Your checking and savings account numbers are not covered by PCI compliance standards
PCI compliance (Payment Card Industry Data Security Standard) protects credit card numbers, debit card numbers, and the security codes on the back of cards. It does not protect your bank account number or routing number. Those are handled under different rules — primarily the Gramm-Leach-Bliley Act and Regulation E — which means your bank has different legal obligations when those numbers are compromised.
This distinction matters because it changes what happens if someone steals your account information. A stolen credit card triggers PCI-mandated fraud protections and dispute processes. A stolen bank account number triggers a different set of protections, with different timelines and different ways to recover money.
The confusion is understandable: both are financial account numbers, both can be used to take money from you, and both should be kept private. But the legal framework protecting each one is separate, and that affects your rights if something goes wrong.
Key Takeaways
- PCI compliance covers credit and debit card data only, not the bank account numbers behind those cards.
- Bank account and routing numbers are protected under federal banking laws like Gramm-Leach-Bliley and Regulation E, not PCI standards.
- If your account number is compromised, you have up to 60 days to report unauthorized transactions and dispute them with your bank.
- Businesses that handle your account number for direct deposit or ACH payments must follow banking security rules, not PCI rules.
What PCI compliance actually covers
PCI compliance is a set of security standards created by the major credit card networks — Visa, Mastercard, American Express, Discover, and others. It applies to any business that stores, processes, or transmits credit or debit card numbers. The standard requires encryption, firewalls, regular security testing, and strict access controls.
The key word is card numbers. PCI covers the 16-digit number on the front of your card, the expiration date, and the three-digit security code on the back. It covers debit cards too — but only the card number itself, not the underlying bank account number.
When you swipe a debit card at a store, the merchant never sees your bank account number. They see only the card number, which is routed through the card network's secure system. That card number is PCI-protected. Your account number stays between you and your bank.
How bank account numbers are protected instead
Your bank account number and routing number fall under Regulation E, which is part of the Electronic Funds Transfer Act. This rule covers electronic transfers — ACH payments, wire transfers, direct deposit, and automatic bill pay. It also covers the Gramm-Leach-Bliley Act, which requires banks to keep customer financial information confidential and secure.
These rules are enforced by the Federal Reserve, the FDIC, and the Consumer Financial Protection Bureau, not by the credit card networks. They do not require the same specific technical controls as PCI — no mandate for encryption or firewalls in the same way. Instead, they require banks to maintain "reasonable safeguards" and to notify you if your information is breached.
The practical difference: if a business that processes your paycheck through direct deposit gets hacked and your account number is stolen, your bank is not required to meet PCI standards. But your bank is required to investigate unauthorized transfers within a specific timeframe and to reverse fraudulent transactions under Regulation E.
What happens if your account number is compromised
If someone uses your account number to make an unauthorized ACH transfer or automatic payment, you have 60 days from the date you receive your bank statement to report it. This is your window under Regulation E. Report it to your bank in writing — email, phone, or in person — and keep a copy of your report.
Your bank must investigate within 10 business days and either reverse the transaction or explain why it was authorized. If they need more time, they can extend the investigation to 45 days, but they must credit your account provisionally while they investigate. This is different from credit card disputes, where you have 60 days to report but the card network handles the investigation.
The catch: Regulation E protections are strongest for transfers you did not authorize. If you gave someone your account number — a landlord, an employer, a utility company — and they took more money than you agreed to, the dispute process is slower and less certain. You still have 60 days to report, but the bank may argue the transfer was authorized because you provided the number.
Why businesses ask for your account number instead of a card
Employers, landlords, and utility companies often ask for your bank account number for direct deposit or automatic payments instead of taking a credit card. One reason is cost: ACH transfers are cheaper than credit card processing. Another reason is that they do not have to meet PCI compliance standards to handle your account number.
This does not mean they can be careless with it. They still have to follow Regulation E and Gramm-Leach-Bliley — they have to keep it secure and notify you if it is breached. But they do not have to pass a PCI audit, maintain PCI-certified systems, or meet the specific technical requirements that credit card processors do.
From a security standpoint, this is a trade-off. PCI compliance is strict and expensive, which is why credit card processors invest in it. Banking regulations are less prescriptive about how to secure account numbers, which means a small business handling payroll might have weaker security than a credit card processor — even though both are handling sensitive financial data.
Protecting your account number from misuse
Since your account number is not PCI-protected, you have to be more cautious about who you give it to. Do not share it over email, text, or phone unless you initiated the contact and you are certain you are talking to the right organization. Scammers often call claiming to be from your bank or a utility company and ask for your account number to "verify" your information.
When you do provide your account number — for payroll, rent, or bills — use a secure method: in person, through a password-protected website, or through a phone call you initiated to a number you know is correct. Ask the organization what security measures they use to protect it. If they seem evasive or do not have a clear answer, consider using a credit card or a third-party payment service instead.
Monitor your bank statements closely. Check for unauthorized ACH transfers or automatic payments you do not recognize. The sooner you report them, the better your chances of getting your money back. Set up account alerts with your bank so you are notified of large transfers or new payees.
The difference between account numbers and card numbers in a refund context
When you are waiting for a refund — a tax refund, an insurance refund, or a business refund — the method of delivery matters. If the refund is coming by direct deposit, the organization handling it will ask for your account number and routing number. They are not PCI-compliant processors, but they are still bound by banking regulations to keep that information secure.
If the refund is coming by check, no account number is needed. If it is coming by debit card (as some tax refunds do), the card number itself is PCI-protected, but your underlying account number is not. In either case, you should receive a confirmation of the refund method and a tracking number or reference code so you can follow up if the money does not arrive.
The timeline for a direct deposit refund is usually 1 to 3 business days once the refund is issued, but the issuing organization may take weeks to process and issue the refund in the first place. If you do not see the money within the stated timeframe, contact the organization that issued the refund, not your bank — they control when the transfer is sent.
Frequently Asked Questions
Is my account number safer than my credit card number?
Not necessarily. Both can be misused, but the protections are different. Credit card fraud is limited to $50 under federal law, and most card networks waive that. Unauthorized ACH transfers have stronger protections under Regulation E, but only if you report them within 60 days. Neither is inherently "safer" — they are just protected differently.
Do I have to give my account number to get a tax refund by direct deposit?
Yes, if you want the refund deposited directly into your bank account. You will need your account number and routing number. You can find your routing number on the bottom left of a check, or by calling your bank. If you do not want to provide this information, you can request a check instead, though it will take longer to arrive.
What should I do if I think my account number was stolen?
Contact your bank immediately by phone or in person — do not wait for your statement. Ask them to monitor your account for unauthorized transfers and to issue you a new account number if needed. Then watch your statements for the next 60 days and report any unauthorized transactions in writing within that window.
Can a business process a refund to my account without PCI compliance?
Yes. Businesses that issue refunds by direct deposit or ACH transfer do not need PCI compliance. They need to follow banking regulations, but those are different standards. PCI applies only to credit and debit card processing, not to ACH or bank transfers.
Why do some refunds take longer when sent by direct deposit?
Direct deposit itself is fast — usually 1 to 3 business days once sent. The delay is usually in the issuing organization's processing time. They have to verify your refund, generate the transfer, and submit it to the ACH network. That can take weeks depending on the organization and the type of refund.