Most of the time, giving out your account number alone is low risk — but context matters enormously

Your bank account number by itself cannot drain your account. A thief needs your routing number, account number, and usually your name to set up an unauthorized transfer or payment. That said, the real danger is not the number itself but who you give it to and why. Sharing with your employer's payroll department or the IRS for a refund is routine and safe. Sharing with someone who contacted you out of the blue, or someone asking you to send money first, is a setup for fraud.

The key distinction is whether you initiated the contact or they did. If you called your bank, your insurance company, or a government agency, you control the conversation and can verify you are talking to the right place. If someone called you, texted you, or emailed you asking for your account number, the risk jumps sharply — even if they claim to represent a company you trust.

Key Takeaways

  • Your account number alone cannot be used to withdraw money, but combined with your routing number it can be used to set up unauthorized transfers or payments.
  • Sharing your account number is safe when you initiated contact with a known organization like your employer, bank, or the IRS for a legitimate transaction.
  • Never share your account number with someone who contacted you first, especially if they claim there is a problem with your account or a refund waiting for you.
  • Scammers often pose as tax authorities, insurance companies, or banks and use urgency or threats to pressure you into sharing account details.
  • If you have already shared your account number with someone suspicious, contact your bank immediately and ask them to monitor for unauthorized activity.

Safe situations: when you initiated the contact

Giving your account number is routine and safe when you are the one who started the conversation. This includes setting up direct deposit with your employer, arranging a wire transfer to pay a bill you owe, or providing banking details to the IRS so they can deposit a tax refund. In these cases, you know who you are talking to because you chose to call them or visit their official website.

The same applies to insurance refunds, utility company refunds, or business refunds you are expecting. If you called the company to ask about a refund and they ask for your account number to process it, that is a normal part of the transaction. The organization has already verified who you are through your policy number, account number with them, or other identifying information before they ask for banking details.

Government payments also fall into this category. If you are waiting for a tax refund, stimulus payment, or unemployment benefit, you can safely provide your account number to the relevant agency — either by phone if you initiated the call, through their official website, or by mail using official forms. The IRS, state tax agencies, and Social Security all accept banking information this way.

Dangerous situations: when they contacted you first

Never share your account number with someone who called, texted, or emailed you first, even if they claim to represent your bank, the IRS, or an insurance company. This is how most financial fraud starts. Scammers are skilled at sounding official and creating a sense of urgency — they may claim your account has been compromised, a refund is waiting, or you owe money.

The IRS does not call people about refunds or payments. They mail notices. If someone calls claiming to be from the IRS and asks for your account number, it is a scam. The same goes for banks — your actual bank will not call you asking for your account number to "verify" it. They already have it. If you receive such a call, hang up and call your bank directly using the number on your statement or their official website.

Insurance companies, utility companies, and government agencies may contact you about legitimate refunds, but they will not ask for your full account number over the phone on a first contact. They may ask for the last four digits to confirm you are the account holder, but they will not ask you to recite all sixteen digits to a stranger. If someone does, treat it as a red flag.

Red flags that signal a scam

Certain phrases and tactics are almost always signs of fraud. Anyone who says they need your account number "right now" or "before the end of the day" is using pressure to bypass your judgment. Legitimate refunds and payments do not expire in hours. Anyone who threatens to freeze your account, report you to the IRS, or take legal action unless you provide banking information immediately is running a scam.

Requests for payment before a refund is also a classic setup. If someone claims you have a refund coming but first need to pay a fee, tax, or processing charge, it is fraud. Real refunds do not work that way. The same applies to anyone asking you to send money via wire transfer, gift card, or cryptocurrency in exchange for a refund or payment — legitimate organizations do not operate this way.

Be skeptical of unsolicited contact about money you were not expecting. If you were not waiting for a refund, a payment, or a settlement, and someone calls to tell you one is coming, verify the claim independently. Look up the organization's phone number yourself — do not use a number the caller provided — and call to confirm whether the contact was real.

What to do if you have already shared your account number

If you shared your account number with someone you now suspect was a scammer, contact your bank immediately. Tell them the situation and ask them to monitor your account for unauthorized activity. Many banks can flag your account for extra scrutiny or issue a new account number if the risk is high enough.

You should also place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can place an alert by contacting any one of the three bureaus; they will notify the others. The alert lasts one year and is free.

If unauthorized transfers have already occurred, file a report with your bank and the Federal Trade Commission at ReportFraud.ftc.gov. Keep records of all communications with the scammer, including dates, times, phone numbers, and what was said. Your bank may be able to reverse unauthorized transfers if you report them quickly, usually within 60 days.

How scammers use account numbers once they have them

With your account number and routing number, a scammer can set up unauthorized ACH transfers — electronic transfers between bank accounts. They can also set up bill payments in your name or attempt to open new accounts using your information. They cannot directly withdraw cash from an ATM or make purchases with a debit card, but they can move money out of your account electronically.

This is why acting quickly matters. The sooner you notify your bank, the sooner they can freeze the account, issue a new number, or reverse fraudulent transfers. Federal law limits your liability for unauthorized electronic transfers if you report them within 60 days, but the limit shrinks if you wait longer. Reporting within two business days keeps your liability to $50; waiting 60 days can expose you to $500 or more in losses.

Protecting your account number going forward

The safest practice is to never volunteer your full account number unless you initiated the contact and you are certain you are talking to a legitimate organization. When you must provide it, use official channels — call the main number on your statement or visit the official website, not a number or link from an email or text message.

Be especially cautious about account numbers in emails and text messages. Legitimate organizations rarely ask for banking details via email. If you receive an email claiming to be from your bank or the IRS asking for your account number, do not click any links or reply. Instead, call the organization directly using a number you know is correct.

For refunds and payments you are expecting — tax refunds, insurance refunds, business refunds — you can often choose how to receive the money. Direct deposit to your bank account is faster and safer than a check, but only if you initiate the request through official channels. Never provide banking information in response to unsolicited contact, no matter how official it sounds.

Frequently Asked Questions

Can someone steal money with just my account number?

Not directly. They need both your account number and routing number to set up an unauthorized transfer. With both pieces of information, they can move money out of your account electronically. This is why you should treat both numbers as sensitive, though sharing your account number alone with a trusted organization is generally safe.

Is it safe to write my account number on a check?

Yes. Your account and routing numbers are printed on every check you write, and checks are regularly handled by mail carriers, bank employees, and store staff. The risk of fraud from a check is low because the numbers alone cannot be used to drain your account — someone would need to forge a check or set up an ACH transfer, both of which leave a paper trail.

What should I do if a company asks for my account number by email?

Do not reply to the email. Call the company directly using the phone number on your official statement or their website. Legitimate organizations rarely ask for banking details via email because email is not secure. If the request is real, the company will be able to help you when you call.

Can the IRS call me about a refund?

No. The IRS communicates about refunds by mail only. If someone calls claiming to be from the IRS and asks for your account number, it is a scam. Hang up and do not provide any information. You can verify your refund status on the IRS website or by calling the IRS yourself using the number on their official site.

How long do I have to report unauthorized transfers?

Federal law gives you 60 days from the date your bank statement shows an unauthorized transfer. However, your liability is lowest if you report within two business days — $50 maximum. After 60 days, you may lose all protection. Contact your bank as soon as you notice suspicious activity.