Is it safe to share your routing number?
Routing numbers are public information, but they're not entirely harmless. Here is what someone can — and can't — do with one.
What the routing number is
Every nine-digit ABA routing number is published in the Federal Reserve's FedACH directory and reproduced across countless reference sites — including this one. By design, the routing number is meant to be shared freely. It's on every paper check you write, printed inside your online banking dashboard, and listed on your bank's contact page. It's as public as your bank's phone number.
What a fraudster cannot do with just your routing number
A routing number on its own is essentially useless to a thief. They can't initiate an ACH debit (they need your account number for that), they can't log into your online banking (they'd need your username and password), and they can't move funds without account-level credentials. Calling a stranger's bank, providing only the routing number, and asking for money would get the caller laughed off the phone.
What becomes risky once the account number is added
The combination of routing number + account number is the floor for ACH origination. With both numbers, a malicious actor can:
- Originate an ACH debit against your account, claiming you authorized a recurring payment to them. The receiving bank typically processes the debit on first attempt; you'd see the charge on your statement and need to dispute it.
- Print a counterfeit check drawn on your account, using the MICR line they constructed from the two numbers. Stores accept the check, the receiving bank credits the merchant, and your bank later traces the fraud back and reverses it — but the merchant has already lost the goods.
- Sign you up for ACH-funded subscriptions — gym memberships, mobile-phone plans, even mortgage payments — that drain small amounts each month until you notice.
All of these are recoverable under federal consumer protection regulations (Reg E for personal accounts), but recovery takes weeks and tightly defined dispute windows.
Practical safety rules
- Treat your routing number as not secret. Sharing it with an employer for direct deposit, a vendor for a refund, or a tax service for a refund is normal and safe.
- Treat your account number as sensitive but not catastrophic. Share it for legitimate purposes (direct deposit, ACH bill-pay setup, brokerage funding), but don't post it on social media, send it over unencrypted text, or include it in cloud-shared documents.
- Treat your full account credentials (username, password, MFA codes) as highly sensitive. Never share them with anyone, including someone claiming to be from your bank.
- Review your statements monthly for any ACH debits you don't recognize. Reg E gives you 60 days to dispute unauthorized ACH activity for a full refund.
What to do if you've already shared your account number with someone you no longer trust
Call your bank and ask whether they can either close the account and reopen a new one, or place an "ACH block" or "ACH filter" on your existing account. ACH blocks reject all incoming debits except those from a pre-approved list of originators; ACH filters accept everything but flag unrecognized originators for your review. Both are standard offerings at most US banks, often free for consumer accounts.