What Bank Details Are Safe to Give Out (and What Never Is)

What bank details are safe to give out? Only your account holder name, account number and routing number (or sort code, IBAN and SWIFT/BIC abroad). Nobody paying you ever needs your PIN, online banking password, card security code or one-time verification codes. Share payment details only with people you've verified.

What bank details are safe to give out to get paid?

To send you money by bank transfer, a payer needs to know which account to credit and who it belongs to. That's it. In the US that means three things: the name on the account, your account number and your bank's routing number.

Outside the US the labels change but the idea is the same. UK payers need your sort code and account number. Payers in Europe and many other countries use your IBAN, and international transfers usually add a SWIFT/BIC code for your bank.

Some payers also ask for your bank's name or whether the account is checking or savings. That's normal on payroll and direct deposit forms. A landlord collecting rent by transfer gives tenants exactly the same details.

What bank details should you never give out?

Anything that lets someone log in to your account or spend from it is off limits, no matter who asks or how official they sound.

• Your PIN. Not to a client, not to a landlord, not to someone claiming to be your bank.
• Your online banking username and password. A payer never needs to see inside your account.
• Your card security code and full card number. These are for paying, not getting paid. If someone who owes you money asks for your card, something is off.
• One-time passcodes your bank texts or emails you. These approve logins and payments. Anyone asking you to read one back is almost always running a scam.
• Security question answers such as your mother's maiden name or first school.

A useful rule: if a detail would let the other person move money out of your account, they don't need it to put money in.

Is it safe to give out your account and routing numbers?

Mostly, yes. Your routing number is public, and your account number is printed on every paper check you've ever written. Businesses handle these numbers every day for payroll, rent and supplier payments.

That doesn't make them harmless. With your account and routing numbers, a fraudster can try to:

• Set up an unauthorized ACH debit, for example signing you up for a bill or subscription you never agreed to.
• Print counterfeit checks drawn on your account.
• Combine them with other stolen details, like your address and date of birth, to impersonate you to your bank.

The good news is that unauthorized debits can usually be reversed if you catch them. In the US, protections for electronic transfers depend on reporting quickly, generally within 60 days of the statement that shows the charge. So your real defense is checking statements and limiting how many places your numbers sit in plain text.

If you receive a lot of payments as a freelancer or landlord, consider a separate account just for incoming money. If its details leak, your main savings aren't exposed.

Is it safe to give bank details in an email?

It's common, but it's not a good habit. The problem with email usually isn't interception in transit. It's what happens afterwards.

• The message sits in your sent folder and the recipient's inbox for years.
• If either mailbox is ever compromised, an attacker can search for "routing number" and find it in seconds.
• Emails get forwarded, copied into shared inboxes and attached to tickets you'll never see.
• A compromised mailbox is exactly where invoice-redirection scams start.

So is it safe to email account and routing numbers? Sending them once to a verified contact is a modest risk, but leaving a permanent copy in two inboxes adds exposure with no benefit. We cover the wider problems in why email isn't secure enough for sensitive information.

How do invoice-redirection scams work?

For most people being paid, this is the bigger risk, and it has nothing to do with money leaving your account. Instead, the scammer gets your client or tenant to pay them instead of you.

It usually goes like this. A scammer gets into an email account, either yours or the payer's, and quietly watches the thread. When an invoice is due, they send a message that looks like it came from you: "We've changed banks, please use these new details." Sometimes they use a lookalike address with one letter swapped.

The payer updates the details and sends the money. You find out weeks later when you chase an unpaid invoice, and by then the money is usually gone. Landlords see the same trick aimed at tenants, with a fake "new account for rent" email.

How to protect yourself and your payers

• Tell new clients or tenants up front: "My bank details will never change by email. If you get a message saying they have, call me."
• Put that same line on your invoices.
• If you're the one paying, confirm any change of details by calling a number you already have, not one in the email.
• Turn on two-factor authentication for your email. A compromised inbox is where most of these scams begin.
• Avoid leaving your details in old email threads where a scammer can copy the exact format.

How to give out your bank details the safe way

If the payer offers a secure supplier or payroll portal, use it. If they just ask you to "send over your bank details", you can avoid leaving them in an inbox by sending a one-time link instead. Here's how with SecureNotes, which is free and needs no account.

1. Confirm who's asking. Make sure the request comes from someone you know is the payer, ideally after a call or a signed contract.
2. Paste only what's needed. Create a self-destructing note with the account name, account number and routing number (or sort code, IBAN and SWIFT/BIC). Nothing else.
3. Choose when it self-destructs. One view is usually right. Add a time limit such as 24 hours or 7 days so an unopened link doesn't linger.
4. Add a passcode. Anyone who gets hold of the link still can't open it without the code.
5. Send the link. Email it to the payer yourself, or let SecureNotes email it for you. Turn on the read notification so you know when it's been opened.
6. Send the passcode another way. Text it, or say it on a call. Never put it in the same email as the link.

Each note is encrypted with AES-256 using its own random key before it's stored, and once the view or time limit is reached the link stops working. Single-view is the popular choice: in SecureNotes data, 70% of notes are set to self-destruct after one view, while only 17% use a passcode (see the live stats). For bank details, the passcode is worth the extra ten seconds. Our guide to sending the passcode safely walks through the options.

For international formats and what to double-check before you hit send, see how to send bank details securely.

Example: a freelancer's first invoice

Priya is a freelance copywriter who has just finished her first project for a marketing agency. Their accounts team emails: "Please send your bank details so we can set you up as a supplier."

First she checks the email comes from the agency's domain and from the contact she was introduced to on the kickoff call. Then she opens SecureNotes and pastes:

Account name: Priya Shah
Routing number: 0XXXXXXXX
Account number: XXXXXXXXXX
Account type: Checking

She sets it to destroy after 1 view or 7 days, whichever comes first, because accounts teams don't always process supplier forms the same day. She adds a passcode and turns on the read notification.

She replies with the link and writes: "I'll text the passcode to the number on our contract." Two days later she gets an email saying the note has been read.

On the other end, the accounts clerk saw a passcode prompt, entered the code, copied the details into the payment system, and the link stopped working. Nothing usable is left in either inbox. Priya's invoice includes one extra line: "My bank details will not change by email. If you receive a request to change them, call me."

Common mistakes when sharing bank details

• Replying without checking the sender. A one-time link keeps details out of inboxes, but it can't tell you whether you're talking to the real payer. Verify first.
• Putting the passcode next to the link. If both are in the same email, anyone with access to that inbox has both.
• Reading out a code your "bank" just texted you. Banks don't call to ask for verification codes. Hang up and call the number on the back of your card.
• Refunding an overpayment. Someone "accidentally" pays too much, asks for the difference back, and the original payment later bounces. Wait until funds fully clear, or ask your bank to reverse it.
• Posting full details publicly. Bank details on a website or a public invoice template get copied. Send them per client instead.
• Assuming self-destruct means nobody keeps a copy. The recipient can still copy or screenshot what they see. That's expected for a payer who needs the numbers, and it's why you only send to people you've verified.
• Not watching your statements. Fraud using your account and routing numbers is fixable if you catch it early. Check your account regularly, especially after sharing details with someone new.