Routing Number on a Check: Can My Account Get Hacked?

Is giving away the routing number on a check safe? It’s one of many questions that people have about banking and bank accounts. Consumers have natural concerns about their bank accounts being hacked, given there are so many bank breaches. Yet, we’ve become so used to guarding our sensitive information online that we sometimes forget to protect the tangible versions of our financial account, like checks. We may use physical checks less than we used to, but the account information is still commonly used in online transactions. Which begs the question: can a thief hack my account using only the bank’s routing number? The simple answer is no. A routing number is not enough information to transfer money from your account since many people with accounts at your bank will have that same routing number. But in some cases, a savvy hacker with both your routing and account number on a check can impersonate you and potentially take money from your account without permission.

What Is a Routing Number?

Routing numbers are also called ABA Routing Numbers. These 9-digit numbers are assigned by the American Banking Association (ABA) to each bank. Banks may have more than one routing number because of mergers, branches in different states, or other special circumstances. Banks can have up to five routing numbers for internal use, and some websites list ABA numbers for every bank doing business in the United States. Accuity is the company responsible for the registration of the more than 26,895 routing numbers assigned to banks. While you may be tempted never to give someone your routing number, there are a few instances where it is necessary. If you are making electronic payments online to save money, signing up for direct deposit with your employer, or accepting money transfers from someone to your bank account, they will need the routing number on a check. In some cases, they will ask you to provide a voided check to ensure the money goes directly into your account.

The Difference Between Routing Number and Account Numbers

While someone cannot hack your account directly using only your bank’s routing number, a carelessly disposed physical check can compromise your bank account because personal checks contain both your routing and account number. With both of these pieces of information, someone can potentially use them to withdraw money, pay their own bills, purchase items online from vendors, or set up a new account using your funds—all from your checking account. Checks also contain your name and address, giving thieves a greater advantage when it comes to banking identity theft. That said, the risk of this happening isn’t the same in every situation, and in some cases, there may not be any risk at all. In most cases, a thief is more likely to try hacking into a commercial account than a personal account.

Protect Your Routing Number and Banking Information

It’s always best practice to either deliver your account information in person or via the phone (provided you have the conversation in a private place). While there is no 100% hack-proof way to send your personal bank information across the Internet, there are things you can do to increase your protection. While it’s not recommended that you send account information via text, chat, or email, there are times when it’s unavoidable, and the following precautions can help.

1. Use an app with end-to-end encryption: End-to-end encryption apps such as WhatsApp or Viber prevent data from being read or secretly modified, other than by the true sender and recipient(s). The sender encrypts the messages, but the third party does not have the means to decrypt them.
2. If you must use email: consider investing in encryption software such as egress or virtru for this purpose. Some email networks (like Gmail) are encrypted within their own systems, but it’s not foolproof. Email messages move through numerous computers, and you can’t guarantee how the recipient protects his/her email account.
3. Ask questions: These might be uncomfortable conversations, but you have a right to know how your sensitive data is being handled and protected. Although we like to think all people or services store our valuable information securely, this isn’t always the case.
4. Use HTTPS websites: If you’re entering bank account information into a website, make sure it’s protected with HTTPS encryption. Look for HTTPS at the beginning of the URL and/or your browser’s padlock or green coloring near the URL to indicate it’s in a secure mode.
5. Use a secure connection: It’s also important to confirm you’re using a secure Internet connection; public Wi-Fi, even on a plane, isn’t a smart option for sending sensitive data.

Other tips include shredding a voided check before disposal. Additionally, if you provide your routing and account number on a check to someone, make sure you know they are not going to use it for illicit purposes. Your employer, a bank employee, or a company with a legitimate reason for having your bank account information (e.g., mortgage company, utility company) will protect your private information. If you must send a scan of your check, do one of the following:

1. Send the check image as an encrypted PDF or password-protected file and send the password securely—preferably, under a different email address.
2. Take a trip back to the 90s and use good, old-fashioned fax! Faxing is more secure than email. Fax data doesn’t sit around forever, and stealing information from a fax transmission is more cumbersome than forwarding an email. Just make sure the recipient shreds the document properly on his/her end.
3. Or travel further back in time and use Snail Mail. If there’s no rush, ask about mailing the check. While it’s always possible that a check could get lost in the mail, it’s a rare occurrence.

How to Know If Your Information Is Compromised

You may not have any money removed from your account if someone uses the routing and account number on a check. However, you may be denied a credit card and not understand the reasons for the denial. Should this occur, immediately check your credit report for any signs that your information is being used by someone else. Review your report carefully for accounts you do not recognize, inquiries made by credit card companies and lenders, or other suspicious activity that may indicate another person is using your identity.

Ways to Protect Your Bank Account

• Keep all your bank papers that contain personal information in a locked cabinet
• Regularly review your account statements and report suspicious activity right away; consumer protection laws give you 60 days to dispute fraudulent withdrawals.
• Sign up for fraud and suspicious activity alerts from your bank
• Do not share your banking information to someone you do not trust
• Have a separate bank account for your personal and business transactions
• Create a strong account password that uses a combination of upper- and lower-case letters, numbers, and symbols. (Pro tip: think of your favorite song lyric and use the first letter of each word of the lyric—it’s an easier password to remember!)
• If you receive a call from someone insisting that he/she is a bank personnel, do not give out any sensitive information. Hang up immediately, if you find it suspicious.
• Only enter your account information on secure computers and phones you trust and do not send it on a public wi-fi network.

With online banking and other online business the standard now, it’s unreasonable to avoid sharing your bank account information altogether. Ultimately, it’s your responsibility to protect your account and decide with whom you share your banking information. Conducting due diligence on companies, monitoring your accounts frequently, and setting up fraud alerts from your bank are the best ways to keep your account information safe.