Is it safe to email bank details? The real risk runs the other way

Your new employer wants your account and routing number for direct deposit. A client asks where to send payment. A tenant wants to set up rent transfers. Or an email lands from your contractor saying their bank details have changed. All four come down to the same question.

Is it safe to email bank details?

Emailing your own account and routing number is low to moderate risk, and there are safer ways to do it. The bigger danger runs the other way: an email that tells you to send money to new bank details. That is how business email compromise works, and the FBI received 24,768 complaints about it in 2025, with reported losses of over $3 billion (IC3 2025 report).

So the rule is simple. Send your own details through a portal or a phone call where you can. Never pay new bank details that arrived by email until you have confirmed them on a phone number you already had.

What can someone do with your account and routing number?

Less than with your Social Security number, but not nothing.

The routing number is not a secret. It identifies your bank, not you, and it is shared by many customers. The Federal Reserve publishes an E-Payments Routing Directory that can be searched by bank name, location or routing number (Federal Reserve). It is also printed on every check you write, along with your account number.

Together, the two numbers let money move in and out. They are what an employer needs to pay you and what a utility or landlord needs to pull an automatic payment. In the wrong hands, they can be used to try to set up debits from your account.

Federal rules limit your losses on unauthorized transfers, with a deadline. Under Regulation E, you must report an unauthorized electronic transfer that appears on your statement "within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers" (12 CFR 1005.6). That makes reading your statements the most useful habit if your numbers have been shared widely.

Wire transfers are a different story. The same regulation excludes "any transfer of funds through Fedwire or through a similar wire transfer system that is used primarily for transfers between financial institutions or between businesses" (12 CFR 1005.3). And the rule defines an unauthorized transfer as one "initiated by a person other than the consumer without actual authority" (12 CFR 1005.2), so a payment you send yourself, even to a scammer, is a different problem. That is why the next section matters more than this one.

The bigger risk: emails that change bank details

Here is how most bank-detail fraud actually happens. A criminal gets into, or imitates, the email account of someone you pay: a contractor, a title company, a supplier, your landlord. Then they send a normal-looking message with "updated" payment instructions. You pay, and the money goes to them.

The FBI gives three real examples of business email compromise: "A vendor your company regularly deals with sends an invoice with an updated mailing address," a CEO asks an assistant to buy gift cards, and "A homebuyer receives a message from his title company with instructions on how to wire his down payment." It adds: "Versions of these scenarios happened to real victims ... but all the messages were fake" (FBI).

The FBI also explains how the fake messages get so convincing. Criminals use addresses with "slight variations on legitimate addresses," and malware that can read "legitimate email threads about billing and invoices," so the fake request arrives at exactly the right moment, in the right thread.

The numbers from the IC3's 2025 report:

Business email compromise is not only aimed at companies. The IC3 defines it as a scam "targeting both businesses and individuals performing a transfer of funds."

How to check new bank details before you pay

This takes two minutes, and it is the step a hijacked email account can't fake.

1. Do not reply to the email and do not use any phone number, link or attachment in it.
2. Call the person on a number you already had: from an earlier invoice, a contract, a business card or the company's website. The FBI's advice is to "look up the company's phone number on your own (don't use the one a potential scammer is providing)" and to "verify any change in account number or payment procedures with the person making the request" (FBI).
3. Read the new details back to them and ask them to confirm the account number digit by digit.
4. Look closely at the sender address. The IC3 tells people to verify the address, "especially when using a mobile or handheld device," where the full address is often hidden (IC3). Our guide on how to tell if an email is spoofed shows how to read the real sender.
5. Treat urgency as a warning sign. The FBI says to "be especially wary if the requestor is pressing you to act quickly."

If you are buying a home, do this for every wiring instruction, every time, even if the email comes from the same thread as all the others.

How to send your own bank details more safely

Ranked from best to acceptable:

1. Enter them in the organization's own system. Payroll and HR platforms, landlord portals and invoicing tools exist for this. Reach them by typing the address yourself, not from a link in an unexpected email.
2. Read them out on a phone call you placed to a number you looked up yourself.
3. Send them by end-to-end encrypted email. Only you and the recipient hold the keys, so no readable copy sits on either provider's servers. Our guide on how to send an encrypted email covers the options in Outlook, Gmail and Apple Mail.
4. Send a password-protected PDF and give the password by phone. This suits a direct deposit form or a voided check. The steps are in how to send tax documents securely.

Whichever you use, send the numbers to a person you have confirmed, keep your Social Security number and birth date out of the same message, and write a bland subject line. "Payment details" is fine. "Bank account and SSN for payroll" is not.

I already emailed my bank details. What now?

If you sent them to the right person, the most likely outcome is that nothing happens. To shrink the risk anyway:

1. Ask the recipient to save the details where they belong and delete the email.
2. Delete your copy from Sent, then empty the trash.
3. Turn on transaction alerts in your banking app, so any debit you don't recognize reaches you the same day.
4. Read every statement. You have 60 days from the statement to report an unauthorized electronic transfer and keep the federal protections described above.
5. If the email account you used is shared or has a reused password, change the password and turn on two-step verification. If you think it has already been accessed, follow what to do if your email is hacked.

If you sent them to a scammer, call your bank today and ask whether it recommends a new account number.

What to do if you paid fake bank details

Speed matters more than anything else here. The IC3 says: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents" (IC3 2025 report).

1. Call your bank now. Ask for a recall or reversal of the payment and, as the IC3's BEC page puts it, "a Hold Harmless Letter or Letter of Indemnity" (IC3).
2. File a complaint at ic3.gov, "regardless of the amount lost," with the full transaction details. The IC3 says it "may be able to assist both the financial institutions and law enforcement in freezing funds."
3. Tell the real payee on a number you trust, so they can secure their email account and warn others.

Fast reports work more often than people expect. In 2025, the IC3's Recovery Asset Team handled 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183 of it, which the FBI reports as a 58% success rate (IC3 2025 report).

Is it safe to text bank details?

A standard text message is no better than email. It is not end-to-end encrypted, and it stays in both phones' history and backups. An end-to-end encrypted messaging app is a real improvement. And the same rule applies in reverse: new bank details that arrive by text get the same phone check as ones that arrive by email.

Where Secria fits

The FBI notes that criminals use access to "legitimate email threads about billing and invoices" to time their fake requests. A mailbox full of readable payment threads is exactly what they want. In Secria Mail, every message is stored with zero-access encryption: your keys are made on your device and only reach our servers encrypted, and each message gets its own AES-256-GCM key. Encryption is post-quantum on every plan, with ML-KEM-1024 and X25519 together. There are no ads, we never mine your mail, and tracking pixels are removed automatically and senders never see your IP address.

If you want a separate address just for money matters, the free plan includes 2 aliases. We explain why that helps in separate email for banking: is it worth it?

FAQ

Is it safe to email my bank account and routing number to my employer? It is common and moderately risky. A payroll or HR portal is better, and a phone call to HR is a good second choice. Confirm the request on a number you found yourself first, because anyone can send an email that looks like it came from HR.

Can someone steal money with just my account and routing number? They can try to set up debits from your account. Federal rules limit your losses on unauthorized electronic transfers if you report them within 60 days of the statement that shows them, so turn on alerts and read your statements.

Is it safe to email a copy of a voided check? A voided check shows the same two numbers plus your name and address. Treat it like the numbers themselves: use a portal, or send it as a password-protected PDF with the password given by phone.

Should I trust an email that says a company's bank details have changed? Not until you have called the company on a number you already had and confirmed the new details digit by digit. This is the single most common setup for business email compromise.

What should I do if I sent money to a scammer's account? Call your bank immediately to request a recall, then file a complaint at ic3.gov with all the transaction details. The sooner both happen, the better the chance the money can be frozen.

Bank details will always have to travel sometimes. The email threads around them don't have to sit readable for years. If you want your payment conversations sealed by default, you can start with Secria for free.