Take the 2-minute tour ×
Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It's 100% free, no registration required.

My Bank of America checks contain my routing & account number, which I've used in the past to make purchases online, among other things. Anyone whom I pay with a check has this information. It seems like this account info is even more sensitive than my credit card #, since with Visa I am protected with a Zero Liability policy, but I do not know that to be the case for my checking account.

I may be naive, but there's a lot of people I've paid with checks whom I would never give my credit card (e.g. people I've bought from on Craigslist). I'm now wondering if it's irrational to do this.

share|improve this question
1  
I thought that your checking/routing number can be used freely to deposit money, but to withdraw money, it requires confirmation from the account holder. Only thing I can think of is that they forge a check with the numbers? –  Corey Nov 2 '10 at 15:50
5  
Not true. You can deposit OR withdraw money with that number. Ever seen those infomercials where you can just read that number off to them over the phone? Worse yet, they don't even have to confirm that you approved the withdrawal before they process it. –  JohnFx Nov 2 '10 at 20:31
    
That's terrible, and new information to me. I'll have to keep this in mind, but I don't write many checks as it is so I'm not too concerned. –  Corey Nov 2 '10 at 21:26
    
I send cashiers checks or money orders to avoid giving anyone my bank account numbers for this reason; including mortgage and car payments. –  ChuckCottrill Dec 31 '13 at 20:31
    
I am particularly wary with this situation. How is it that when we go to the store they inquire balance right there but when we deposit a false check the system cashes it instead of using that routing and account number to check for balance? –  Mara Clemente Dec 7 at 13:33

6 Answers 6

up vote 12 down vote accepted

Yes, and there are almost no checks (no pun intended) on people pulling money from your account using a routing number. It is an EXTREMELY insecure system. If you want a real Halloween scare, read this article: Easy Check Fraud Technique Draws Scrutiny.

Unfortunately you just have to live with it.

If you are curious why this loophole is allowed to continue, consider how hard it is to close it without undermining the convenience of checks. Short of you going to the bank with each person you write a check to and showing ID to validate the transaction, I don't see how you could continue to use a negotiable instrument like this without such a security hole.

The ultimate answer is going to have to be replacing checks with other means of payment.

share|improve this answer
    
How long can check numbers be? What technical problems would exist with appending a few arbitrary secret digits to each check number, so that instead of the first three checks being 101, 102, 103, they'd be something like 10178342, 10231889, etc. with the bank knowing what the digit sequence should be but recipients of individual checks not? I would think that should be compatible with the existing banking infrastructure, would it not? –  supercat Mar 7 '11 at 0:18
    
I don't see how that would provide any security. Who cares what check number a criminal uses to rob you? –  JohnFx Mar 7 '11 at 1:47
    
@JohnFx: I think supercat's idea is that the bank receiving the check would verify the check-number-checksum before cashing/depositing the check. This could work, except that it would require cooperatin between competing institutions. –  smokris Nov 16 '11 at 17:33
    
Still doesn't solve the problem that anyone you write a check to can re-use the info on the check to draft fraudulently. –  JohnFx Nov 16 '11 at 19:21
1  
@JohnFx You could easily make it so the check numbers can only be used once (see: nonce), are not sequential, and the number is large enough it can't be guessed statistically without trying millions of checks. –  Bryan Anderson Nov 18 '11 at 16:38

Yes, those numbers are all that is needed to withdraw funds, or at least set online payment of bills which you don't owe.

Donald Knuth also faced this problem, leading him to cease sending checks as payment for finding errors in his writings.

share|improve this answer
1  
Look at the wikipedia page, there is the routing number right there. en.wikipedia.org/wiki/Knuth_reward_check. Yup, it is easy to steal from checks with just those digits. –  MrChrister Nov 2 '10 at 23:00
    
Actually, the description of the check image itself (en.wikipedia.org/wiki/File:Knuth-check2.png) reads: "Note that the machine-readable numbers at the bottom of the check have been randomly swapped or modified, so that no personal information about Don Knuth's personal bank account is leaked through this image." –  mskfisher Nov 3 '10 at 11:51

The bottom line is to keep most of your money in accounts with no check privileges and to not give the account numbers for these accounts to anyone. Keep just enough in your checking account for the checks you are going to write.

share|improve this answer
    
This is also a good idea (of course) when you have to give someone your account number so that they can send you money. –  poolie Dec 30 '10 at 23:23

When an someone as esteemed and smart as Donald Knuth tells you the chequing system is busted it's time to close your cheque account, or I guess live with the associated risk.

Answer to question, yes your account information can be used to commit fraud on you via your bank.

share|improve this answer

That's accurate. Here is another risk with the current checking system, which many people are not aware of:

Anyone who knows your checking account number can learn what your balance in that account is. (This is bank-specific, but it is possible at the major banks I've checked.)

How does that work? Many banks have a phone line where you can dial up and interact with an automated voice response system, for various customer service tasks. One of the options is something like "merchant check verification". That option is intended to help a merchant who receives a check to verify whether the person writing the check has enough money in their account for the check to clear. If you select that option in the phone tree, it will prompt you to enter in the account number on the check and the amount of the check, and then it will respond by telling you either "there are currently sufficient funds in the account to cash this check" or "there are not sufficient funds; this check would bounce".

Here's how you can abuse this system to learn how much someone has in their bank account, if you know their account number. You call up and check whether they've enough money to cash a $10,000 check (note that you don't actually have to have a check for $10,000 in your hands; you just need to know the account number). If the system says "nope, it'd bounce", then you call again and try $5,000. If the system says "yup, sufficient funds for a $5,000 check", then you try $7,500. If it says "nope, not enough for that", you try $6,250. Etcetera. At each step, you narrow the range of possible account balances by a factor of two. Consequently, after about a dozen or so steps, you will likely know their balance to within a few dollars. (Computer scientists know this procedure by the name "binary search". The rest of us may recognize it as akin to a game of "20 questions".)

If this bothers you, you may be able to protect your self by calling up your bank and asking them how to prevent it. When I talked to my bank (Bank of America), they told me they could put a fraud alert flag on your account, which would disable the merchant check verification service for my account. It does mean that I have to provide a 3-digit PIN any time I phone up my bank, but that's fine with me.

I realize many folks may terribly not be concerned about revealing their bank account balance, so in the grand scheme of things, this risk may be relatively minor. However, I thought I'd document it here for others to be aware of.

share|improve this answer

I was a victim of this. I'm not sure who got my routing and account number off my check, but someone subscribed to Playboy.com using my bank account information. Luckily it was only for about $30 and the bank refunded my money. However, it was a mess in that I had to open a new checking account and keep the other one open until all checks cleared. The bank was extremely helpful and monitored the account to make sure only the checks I told them about were processed. I then had to close the old account.

This is why I believe checks are much less secure than credit cards or debit cards. A paper check can lay on someone's desk for anyone to pick up or write the information down off of it. I avoid checks if at all possible. For things like Craig's list, I would try to use PayPal or some other intermediate processing service.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.