Giving your checking/savings account number to someone is incredibly insecure - they can debit your account! The routing numbers are public information. How can I have an account that only accepts deposits?

A very common example is paying by check - the recipient has your checking and routing numbers. This can and has been used for fraud.

In the banking world: I've had an account with OldBank, and recently opened an account with NewBank. In order to transfer money from OldBank to NewBank (both US banks), I could either give OldBank my NewBank login details (no, thanks), or verify two deposits < $1. Standard procedure.

The problem is that OldBank wanted my savings account #, and the routing number of NewBank (the latter being public information). I gave those and verified the two deposit amounts. Great. But then I saw that OldBank also withdrew an amount equal to the sum of those two <$1 amounts - which means OldBank can withdraw money from my NewBank account at any time.

That is not what I want. Coming from the Bitcoin world, the bank situation is incredibly insecure. With Bitcoin (or any other cryptocurrency), you give the world your public receiving address, and keep your private withdrawal key. Anyone can deposit money into your account, but only you can withdraw. This makes perfect sense to me.

Is there an equivalent for banks in the US, or is the state of bank transfer security situation as ridiculous as the one with checks?

Are there US banks that allow designating accounts as "external entities can only deposit"?

How about foreign banks?


A handful of banks simply refuse all external ACH debit requests. I'm not aware of any that let you choose.

But most US banks will allow you to maintain multiple accounts at no additional charge. Then you can use one account for linking to external accounts, and a different one for keeping your money. If you decline overdraft transfers, then without the account number for the second account, external banks can't touch your funds.


The situation is actually worse than you think. The default position of North American banks is that if anyone who has your bank account details, and is a reasonably reputable financial institution, asks for money from your account then your bank will give it to them. There is literally nothing you can do to prevent this. The only way to prevent such unauthorized access is to change the account details. There are dispute procedures that may allow you to get your money back, but they are time-consuming and dependent to some extent on the goodwill of both financial institutions.

It's worth noting that most banks outside North America want to see the document that authorized the withdrawal before they let funds out.

  • 1
    "There are dispute procedures that may allow you to get your money back, but they are time-consuming and dependent to some extent on the goodwill of both financial institutions." What a terrible system is this? In Europe, the banks don't necessarily want to see the direct debit SEPA mandate, but if you found a debit to be unauthorized, you just tell your bank within 8 weeks (or, in certain circumstances, within 13 months) and it will immediately be reversed. – glglgl Feb 11 at 18:30

This type of service does exist, although it is usually something attached to business banking accounts, not personal accounts. You are actually issued a second account number that is linked to your account but is deposit-only. You would just need to ask around at banks to see if anything like this is available for your personal account.

  • 1
    Do you know what this is called? – krubo Feb 18 '19 at 3:50

I never provide the log in details of an account to another financial entity. I agree with you, no thanks.

My experience in the US over 20 years (finite sample of 15 or so banks) is that when you do the two trial deposits routine, it only enables the sender of the deposits to have an active transfer link. To have it go both ways, it has to be done on both sides.

I would not be concerned about setting these up between two US banks that have routing numbers, FDIC insurance, etc. That makes them legitimate.

Though I have no experience with them, I would never do this with a foreign entity nor anything like Bitcoin or other. Subsidiaries of foreign banks meeting US regulatory standards (chartered in the US and members of the Federal Reserve) would be fine (Barclays Bank, Deutsche Bank, etc.).

  • We can trust the banks, but what about giving checks to landlords? Say it's my last month at a landlord. I give them the last check. They put it on the table and have new tenants visit the place. One of them takes a photo of my check. – Dan Dascalescu Feb 13 '19 at 20:32
  • Not only does the prospective tenant see your check but so does everyone who handles it, all the way to the teller at the bank who cashes/deposits it. Open a bank account, a brokerage account, pay your doctor with a check or a credit card. Your personal information is out there, everywhere (SSN, Drivers License #, DOB, credit card #s, account #'s, health information, tax returns, etc.). – Bob Baerker Feb 13 '19 at 22:32
  • Credit cards at least have fraud protection as a standard feature, and there are many services offering one-time credit card numbers. – Dan Dascalescu Feb 13 '19 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.