54

My Bank of America checks contain my routing & account number, which I've used in the past to make purchases online, among other things. Anyone whom I pay with a check has this information. It seems like this account info is even more sensitive than my credit card #, since with Visa I am protected with a Zero Liability policy, but I do not know that to be the case for my checking account.

I may be naive, but there's a lot of people I've paid with checks whom I would never give my credit card (e.g. people I've bought from on Craigslist). I'm now wondering if it's irrational to do this.

8
  • 1
    I thought that your checking/routing number can be used freely to deposit money, but to withdraw money, it requires confirmation from the account holder. Only thing I can think of is that they forge a check with the numbers?
    – Corey
    Nov 2, 2010 at 15:50
  • 7
    Not true. You can deposit OR withdraw money with that number. Ever seen those infomercials where you can just read that number off to them over the phone? Worse yet, they don't even have to confirm that you approved the withdrawal before they process it.
    – JohnFx
    Nov 2, 2010 at 20:31
  • 1
    That's terrible, and new information to me. I'll have to keep this in mind, but I don't write many checks as it is so I'm not too concerned.
    – Corey
    Nov 2, 2010 at 21:26
  • 1
    I send cashiers checks or money orders to avoid giving anyone my bank account numbers for this reason; including mortgage and car payments. Dec 31, 2013 at 20:31
  • 2
    I am particularly wary with this situation. How is it that when we go to the store they inquire balance right there but when we deposit a false check the system cashes it instead of using that routing and account number to check for balance?
    – user22926
    Dec 7, 2014 at 13:33

7 Answers 7

35

Yes, and there are almost no checks (no pun intended) on people pulling money from your account using a routing number. It is an EXTREMELY insecure system. If you want a real Halloween scare, read this article: Easy Check Fraud Technique Draws Scrutiny.

Unfortunately you just have to live with it.

If you are curious why this loophole is allowed to continue, consider how hard it is to close it without undermining the convenience of checks. Short of you going to the bank with each person you write a check to and showing ID to validate the transaction, I don't see how you could continue to use a negotiable instrument like this without such a security hole.

The ultimate answer is going to have to be replacing checks with other means of payment.

21
  • 3
    How long can check numbers be? What technical problems would exist with appending a few arbitrary secret digits to each check number, so that instead of the first three checks being 101, 102, 103, they'd be something like 10178342, 10231889, etc. with the bank knowing what the digit sequence should be but recipients of individual checks not? I would think that should be compatible with the existing banking infrastructure, would it not?
    – supercat
    Mar 7, 2011 at 0:18
  • 2
    @JohnFx: I think supercat's idea is that the bank receiving the check would verify the check-number-checksum before cashing/depositing the check. This could work, except that it would require cooperatin between competing institutions.
    – smokris
    Nov 16, 2011 at 17:33
  • 2
    @JohnFx You could easily make it so the check numbers can only be used once (see: nonce), are not sequential, and the number is large enough it can't be guessed statistically without trying millions of checks. Nov 18, 2011 at 16:38
  • 1
    @JohnFx: If it's so easy how do you actually withdraw money from someone's account given their account information? I feel like everyone says it's a piece of cake, but no one describes how, which is ironic given that it's supposed to be so easy and legal (assuming you have their permission).
    – user541686
    Aug 9, 2014 at 0:05
  • 1
    @Joshua - When a withdrawal is made using the ACH system, there is no check number involved. All that's necessary is the routing number and the account number. Even the account holders name is not required. Jun 21, 2015 at 9:26
17

Yes, those numbers are all that is needed to withdraw funds, or at least set online payment of bills which you don't owe.

Donald Knuth also faced this problem, leading him to cease sending checks as payment for finding errors in his writings.

2
  • 1
    Look at the wikipedia page, there is the routing number right there. en.wikipedia.org/wiki/Knuth_reward_check. Yup, it is easy to steal from checks with just those digits.
    – MrChrister
    Nov 2, 2010 at 23:00
  • 2
    Actually, the description of the check image itself (en.wikipedia.org/wiki/File:Knuth-check2.png) reads: "Note that the machine-readable numbers at the bottom of the check have been randomly swapped or modified, so that no personal information about Don Knuth's personal bank account is leaked through this image."
    – mskfisher
    Nov 3, 2010 at 11:51
6

That's accurate. Here is another risk with the current checking system, which many people are not aware of:

Anyone who knows your checking account number can learn what your balance in that account is. (This is bank-specific, but it is possible at the major banks I've checked.)

How does that work? Many banks have a phone line where you can dial up and interact with an automated voice response system, for various customer service tasks. One of the options is something like "merchant check verification". That option is intended to help a merchant who receives a check to verify whether the person writing the check has enough money in their account for the check to clear. If you select that option in the phone tree, it will prompt you to enter in the account number on the check and the amount of the check, and then it will respond by telling you either "there are currently sufficient funds in the account to cash this check" or "there are not sufficient funds; this check would bounce".

Here's how you can abuse this system to learn how much someone has in their bank account, if you know their account number. You call up and check whether they've enough money to cash a $10,000 check (note that you don't actually have to have a check for $10,000 in your hands; you just need to know the account number). If the system says "nope, it'd bounce", then you call again and try $5,000. If the system says "yup, sufficient funds for a $5,000 check", then you try $7,500. If it says "nope, not enough for that", you try $6,250. Etcetera. At each step, you narrow the range of possible account balances by a factor of two. Consequently, after about a dozen or so steps, you will likely know their balance to within a few dollars. (Computer scientists know this procedure by the name "binary search". The rest of us may recognize it as akin to a game of "20 questions".)

If this bothers you, you may be able to protect your self by calling up your bank and asking them how to prevent it. When I talked to my bank (Bank of America), they told me they could put a fraud alert flag on your account, which would disable the merchant check verification service for my account. It does mean that I have to provide a 3-digit PIN any time I phone up my bank, but that's fine with me.

I realize many folks may terribly not be concerned about revealing their bank account balance, so in the grand scheme of things, this risk may be relatively minor. However, I thought I'd document it here for others to be aware of.

5

The bottom line is to keep most of your money in accounts with no check privileges and to not give the account numbers for these accounts to anyone. Keep just enough in your checking account for the checks you are going to write.

2
  • This is also a good idea (of course) when you have to give someone your account number so that they can send you money.
    – poolie
    Dec 30, 2010 at 23:23
  • @poolie There are several 3rd party payment sites that would suffice to fill in this gap: Venmo, Zilla, etc. This can sufficiently, and freely transfer money to/from your checking account, and act as an intermediary step between you and untrusted parties.
    – Shorlan
    Dec 17, 2018 at 21:28
4

When an someone as esteemed and smart as Donald Knuth tells you the chequing system is busted it's time to close your cheque account, or I guess live with the associated risk.

Answer to question, yes your account information can be used to commit fraud on you via your bank.

3

I was a victim of this. I'm not sure who got my routing and account number off my check, but someone subscribed to Playboy.com using my bank account information. Luckily it was only for about $30 and the bank refunded my money. However, it was a mess in that I had to open a new checking account and keep the other one open until all checks cleared. The bank was extremely helpful and monitored the account to make sure only the checks I told them about were processed. I then had to close the old account.

This is why I believe checks are much less secure than credit cards or debit cards. A paper check can lay on someone's desk for anyone to pick up or write the information down off of it. I avoid checks if at all possible. For things like Craig's list, I would try to use PayPal or some other intermediate processing service.

-2

Yes this is a huge security loophole and many banks will do nothing to refund if you are scammed. For example for business accounts some Wells Fargo branches say you must notify within 24 hours of any check withdrawal or the loss is yours. Basically banks don't care - they are a monopoly system and you are stuck with them. When the losses and complaints get too great they will eventually implement the European system of electronic transfers - but the banks don't want to be bothered with that expense yet.

Sure you can use paypal - another overpriced monopoly - or much better try Dwolla or bitcoin.

1
  • PayPal is it is often linked to draw from your checking account. I know PayPal can draw from your checking account. Can your checking account (if insufficient funds, but sufficient in PayPal) draw from your PayPal account?
    – TARKUS
    May 23, 2017 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .