🇺🇸 US

Is it safe to share your bank account number or card digits?

USPublished 6 October 2026 · Written by BuyMeWhiskey Editorial Team · How we check facts

A bank account number or the last few digits of a card are not the same as a login password, but they are still sensitive information. Share them only with a verified recipient and never combine them with passwords, one-time codes or other authentication details.

Next question: Why are credit reports not updated in real time? →

If you have already given sensitive information to a suspected scammer, use the FTC recovery steps and contact your bank directly using a trusted number.

Follow the FTC scam-recovery steps

Run your own numbers: Credit card payoff calculator.

An account number is not a bank login

A U.S. bank account number identifies an account; it is not the same thing as the username, password or multi-factor authentication used to access online banking. That distinction matters, but it does not make the number harmless.

Account and routing information can be used in legitimate payment processes, so a customer may sometimes need to provide them to a trusted business. The safer question is not “Is an account number secret?” but “Who is asking, why do they need it, and did I verify them independently?”

Routing number plus account number

A routing number identifies the financial institution or payment route, while the account number identifies the account. Together they can be used for legitimate ACH-related transactions, which is why businesses may legitimately request them for payments.

The risk rises when the request is unexpected or comes with pressure. A scammer may already know a surprising amount about you and use the correct last four digits, ZIP code or other details to sound convincing. The FTC has warned about callers using partial information to build trust and prompt people to reveal more.

What can someone do with the last four digits of a card?

Usually, the last four digits alone are not enough to make a normal card purchase. They are commonly displayed on statements and receipts precisely because they are a shortened identifier. But they can still help a fraudster match information about you or make an impersonation attempt sound credible.

The CFPB notes that legitimate businesses may use the last four digits of a Social Security number or other information as part of identity verification. That means “they knew my last four” is not proof that the caller had full access to the account. It is a reason to slow down and verify the caller.

What about card last four + SSN last four + ZIP code?

That combination is more concerning because it joins several identifiers. The FTC has specifically warned that scammers sometimes know a person's last four Social Security digits, ZIP code or exact credit card balance and use those details to seem legitimate.

Do not treat the caller as genuine just because they can recite personal information. Caller ID can be spoofed, and stolen or leaked data can circulate. End the call and use the phone number on the back of your card, your statement or the institution's official website.

One-time codes are much more sensitive

A verification code sent by text or generated by an authenticator is an authentication secret. The FTC says never share a bank or investment verification code with someone who contacts you. A scammer who has your password but also obtains the code may be able to pass the bank's second security check.

The practical rule is simple: account numbers may sometimes be shared for a legitimate payment, but passwords, PINs and one-time verification codes should never be handed to an unexpected caller.

What if a real credit card company asks for account details?

Sometimes a bank or card company may genuinely need information to set up or verify a payment. The safest way to confirm the request is to contact the company through a channel you already trust, not through the number or link supplied by the caller.

If a company is asking for more information than seems necessary, ask what it is for. A legitimate institution should be able to explain the purpose. You can also log in through the official app rather than following a link in a text or email.

If you already shared the information

The response depends on what you shared. If it was only a card's last four digits, continue monitoring and be alert for follow-up impersonation attempts. If you gave an account number, routing number, card number, Social Security number, username or password, the risk is higher.

Contact your bank or card issuer through a trusted channel.
Change passwords if credentials were exposed, especially where the same password was reused.
Never share an authentication code supplied to your phone or app.
Check account activity and report unauthorised transactions promptly.
Consider a credit freeze if your identity information was exposed.

The FTC says credit freezes are free and can help stop new accounts being opened in your name. IdentityTheft.gov provides a recovery plan when personal information has been misused.

The safest rule

Partial financial information is not the same as a password, but it is still useful to criminals as part of an impersonation chain. The more pieces a person has, the more convincing the next contact can become. Verify the recipient, minimise what you share and keep authentication secrets to yourself.

Illustrative incident: disputed transactions

Worked example

Illustrative example: Maya receives a call from someone claiming to be her card issuer. The caller already knows her ZIP code and the last four digits of her card. He asks her to read out a six-digit verification code that has just arrived by text.

Maya should treat the request for the code as the critical red flag. The FTC says a verification code is used to prove that the person logging in is really the account holder, and a scammer may use the code to get into the account.

She hangs up, opens her bank app independently and calls the number shown there. She does not rely on the caller's number. If the bank confirms that the call was fraudulent, she follows its security instructions and checks for unauthorised activity.

The lesson is that the first pieces of information did not prove the caller was genuine. The code request was the point where the scammer was trying to turn partial knowledge into account access.

Is it okay to give a company my bank account and routing numbers?#

It can be legitimate when the company is verified and genuinely needs the information for a payment or transfer. The risk is higher when the request is unexpected. Confirm the business independently and never give an unexpected caller your online-banking password, PIN or verification code.

Can someone steal money with just my bank account number?#

An account number by itself is not an online-banking password, but it is still sensitive financial information. It can be used as part of payment or fraud attempts, especially when combined with other personal data. Contact your bank if the number was shared with a suspected scammer.

Is the last four digits of a credit card safe to give out?#

The last four digits are commonly used as a shortened card identifier and usually are not enough to make a normal card purchase. They still help scammers sound credible when combined with other information, so unexpected callers should not be trusted simply because they know the last four.

Someone knows my last four SSN digits and ZIP code - should I worry?#

Take it seriously, but do not assume the person has your full identity information. The FTC warns scammers may already know partial data and use it to persuade you to reveal more. End the contact, verify the organisation independently and consider a credit freeze if your identity data was exposed.

Can a scammer get my full card number from the last four digits?#

The last four digits do not normally reveal the rest of a card number. The danger is instead that they can be combined with other stolen or guessed data in an impersonation attempt. Do not provide the missing digits, security code or one-time verification code to an unexpected caller.

What should I do after giving a scammer my bank details?#

Contact the bank immediately through a trusted phone number or app and explain exactly what you disclosed. Change any exposed passwords, monitor the account and follow the bank's security instructions. The FTC also recommends reporting scams and using IdentityTheft.gov when identity information was compromised.

Keep reading

Next question →Why are credit reports not updated in real time?

Sources

Figures were checked against these sources before publication. If a rule changes, we update the page and show the new date.

General information, not personal financial advice. Rules depend on your circumstances; check the official source or speak to a regulated adviser before acting.