Identifier assigned to a deposit, loan, or other account within a financial institution and used with routing details to direct payments.
A bank account number is an identifier a financial institution assigns to a specific deposit, loan, or other account in its records. It directs entries to the account when used with the correct institution or routing information, but its format, length, and permitted characters vary by country, bank, account type, and payment system.
The bank defines the account-number namespace. Two institutions can assign the same local account number because the accompanying routing identifier distinguishes the banks. One institution can also maintain different number formats for checking, savings, loans, virtual accounts, or legacy systems.
An account number is not automatically the same as:
| Identifier | What it identifies |
|---|---|
| Customer number | A customer relationship that may contain several accounts |
| U.S. routing number | The financial institution or processing point used for checks or electronic payments |
| U.K. sort code | The payment service provider and routing record used with a domestic account number |
| IBAN | A country-standardized international account identifier containing country code, check digits, and BBAN |
| BIC or SWIFT code | An organization identifier used in financial messaging |
| Card PAN | The payment-card account credential used for card authorization and routing |
| Payment reference | Information used to reconcile a transfer after it reaches an account |
A payment reference cannot repair a wrong account number. It helps the recipient identify the purpose of a correctly routed payment.
For many ACH payments, a payer supplies a nine-digit routing number and the receiver’s account number. Account-number length is institution-specific. The number printed on a check can also appear alongside the check serial number, so users should confirm the correct field with their bank rather than rely only on position.
A domestic instruction commonly uses a six-digit sort code and an account number. The sort code routes toward the payment service provider; the account number identifies the account in that provider’s records. For a GB IBAN, these domestic components are embedded within the BBAN portion.
An IBAN adds a country code and check digits to a country-defined BBAN. The BBAN can contain a bank identifier, branch identifier, domestic account number, and national check characters according to that country’s registered format.
IBAN standardizes the outer structure and validation method. It does not make every country’s internal account format identical.
Payment teams should distinguish four questions:
These checks are not interchangeable. Nacha explains, for example, that the minimum account-validation standard for covered online consumer ACH debits determines whether an account is legitimate, open, and capable of receiving ACH entries; it does not automatically require proof of account ownership.
A successful micro-deposit, prenotification, API response, or checksum can answer a narrow validation question without proving that an invoice-change email came from the real supplier.
Assume a company regularly pays a supplier using routing number R1 and account number A1. An email apparently from the supplier requests that future payments go to routing number R2 and account number A2.
The accounts-payable system confirms that R2 is a structurally valid routing number and that A2 accepts ACH credits. Those checks reduce data-entry risk but do not prove the email is genuine or that the supplier owns A2.
A stronger process would:
If the company sends $75,000 to a fraudster-controlled account, the fact that both identifiers were valid does not make the instruction authorized. Validity, ownership, and authorization are separate controls.
Bank account numbers appear in:
The required fields depend on the payment rail. A bank may publish different instructions for ACH, domestic wires, international wires, or intermediary-bank routing. Reusing details from one rail without confirmation can produce a rejection, delay, or misdirected transfer.
An account number is not a password, PIN, or one-time authentication code, and businesses often need it to initiate authorized payments. That does not make it public information.
Risks include fraudulent debit attempts, payment-redirection fraud, social engineering, account enumeration, and exposure through invoices, spreadsheets, email, or logs. Appropriate controls can include:
Do not send a password, PIN, card verification code, or one-time security code merely because someone already knows an account number.
An incorrect instruction can be rejected, returned, delayed, posted to an unintended account, or held for repair. The result depends on the payment system, bank controls, and whether the number corresponds to an existing account.
Contact the sending institution immediately. Provide the transaction date, amount, reference, beneficiary details, and the instruction actually used. A bank may attempt a recall or trace, but recovery is not guaranteed, especially if funds have already been withdrawn or transferred onward.
For recurring payments or stored vendor details, correct the master record as well as the individual transaction. Otherwise the next payment can repeat the error.
Payment rules, error rights, and recovery procedures vary by jurisdiction and payment rail. This page provides general education, not legal, compliance, cybersecurity, or personalized financial advice.