What could a malicious party potentially achieve by having *just* a name, account number, and sort code?
I think the answer to this must differ from country to country.  I have lived in several countries where the normal everyday way of making a payment is to instruct my bank to transfer the money to the recipient's account.  Of course this means I must know his name, SC and account number – but this is an accepted part of the system; businesses routinely display that information on invoices and correspondence.  It is simply not regarded as confidential. DumbCoder's comment suggests that if he has that information he can take money from my account without my permission – in other words, my bank will pay money out of my account on someone else's request, without my authority.  Is this correct?  In which country or countries can this happen?   (I must go there quickly and begin stealing people's money.) When you want to pay a bill on line there are several ways to do it. You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.  You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are. You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.  In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.  The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud. I disagree with Dumbcoder's response. Setting up a DD is not easily approved by the banks as you must prove a existing business cash flow. And secondly you cannot empty someone's account via DD as they are protected by the DD mandate. (Money goes out, complaint is made, money goes back in, the registered business with the DD facility has some serious explaining to do to the bank and FCA). Dumbcoder you likely work in a middle position of a company..
"Ally Bank $0 - from their website (emphasis mine): To receive a wire transfer from a non-U.S. bank: Incoming wire transfers from a non-US bank are processed by our   designated receiving bank, JP Morgan Chase Bank, N.A. You'll need to provide the following information to the person or   business sending the wire transfer to you: Receiving Bank: JP Morgan   Chase Bank, N.A. ABA/Routing Number: 021000021 Address: 1 Chase   Manhattan PLZ, New York, NY 10005 SWIFT Code or Bank Identification   Code: CHASUS33 Beneficiary Account Number: 802904391 Beneficiary Name:   List 'Ally Bank' since the wire is being processed by JP Morgan Chase   Bank, N.A. Further Credit: Your Ally Bank Account Number and your name   as it appears on your Ally Bank account. Note: We won't charge you to receive a wire transfer into your Ally   account. https://www.ally.com/help/search.html?term=SWIFT&console=false&context=Help&domain=www.ally.com&section=Help+%26+FAQs Alliant Credit Union $0 - from their website (emphasis mine): Direct international wire transfers  International wire transfers are   handled through our correspondent bank for processing. International   wires can take up to 10 business days to be credited to the receiving   institution. Funds should be wired to: Northern Trust ABA# 071000152 ""Note: US   Banks do not use SWIFT codes. This ABA # is used in place of SWIFT   codes for US Banks."" 50 South La Salle Street, Chicago, IL 60603 For further credit: Alliant Credit Union Account Number 35101804 11545   W. Touhy Avenue, Chicago, IL 60666 For final credit: Member’s name and complete address (No P.O. Box)   Member’s 14-digit account number Destination of funds (checking,   savings or loan number)  Incoming wire transfers: Wire transfers received Monday - Friday,   7:00am - 3:00pm, CT, will be credited to your account the same day.   Wire transfers received after 3:00pm, CT, Monday - Friday and on the   weekend will be credited the next business day. Fees:   We do not charge a fee to receive incoming wire funds. However, the financial institution wiring the funds may charge for this   service. http://www.alliantcreditunion.org/help/receiving-a-wire-transfer-to-your-alliant-account" Given a routing number / account number, it's easy to print a check with those details.  All you need is a MICR font.  No EFT needed. I would recommend that instead, you get his account information, and set up a direct withdrawal.  Of course, then you could potentially use HIS account fraudulently, but that would be true even if he just wrote you a check. Within the bank or group of banks owned by the same company the account number is unique. What is unique is the bank id number and account number combination. If the bank ID number doesn't match a banking institution, the transaction will not be completed. If you are unlucky and your mistake in writing the bank id number does match a bank, you have to hope the account number doesn't match.  The name's do not have to match. Checks have been deposited with incorrect spelling, nick names vs formal names. Mr. and Mrs ... "Anytime you do work without any payment until the work is complete, you are effectively extending credit to the party receiving your service. How much credit you are willing to extend will vary greatly, depending on the amount and the trustworthiness of the party. For example, if you are charging $50 for something, you probably won't bother to collect money upfront, whereas if you are charging $5,000 you probably would collect some upfront. But if the party you are working for is a large financially sound company, the number may be even much higher than $5K as you can trust you will be paid. Obviously there are many factors that go into how much credit you are willing to extend to your customer. (This is why credit reports exist for banks to determine how much credit to extend to you.) As for the specific case you are asking about, which may be classified as a decent amount of work for a small business, I would default to having a written scope of work, a place in the document for both parties to sign, and specify 50% upfront payment and 50% payment at completion. When you receive the signed document and the upfront payment (and possibly even after the check clears), you begin work. I would call this my ""default contract"" and adjust according to your needs depending on the size of the job and the trustworthiness of the customer. As for your question about how to deposit the check, that depends on what type of entity you are. If you are a sole proprietor you should ask for the checks to be made out to you. If you are a business then the checks should be made out to your business name. You don't need ""in trust"" or anything similar because your customer, after paying the upfront fee, must trust that you will do the work you promise to do, just like you have to trust that after completing the work you will receive the final payment. This is the reason the default is 50% before and after. Both parties are risking (roughly) the same amount. Tip: having done the ""default"" contract many times in my career, both as a sole proprietor and a business owner, I can assure you there is a big difference between a potential customer agreeing to something in advance, and actually writing a check. The upfront payment definitely helps weed out those that were never going to end up paying you, even if their intentions were good. Tip 2: be as specific as possible as to what the scope of work will include. If you don't, particularly with software, they'll be adding feature after feature and expecting it to be ""included""." US checking accounts are not really secure, though many people use them. One form of check fraud has been highlighted by Prof. Donald Knuth and carried out by Frank Abagnale, as portrayed in the film Catch Me If You Can. Basically, anyone can write a check that would draw from your account merely by knowing your account number and your bank's ABA routing number.  With those two pieces of information (which are revealed on every check that you write), anyone can print a working check, either using a laser printer with MICR (magnetic ink character recognition) toner, or by placing an order with a check-printing company.  The only other missing element is a signature, which is a pretty weak form of authentication. When presented with such a check, your bank would probably honor it before finding out, too late, that it is fraudulent. A variant of this vulnerability is ACH funds transfers.  This is the mechanism through which you could have, say, your utility company automatically withdraw money from your account to pay your bill.  Unfortunately, the transfer is initiated by the recipient, and the system relies largely on trust with some statistical monitoring for suspicious patterns. Basically, the whole US checking system is built with convenience rather than security in mind, since other institutions are able to initiate withdrawal transactions by knowing just the ABA number and account number.  In practice, it works well enough for most people, but if you are paranoid about security, as you seem to be, you don't want to be using checks. The European system, which has largely eliminated checks in favor of payer-initiated push transactions, is safer by design. It costs money to pull credit information, and there's a record of who requested the info. And hard pulls are only a temporary, short-term ding on your score. Basically, if someone wants to make trouble,  there are better ways to do so. "In Europe in most of the countries there is also a thing called ACH. In UK there is a thing called BACS and in other countires there are other things. Essentially every country has what is called a ""Low value Net Settlement System"" that is used to transfer funds between accounts of different banks. In US there is rounting number, in UK there is a Sort Code, in Indonesia there is a sort code. Essentially a Bank Identifier that is issued by the Governing body within respective countires.   Certian identifiers like SWIFT BIC [Bank Identification Code] are Unique across world." "Yeah... using let's encrypt for the SSL certs.... which I'm certainly not against, but provides even less guarantee they are who they say they are.  High probability of scam.  EDIT: Port 22 is wide open which gives me even less faith.  EDIT 2: I could not find ""Beam"" or ""Meet Beam"" on the FDIC registry either.  https://research.fdic.gov/bankfind/"