8

People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure.

Just to clarify:

Giving someone your sortcode and account number allows them to transfer money to your bank... AFAIK there is no way to draw money out of someone's account.

So do you still need such a high level of security on a site as you would say for credit card numbers etc? Would the same care you take over this data as you would for card numbers?

I ask as a client has requested storing the data in their db - they have no SSL certificate to handle this data, but does that matter? Seeing as all someone could do is transfer you money...? Right?

Improve this question
10
  • Interesting question. I was discussing something similar with someone in the US the other day and I don't think we really came to a conclusion. They were sure that you could do all sorts of damage there with that kind of information. The only thing I could think of is setting up a direct debit and then I'd expect my bank to question it if it wasn't to a bill in my name.
    – pdr
    Apr 7, 2011 at 15:52
  • IANAL - but there are a lot of regulations regarding the storage of finanacial data/details. I'd check with the relevant authorities (FSA perhaps?) about the minimum that is required by law. Also, any such information, while not individually valuable, could be of use for identity theft - so I'd strongly recommend taking at least some precautions.
    – TZHX
    Apr 7, 2011 at 15:52
  • This very much reminds my of when Jeremy Clarkson showed his account number and sort code claiming that with that information you can't do anything. By the following week his information had been used and money was going to various charities.
    – Mumbles
    Apr 7, 2011 at 15:54
  • Correct me if I'm wrong but can you not set up a direct debit with just the sort code and account no?
    – billy.bob
    Apr 7, 2011 at 15:58
  • 3
    Is your client planning on accepting personal or financial data over the web? In that case, they NEED an SSL certificate. If they're going to hold financial data, they NEED some security resource other than asking a guy who needs to ask on a Stack Exchange site. This has "bad idea" written all over it.
    – David Thornley
    Apr 7, 2011 at 21:45

6 Answers 6

Reset to default
8

IANAL (I Am Not A Lawyer), but DPA 1998 states

Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen.

http://www.ico.gov.uk/for_organisations/data_protection/security_measures.aspx

I can imagine people being upset if any account information was illicitly accessed.

If you're still not sure, ask your manager.

Improve this answer
5

There was an interesting story from a couple of years ago when Jemery Clarkson (of Top Gear fame) challenged readers to steal money from him using only his bank account details. He believed the same thing you did: that the worst someone could do would be to deposit money into his account.

Clarkson was forced to admit he was wrong after an unidentified prankster set up a £500 direct debit from the presenter's account in favour of charity Diabetes UK

A bit of social engineering and bank details is really all you need to know.

Improve this answer
1

If you can't afford to get an SSL certificate, you really don't have any business storing information that is that personal online. Not having SSL means you don't have a security guy on staff, you're not keeping up with your patches or doing security audits...There are a lot of things that follow from a budget that won't stretch by a couple hundred bucks.

Sure, it may be harder to employ nefariously than a credit card number, but your clients certainly would expect you to take reasonably good care of the information. I would definitely recommend that they do not store that information, and, without SSL, I wouldn't even recommend that they collect it.

Improve this answer
0

Look into what UK laws might apply. There might be laws over this data that require the same security as credit cards.

Find out for sure what can be done with this information if it got into the wrong hands.

It sounds like something I would expect to be guarded if I was your customer.

Improve this answer
0

IANALE (I am not a lawyer either)

Whilst the question was asked some time ago being as the internet lives forever a more relevant answer for today in relation to the Data Protection Act 2018 (UK GDPR) the answer from the Information Commissioners Office I received today: "Nothing specific with regards to account numbers or sort codes. If this is a personal information, the same rules apply as for any other personal data"

It will be Personal Information as long as the data is not entirely anonymous to you. i.e. if it is stored against a name or with a relationship to a person then it's personal information.

Comply with all the usual GDPR regulations and requirements as a bare minimum.

Improve this answer
1
  • 1
    It's important to bear in mind that "personal" data doesn't just mean data that is designed by the data controller to be linked to a named individual within a specific database. It includes storing elements of data that are in practice linked elsewhere to a specific individual. A bank account number may be considered personal data because the bank link it to a specific person, not because the party storing the account number have linked it to a specific person.
    – Steve
    Mar 26, 2020 at 21:34
0

The PCI Security Standards are an excellent source for security practices that of course apply in any country. Other (American) standards such as those for HIPAA Compliance are also extremely relevant here.

Obviously, 100% of the communication that takes place over the public Internet must be encrypted using SSL. (It is now trivially easy to obtain certificates for free using services such as LetsEncrypt, so there are no more excuses.)

Ideally, I think that you should look for someone else in the UK who can bear the burden of actually storing these secrets for you, and for actually performing the requisite money-transfers, so that all you have to store in your database is some "nonce" (meaningful but garbage value) provided by them. There are many so-called "automated clearing house" services out there, probably the most commonly known of these being good ol' PayPal. But, even your local bank might be able to provide services, or point you in the right direction.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.