People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure.

Just to clarify:

Giving someone your sortcode and account number allows them to transfer money to your bank... AFAIK there is no way to draw money out of someone's account.

So do you still need such a high level of security on a site as you would say for credit card numbers etc? Would the same care you take over this data as you would for card numbers?

I ask as a client has requested storing the data in their db - they have no SSL certificate to handle this data, but does that matter? Seeing as all someone could do is transfer you money...? Right?

  • Interesting question. I was discussing something similar with someone in the US the other day and I don't think we really came to a conclusion. They were sure that you could do all sorts of damage there with that kind of information. The only thing I could think of is setting up a direct debit and then I'd expect my bank to question it if it wasn't to a bill in my name. – pdr Apr 7 '11 at 15:52
  • IANAL - but there are a lot of regulations regarding the storage of finanacial data/details. I'd check with the relevant authorities (FSA perhaps?) about the minimum that is required by law. Also, any such information, while not individually valuable, could be of use for identity theft - so I'd strongly recommend taking at least some precautions. – TZHX Apr 7 '11 at 15:52
  • This very much reminds my of when Jeremy Clarkson showed his account number and sort code claiming that with that information you can't do anything. By the following week his information had been used and money was going to various charities. – Mumbles Apr 7 '11 at 15:54
  • Correct me if I'm wrong but can you not set up a direct debit with just the sort code and account no? – billy.bob Apr 7 '11 at 15:58
  • 3
    Is your client planning on accepting personal or financial data over the web? In that case, they NEED an SSL certificate. If they're going to hold financial data, they NEED some security resource other than asking a guy who needs to ask on a Stack Exchange site. This has "bad idea" written all over it. – David Thornley Apr 7 '11 at 21:45

IANAL (I Am Not A Lawyer), but DPA 1998 states

Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen.


I can imagine people being upset if any account information was illicitly accessed.

If you're still not sure, ask your manager.


There was an interesting story from a couple of years ago when Jemery Clarkson (of Top Gear fame) challenged readers to steal money from him using only his bank account details. He believed the same thing you did: that the worst someone could do would be to deposit money into his account.

Clarkson was forced to admit he was wrong after an unidentified prankster set up a £500 direct debit from the presenter's account in favour of charity Diabetes UK

A bit of social engineering and bank details is really all you need to know.


If you can't afford to get an SSL certificate, you really don't have any business storing information that is that personal online. Not having SSL means you don't have a security guy on staff, you're not keeping up with your patches or doing security audits...There are a lot of things that follow from a budget that won't stretch by a couple hundred bucks.

Sure, it may be harder to employ nefariously than a credit card number, but your clients certainly would expect you to take reasonably good care of the information. I would definitely recommend that they do not store that information, and, without SSL, I wouldn't even recommend that they collect it.


Look into what UK laws might apply. There might be laws over this data that require the same security as credit cards.

Find out for sure what can be done with this information if it got into the wrong hands.

It sounds like something I would expect to be guarded if I was your customer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.