Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to collect bank account information from my customers on my website.

I'd like to do that through a form, then I will download it to a PC, print it, and then delete it from the website. Or eventually, send it somewhere external right after the user submitted the form so it never gets stored on the website.

The goal is to receive the payment information without having to ask the customer to print, fill manually, and send it over fax. And accomplish this without having to use an external payment gateway.

share|improve this question
Why is it necessary for them to send their bank account numbers? Do you just mean payment information, or literally bank account numbers? – chao-mu Jul 2 '12 at 13:19
1  
So you want to keep what likely are illegal copies of your customer's banking information in storage. This seems like its askng for trouble. Why not simply encrypt the information. – Ramhound Jul 2 '12 at 13:54
@chao-mu I need to ask for the bank account so that the billing department can charge the monthly fee. – Alexandru Trandafir Catalin Jul 2 '12 at 15:11
@Ramhound I don't want to keep that information, I just want a safe way to ask for it online until it gets stored locally on paper, nothing will be kept on the server. – Alexandru Trandafir Catalin Jul 2 '12 at 15:11
2  
@AlexandruTrandafirCatalin - Yes, I know what you want to do, and it really concerns me. Instead of keeping banking information in an encrypted format, you want to print the information on paper, that anyone with access to said paper can copy or even steal said paper. What you want to do is NOT secure. Doing what you want to do violates the PCI standard and likely is illegal in many ways. – Ramhound Jul 2 '12 at 16:12

2 Answers

up vote 5 down vote

The simple answer is don't. Don't handle financial information unless absolutely necessary. Look into third-party payment processors. Supporting them is far easier than tackling the legal and technical challenges of handling sensitive information like bank account numbers. Also, by hosting this information, you are making you and your customers a target.

See Monthly Payment Processing and others like it.

share|improve this answer
up vote 1 down vote

@Alexandru - I would advise having a good look at all the questions tagged PCI as there are a number of rules as to how you managebank account/credit card data.

Once you have done that, you may decide that you don't want that responsibility - it can cost a significant amount to manage this data securely at a level acceptable to the Payment Card Initiative.

If you do wish to manage it yourself, remember that SSL can be a very secure way to transfer data, but you will need to protect that data the entire time it is in your systems, whether those systems are electronic or paper storage.

share|improve this answer
Perhaps you could mention payment processors? – chao-mu Jul 2 '12 at 13:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.