Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and identifies the exact bank.

Can a skilled cracker use this information to steal money from an account? How safe is it to provide these details?

share|improve this question
Usually public records searches will allow someone with your name and an incomplete address (or location deduced by IP geolocation) to get your complete address, so the complete address by itself is not all that significant. – Mike Samuel Aug 24 '11 at 21:11
Yes they can it happened to me a few days ago my bank is on it. It also happened in 2009 and they caught the person. – user4953 Sep 14 '11 at 18:21
Hi Kathy, welcome to Information Security! Answers here are expected to be provide information to base an answer on, either research, logic, etc - and not just an assertion or anecdote (btw, sorry to hear about that - I imagine it was not a pleasant experience). – AviD Sep 15 '11 at 21:26

IBAN are used to identify a recipient.

The check digits enable the sending bank (or its customer) to verify the validity of a routing destination and account number from a single string of data at the time of data entry.

To be able to send money from your account to another account, someone needs to impersonate your identity. I doubt your bank would let somebody claiming they are you and giving an IBAN and an address, make transfert of money. If they do, change your bank.

share|improve this answer
All German banks do allow direct debit without requiring permission from the account owner. If he or she does not check the account in time to issue a reverse order, the money is lost. For direct debit, the account number, owner name, bank id and bank name are sufficient. – Hendrik Brummermann Aug 12 '12 at 7:27
Are you serious? That seems crazy - especially for Germany where there seems to be so much protection in other areas, especially wrt privacy etc. – Tim X Feb 28 '13 at 22:45
In France, I am required to send a letter of authorisation for each automatic withdrawing order (phone company, energy company etc). Hopefully the lack of proper authorisation should trigger refusal? – M'vy Mar 1 '13 at 10:46

This question is likely to be country-specific. In the US, an account number is generally not enough to steal money from someone's account. This is fortunate, because every time you write a check or make a bank payment to someone, they receive your account number.

However, learning someone's the bank account number is enough to learn their account balance. There is an attack that is not widely known:

  • Most banks have a phone number that merchants can call and, via an automated voice response system, learn whether a particular account has enough money that a check for a particular amount will clear. Basically, you just call up, hit a few digits to go through the phone tree to the merchant check verification option, then type in the account number and the amount, and the phone system will respond with whether the account balance is at least as much as the amount you've provided.

This allows an attacker who knows your account number to learn your bank account balance, by using binary search. This is a confidentiality breach that is not widely known.

If this bothers you, you may be able to protect your own account against this by calling up your bank and asking them to put a fraud alert on your account. At least for my own bank, when the bank does this, it disables the merchant check verification service for your bank account.

share|improve this answer
Write a check and they have your account number and routing number, seems it would be that much easier to get money out of an account. – Wayne In Yak Mar 9 '12 at 21:11
@WayneInML, yes, I agree, that is a risk too. I just wanted to point out an additional, separate risk that not as many people know about. P.S. The privacy risk I mentioned relies only upon knowing the victim's account number (routing number is not needed). – D.W. Mar 10 '12 at 1:28
FYI, the routing number is not at all secret. You can look it up. – derobert Oct 2 '12 at 22:29
Interesting. Do most banks still do this? I'm aware that you can get amount ranges (e.g, <$1000, $1000-$50000, etc.), but not exact amounts. – speedplane Jan 6 at 22:12

It's possible to transfer money out of an account knowing only Account Number, Sort Code and address.

There was a reasonably high-profile case where Jeremy Clarkson, not believing this to be the case, published his bank details in a newspaper. The details were then used to send money to a charity.

share|improve this answer
Although to be fair, that is not what was important in this case. You can't take money out of an account using just these details - you need more info, and a bit of social engineering. But an attacker with this info requires less effort to complete the attack. – Rory Alsop Sep 5 '11 at 14:29

The following is based primarily on US Banking, but most countries have similar risk management practices if they follow Basel Practices.

To perform an ACH requires a routing number and an account number.

However, for an ACH to go through requires it to pass internal controls and screens. The bank is required to monitor for fraud and if you are making irregular transactions for your account they should detect it. In the US, hopefully they are complying with the federal regulator's recommendations to implement layered controls FIL-50-2011, e.g., there is so security-gate to go through to move money out (e.g., out-of-band one time token, such as SMS one time code). Also, in the US, you are protecting against electronic funds transfer fraud through Regulation E. Regulation E allows you to make a claim against fraud. Often the bank can reverse fraudulent transaction.

You may want to read this paper by Microsoft Research: Is everything we know about password stealing wrong? (PDF) Is addresses the risk to individuals of bank account compromise.

share|improve this answer
There are usually a greater number of controls for money flowing out of a bank versus in (though most banks will try to filter for money laundering and fraud patterns going in). Things like positive pay can help reduce outgoing fraud. Some banks may also prevent outgoing transfers without first requiring a confirmation through an out of band channel (e.g., click a one time link in an email or respond to an SMS). – Eric G Feb 23 '13 at 17:16

Normally, a bank will require proof of identification, such as a signature or online password, before allowing someone to withdraw or wire money from an account. Also, a bank may call or email the account holder before making the wire or withdrawal, especially if it is unusual activity for the account.

share|improve this answer
And signatures are of course copy-proof because they vanish when you try to photocopy them... So yeah, they practically allow anyone to withdraw money. – Luc Feb 15 '14 at 1:46
Not in Germany. – Andrey Sapegin Jan 4 at 14:46

protected by Community Mar 3 '13 at 15:14

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.