10

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe.

As far as I know (see also this question) these details can not be used to withdraw money without verification (Direct Debit in Germany?).

Would you encrypt these details? Or in other words, is it considered good practice to especially protect them? (Like you won't store passwords in cleartext but rather as a hash)

Improve this question
2
  • If someone walked up to you on the street and asked for it, would you just tell them? No? Then it's potentially private/sensitive.
    – Daisetsu
    Commented Feb 14, 2014 at 19:28
  • 1
    "private data"? Definitely. Encrypt it? Now there's a question.
    – Luc
    Commented Feb 15, 2014 at 1:43

2 Answers 2

Reset to default
4

As a European, I consider my IBAN to be my private information, just like my email address, real name, home address and IP address. I'd like for you to not store any of them, but if you have to, please encrypt them and make sure my information (it's my information, not yours) is secure.

So to directly answer your question, yes, encrypt it and don't store the key nor handle encryption/decryption on the server processing user requests.

Improve this answer
2
  • Interesting view of point, I did not realize that IBAN is just like an address: for people to pay (visit) you, they need to know your IBAN (address). Although I am European, I still do not know whether abuse is possible when someone knows your IBAN (i.e. initiating (periodic) transfers from your account).
    – Lekensteyn
    Commented Feb 15, 2014 at 15:57
  • 2
    There is an example of someone posting the bank details in EU and losing money because of it. news.bbc.co.uk/2/hi/7174760.stm
    – Matrix
    Commented Feb 16, 2014 at 7:15
3

I agree that most Europeans will see their IBAN as private data and want them to be encrypted.

But there is another compelling reason to encrypt and sign the IBANs: A man-in-the middle attacker may maliciously alter them to receive the money you want to pay off. So you should protect any IBAN against this threat.

Improve this answer
1
  • does it makes sense to change IBAN number every 6 years? Is there a privacy benefit?
    – Sybil
    Commented Aug 17, 2020 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .