Bank account number and account holder in check exposed?

Question

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't this information considered confidential? If not then disregard this question.

If yes, then it makes me wonder why banks blatantly expose the account number/name of the issuer in checks? Would it be a good practice if they at least hash the account name and number before they print it in the checks you will issue?

Answer 1

Going to have another go at this one, to try and address the many excellent comments...

A cheque is an instruction to a bank to take money from Alice's account and give it to Bob. In order to act on it, the bank need to know Alice's account details; they must be written on the cheque in some form when it arrives for clearing.

A pre-printed cheque in Alice's cheque book happens to have her account number already written on it, purely for convenience sake, in both human and machine readable forms.

@IMB first asks if this is a vulnerability, since if Eve gets hold of a cheque, she can read the account details off it and use them in an attack. The answer is yes, it is a vulnerability.

Then @IMB asks if hashing the account details would be a good control. I suspect they actually mean encrypting, rather than hashing, as cryptographic hashing is a rather specific technical term that doesn't quite apply here, but you get the picture. The answer is also yes, if done carefully, encrypting the account number (with a suitable nonce added) would largely prevent Eve using the account information.

Lastly @IMB asks why don't the banks do it then? Well, as with every security control, you have to measure the cost of using it against the impact of a failure in order to decide if you should implement it or not.

I think the main cost is that humans could no longer read the whole cheque. That doesn't sound like a problem in these days of ubiquitous computing, but banks are conservative and old fashioned and they are particularly fond of having human audit processes. They like a manager being able to pull a cheque at random every day and double-check how it was processed. They like being able to pull a physical piece of paper out and wave it at a customer and say "No, we didn't make a mistake."

Additional costs are that it adds overhead to the cheque clearing process (and customers already hate how long that takes), that you no longer have a backup if the machine readable part of a cheque is damaged, and I suppose you might run into regulatory difficulties about the legal definition of a cheque.

The risks, on the other hand, are not huge, because the banks have other controls in place. They authenticate people before allowing them to remove money, and require more than just account numbers to easily withdraw money. They use various technical methods to prevent Eve printing cheques with Alice's details on. They have insurance to cover any losses. They monitor account activity for suspicious transactions.

One last thing to consider: Alice has to tell her account details to quite a lot of people anyway: her employer (so she gets paid), the tax man, the water company (for direct debits) and so on. And she has to embed it in her debit card. And the bank have to print it on her statements... So Eve has many other ways to get this information.

In the end, the banks have weighed the costs and the risks and concluded it's just not worth it - especially considering the decline in use of cheques. Last time I tried to pay for something in a store by cheque they had to get the manager because none of the sales assistants had seen one before except in movies.

Answer 2

Yes. Printing the routing and account number on checks does incur some risk, though it's probably an acceptable risk:

• Generally speaking, the routing and account number is not enough to steal money from your account, in practice, due to the likelihood that any attempt at theft will be caught and reversed.

  That said, the system relies upon deterrence, not prevention. Someone who knows the routing and account number for your bank account might be able to withdraw money from your account without your authorization. They might get caught, and the unauthorized transaction might get reversed, but it is a security risk.

  As proof of this, consider the fact that there are some merchants who will let you pay by phone using an "electronic check". If you've never used that, here's how it works: you call them up, tell them the routing code and account number for your checking account, tell them the amount of the payment you want to make, and then they basically create a "forged" check with this information and get paid. (Understand that it is not actually forged, since it is done with your authorization.) It shows up on your bank account statement as an electronic withdrawal or check payment. How is this legal, you might be wondering? It is legal, because it is done with your consent. But that's not the point. The point is that the only information needed to make this happen is the routing code and account number. If an honest merchant can do this, then so can a dishonest merchant. There are likely to be limits on who has access to do that in an electronic and automated fashion; someone who does so without your authorization will probably get caught, if they do it to a bunch of people and the victims complain to their bank; in short, deterrence might be reasonably effective in practice; but there is nothing that absolutely prevents it. The check-clearing infrastructure has certain inherent vulnerabilities, sad to say.

A second risk is that someone who knows your account number of your checking account can likely learn the balance in your account. See my explanation for how this can happen (short version: it involves exploiting merchant check verification systems, which are made available by banks and are insecure by design).

These risks are inherent to the current checking system. There's not a lot you can do about it. You can close the confidentiality hole, if you care enough, but you can't fix the other risks.

As a general rule of thumb, it is probably best not to share your bank account number with anyone who doesn't need it (e.g., to receive a payment from you).

All of this is discussed in detail in the following question on the Personal Finance and Money Stack Exchange site: Can't the account information on my checks be easily used for fraud?. See also Can someone steal money from my bank account if they know my IBAN and personal details? on this site for a detailed explanation of how someone can withdraw money from your acount, if they know your routing and account number. See especially the case with Jeremy Clark.

Answer 3

A different way to answer:

Checking account numbers and Credit Card numbers are an old way of doing things, both invented before the internet, computers, and auto-draft services were widespread. Both methods using a re-useable password that you send everywhere. (ok, its an account number, but it works)

The correct solution would be to replace checks, credit cards and debit cards with (preferably hand-held) computers that generate one-time passwords/certificates that only work for the agreed amount, using asymmetrical encryption.

This is why turning an Android into a payment device could be promising, it would effectively eliminate the problem of card swipe recorders. The question is, if/when will they use one-time certificates in the implementation?

Printed checks could have a QR code or similar on them with the one-time certificate I refer to.

Think of card readers and banks as gas stations, and checks and credit cards as cars. It is very expensive to support the next generation if nobody is using it yet.

P.S. I'm not a banking, financial, or security expert, just a programmer. :)

Answer 4

True, banks should implement some sort of hashing but:

• fraudsters would figure out how to decrypt it anyways
• would break every online check scanning biz
• would break every bank procedure worldwide unless standards were introduced
• banks don't like to change

If a fraudster can find out your account number, they can easily make a fake cheque and have a good chance of passing it off as the real thing if they can social engineer a signature out of you. Half the time banks don't even check a signature they just take the cheque and give you money if it was drawn on that bank.

Chequing should be obsolete, but I guess banks like to eat fraud.