I am developing an online banking site. Is it advisable to build a feature that allow user to download and save an image of their cleared checks on their computer? Is there any risk to user who download and save check image on their computer?

  • my bank does that now, if that helps. you lose some physical fraud protection, but it's paper thin anyway, there's still all the legal protections against check fraud even if your account number is leaked.
    – dandavis
    May 16 '18 at 20:53
  • 1
    Anurag - what guidance do your Risk or Regulatory Compliance people give you? Have you thought about data protection regulations? And the value proposition: what benefit is there in having an image of cleared cheques?
    – Rory Alsop
    May 17 '18 at 6:11
  • Perhaps a risk in that if you have copies of cancelled checks, you might have to produce them on discovery. If just the bank has copies, then the check production would be limited by the retention period for the bank.
    – mongo
    May 17 '18 at 13:08

The chief risk in this is that the check has routing and account numbers on the image, so if someone were to intercept the download, they would have that information. Something like a MITM or hijacking your site to do XSS to download something besides the check image could be potentially harmful, but that's true of every site and not really specific to your question.

That being said, this risk of someone intercepting the download is relatively low and mitigated by using proper site encryption and secure downloading. SSL, HTTPS, proper certificates, that sort of thing.

The other, much smaller risk is if the end-users computer is compromised and the image is stolen from there - but this is well outside your liability and falls on the end-user to protect their data.

  • It is worth noting, as the systems will be "in house" that a public key infrastructure could be configured to remove trust from the certificate authorities and ensure the bank is the only controller of the root CA. Then only use a trusted certificate authority for the frontend.
    – safesploit
    Jul 16 '18 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.