1

Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?

3
  • It depends on what account numbers are used for. There's probably no universal answer.
    – vidarlo
    Commented Nov 30, 2023 at 19:35
  • bank account numbers are pretty common -- i don't mean any associated data (like account->person or the like). just knowing that numbers are somewhat sequential and the latest was X Commented Nov 30, 2023 at 20:33
  • If you can't describe the system I think it'll be difficult for us to enumerate vulnerabilities.
    – vidarlo
    Commented Nov 30, 2023 at 20:35

2 Answers 2

2

Generally an account number on its own isn't really very useful. You can usually transfer money to it - but unless you know the details of the person who it's linked to it's hard to do much more. This will depend on the specific systems though.

But sequential numbers would leak some information. For example, if you could find out when someone opened an account, it could potentially allow you to guess their account number, which you might then be able to use in conjunction with the other information you have about them.

It also leaks information about the number of accounts that are being opened, which could be commercially valuable. For instance, a competitor could have one of their staff open an account every week with the bank, and then get an idea of how many new customers they're getting based on how much the account numbers are going up.

And if you know they're sequential, you don't even need to be opening accounts - you can make some fairly accurate guesses based on a sample of account numbers that you find (known as the German tank problem, after the allies used the serial numbers of German tanks to estimate their production rates).

1

Whether it is a bank account, a user id or a serial number, predictable identifiers will always create a weakness by design in any system. This weakness would translate to a vulnerability if it is not taken into account when implementing systems, as it could happen with insecure APIs (ie. with guessable ressource IDs or scrappable users).

If this weakness is taken care of then the main cause of concern (or remaining risk) would certainly be the information leaked (possibly deduced) by the sequence. Which in the case of bank accounts is certainly harmless: a bank account does not bear any data about the owner (customer) to my knowledge but only about the country, brand, institution, issuer... This information would barely make the difference in an attack.

Of course, we should always restrict ourselves from leaking bank numbers (voluntarily or not) as this information can help to correlate personal data and open the door to social engineering. But incremental account numbers will not really increase this risk as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .