To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe.

As far as I know (see also this question) these details can not be used to withdraw money without verification (Direct Debit in Germany?).

Would you encrypt these details? Or in other words, is it considered good practice to especially protect them? (Like you won't store passwords in cleartext but rather as a hash)

  • If someone walked up to you on the street and asked for it, would you just tell them? No? Then it's potentially private/sensitive. – Daisetsu Feb 14 '14 at 19:28
  • 1
    "private data"? Definitely. Encrypt it? Now there's a question. – Luc Feb 15 '14 at 1:43

As a European, I consider my IBAN to be my private information, just like my email address, real name, home address and IP address. I'd like for you to not store any of them, but if you have to, please encrypt them and make sure my information (it's my information, not yours) is secure.

So to directly answer your question, yes, encrypt it and don't store the key nor handle encryption/decryption on the server processing user requests.

  • Interesting view of point, I did not realize that IBAN is just like an address: for people to pay (visit) you, they need to know your IBAN (address). Although I am European, I still do not know whether abuse is possible when someone knows your IBAN (i.e. initiating (periodic) transfers from your account). – Lekensteyn Feb 15 '14 at 15:57
  • 1
    There is an example of someone posting the bank details in EU and losing money because of it. news.bbc.co.uk/2/hi/7174760.stm – Matrix Feb 16 '14 at 7:15

I agree that most Europeans will see their IBAN as private data and want them to be encrypted.

But there is another compelling reason to encrypt and sign the IBANs: A man-in-the middle attacker may maliciously alter them to receive the money you want to pay off. So you should protect any IBAN against this threat.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.