In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to the client to process such payments using a separate system.

What, if anything, should we be doing to secure this data? And where could I be looking to find information about this sort of thing?

  • Although you aren't using credit card numbers, you can use PCI DSS standards as a starting place.
    – schroeder
    Commented Jun 5, 2014 at 16:10

1 Answer 1


PCI doesn't have anything to do with banking information, and may not be applicable depending on your hosting situation. PA-DSS deals with web applications.

I would very seriously consider the risks involved in this, compared to the monetary benefit you derive as a result of accepting and storing this information. A data breach of this information may expose you to a great deal of risk and expense. For example over 30 states have their own beach notification laws, and timelines for how long you have to contact the state attorney general, customers, etc. You may have only a day or two in many cases and the legal fees alone would be very expensive.

Beyond that, you are often responsible to notify all affected customers in most of these states by mail. Many companies end up purchasing/providing free credit monitoring and you may be sued by banks or individuals whose accounts are compromised in order to cover actual losses, including actual funds and bank resources. You may face additional, personal liability if you don't follow industry best practice, which typically would include code and pen test review of all releases and updates, annual audits, encryption, file integrity monitoring, web application firewall usage, SIEM, IDS/IPS, and the list goes on.

This is not all to scare you, but to convey the seriousness of the undertaking. If you are determined to store banking-related PII I would strongly consider consulting a lawyer or an experienced banking industry IT security professional. At the very least, I would talk to a few of the larger banks in your area and ask what they would require if you were operating a service like this for one of their business clients.

Disclaimer: I'm not a lawyer, views and thoughts are mine and mine only, etc, etc.

  • I'm in the security forum; I am sort of expecting to be scared. :)
    – XtinaS
    Commented Jun 5, 2014 at 19:41
  • 1
    Agree with the main point but you start with a false distinction. PCI DSS applies to all merchant systems and applications that handle payment card data: web app, back end, reporting, whatever. PCI PA-DSS applies to (all) such applications developed by someone else, but DSS still applies after the app is installed at the merchant and used. You aren't required to apply PCI for ACH and similar banking, but as the comment indicates choosing to do so could be a good idea. Maybe you're thinking of the OWASP top ten; those are unique to web apps. Commented Jun 6, 2014 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .