Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and identifies the exact bank.
Can a skilled cracker use this information to steal money from an account? How safe is it to provide these details?
This question is likely to be country-specific. In the US, an account number is generally not enough to steal money from someone's account. This is fortunate, because every time you write a check or make a bank payment to someone, they receive your account number.
However, learning someone's the bank account number is enough to learn their account balance. There is an attack that is not widely known:
This allows an attacker who knows your account number to learn your bank account balance, by using binary search. This is a confidentiality breach that is not widely known.
If this bothers you, you may be able to protect your own account against this by calling up your bank and asking them to put a fraud alert on your account. At least for my own bank, when the bank does this, it disables the merchant check verification service for your bank account.
IBAN are used to identify a recipient.
The check digits enable the sending bank (or its customer) to verify the validity of a routing destination and account number from a single string of data at the time of data entry.
To be able to send money from your account to another account, someone needs to impersonate your identity. I doubt your bank would let somebody claiming they are you and giving an IBAN and an address, make transfert of money. If they do, change your bank.
It's possible to transfer money out of an account knowing only Account Number, Sort Code and address.
There was a reasonably high-profile case where Jeremy Clarkson, not believing this to be the case, published his bank details in a newspaper. The details were then used to send money to a charity.
The following is based primarily on US Banking, but most countries have similar risk management practices if they follow Basel Practices.
To perform an ACH requires a routing number and an account number.
However, for an ACH to go through requires it to pass internal controls and screens. The bank is required to monitor for fraud and if you are making irregular transactions for your account they should detect it. In the US, hopefully they are complying with the federal regulator's recommendations to implement layered controls FIL-50-2011, e.g., there is so security-gate to go through to move money out (e.g., out-of-band one time token, such as SMS one time code). Also, in the US, you are protecting against electronic funds transfer fraud through Regulation E. Regulation E allows you to make a claim against fraud. Often the bank can reverse fraudulent transaction.
You may want to read this paper by Microsoft Research: Is everything we know about password stealing wrong? (PDF) Is addresses the risk to individuals of bank account compromise.
Normally, a bank will require proof of identification, such as a signature or online password, before allowing someone to withdraw or wire money from an account. Also, a bank may call or email the account holder before making the wire or withdrawal, especially if it is unusual activity for the account.
