6

EDIT: This is for the UK/Europe region.

I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be plaintext in a database, as they are publicly available. I'm concerned about storing the account number however. I also know that you cannot really get anything from a bank account with just the routing and account numbers.

I know that this information does not fall under PCI standards. We currently have a hosted business web application and database on the same server, and we would like to store some account details here for some of our employees to refer to when doing invoices, etc. We do have a fully enabled role/permission based system, so we can limit who this information is available to.

My main concern is our mail shots for this information. AFAIK, we have to send a confirmation letter to the customer when any part of their account changes (such as collection dates, etc.), or they make a new one. On this letter, the bank account number should appear. We also want this information to be available to the customer on their online portal account (built by us). Is it safe to store the account number as-is (plain), and ONLY include the full number on the paper letter? The online version could be partially or fully obscured by the server, so that it never appears in-browser.

Or am I over-thinking this and going too far? OR would it be better to just walk away from this and stress the word NO to my superior?

  • 1
    In the UK account number, sort code, name and address seem to be enough to create a direct debit from a bank account to some institution. Jeremy Clarkson thought otherwise until he "donated" 500gbp to a charity: news.bbc.co.uk/1/hi/entertainment/7174760.stm – domen Apr 27 '15 at 12:41
  • Ah, I remember reading this in the paper amusingly. The amusing factor is gone now that I'm having to consider all this :| – MightyLampshade Apr 27 '15 at 13:57
2

It depends on the bank's security in general. Europe is better than the US, but there are stories of forged debits in the UK as well where they only used basic information.

If you are worried about routing numbers and account numbers (as leaking a database can be a PR nightmare regardless if the info regards financial information), you could opt for a second instance of your application for internal users only (and a shared database, just be careful of race conditions).

You can then use assymetric encryption to store the sensitive information in the database and put the public key in the instance for clients (where the information is encrypted when sent to the database) and the private key for decryption in the backend system. That way the frontend exposed to clients can only encrypt information.

  • Thanks. That make sense, but splitting our application isn't really feasible (time vs money scenario). Our customer portal operates off the same (albeit limited, restricted, and very much stripped) REST services that we use for the "internal" part of the application. Therefore I'm not sure your key storage scenario is feasible. We operate a three-tier architecture (front-end/client -> business layer/services -> database layer/database access), with all three being hosted on the same dedicated server. – MightyLampshade Apr 27 '15 at 14:11
  • 1
    Might as well accept or avoid the risk then. – Lucas Kauffman Apr 27 '15 at 14:12
  • I'll put that to my superior, his choice, his responsibility. lol. – MightyLampshade Apr 27 '15 at 14:19
  • The fact you're running everything on a single server is weird as well – Lucas Kauffman Apr 27 '15 at 14:20
  • True. I've been meaning to push for a split in servers. Quick question. If we split our set-up so that the database is on a different server from the front-end application and services, would it be feasible to use the whole public/private key set-up? I.e. our services request the private key from the database server to decrypt the data received from the database server in another call? Or would it be better to call another service on the database server to decrypt the data first, then send it over the wire? – MightyLampshade Apr 27 '15 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.