How do you feel about bank details in email?

talexuser

I realise that your bank account no and sort code was on every cheque you ever sent... but that was mostly before almost universal internet.

I just opened the best buy ICICI 1.65% which needs a first deposit by DD and they confirmed my bank account details by email. I don't recall other account opening confimations having the entire numbers in an email.

Seeing we are always told email is not secure how do you regard any risk?

Archi_Bald

What can happen if someone knows the sort code and account number?

Annisele

Archi_Bald wrote: »

What can happen if someone knows the sort code and account number?

If it's an account you can set direct debits up for - then somebody else can do that. (See what happened to Jeremy Clarkson for an example of why you shouldn't publish bank details to the world). The direct debit guarantee will protect you, but sorting it out will be hassle.

Rollinghome

All my debit cards from, Lloyds, Santander, etc have the account number and sort code embossed on them.

So that every time they're presented, the shop assistant can read it. In the good old days before the online machines it was printed on those carbon receipts they issued too: one copy for them and one for you.

Presumably if shop assistants can read our bank details from the card without the hassle of hacking our email accounts then knowing those details isn't seen as serious risk by most banks. Be much more worried about card skimmers both on ATMs and anywhere you use your cards.

Archi_Bald

Annisele wrote: »

If it's an account you can set direct debits up for - then somebody else can do that. (See what happened to Jeremy Clarkson for an example of why you shouldn't publish bank details to the world). The direct debit guarantee will protect you, but sorting it out will be hassle.

Yawn. This wasn't a case of proving that you shouldn't give people your sort code and account number but a case of getting one back on big-mouth Clarkson.

Tens of millions of people have written billions of cheques for decades and are using millions of debit cards that have not only got their sort code and account number but also their name printed on them. And still there is no epidemic, or even regular occurrence, of abusive DDs.

eskbanker

Rollinghome wrote: »

All my debit cards from, Lloyds, Santander, etc have the account number and sort code embossed on them.

So that every time they're presented, the shop assistant can read it.

I don't know about you but I don't present my debit cards to shop assistants, I put them into secure pinpads! Even on the rare occasions where it might be necessary to physically hand over a card I certainly wouldn't let it out of my sight and think I'd probably spot someone writing down the numbers from it....

bowlhead99

Annisele wrote: »

If it's an account you can set direct debits up for - then somebody else can do that. (See what happened to Jeremy Clarkson for an example of why you shouldn't publish bank details to the world). The direct debit guarantee will protect you, but sorting it out will be hassle.

Also having your bank details in the public domain opens you up to the scam where someone credits £1000 into your account, contacts you to say they did it in error and would you please transfer it back because they need it for their baby cousin's life saving surgery, and please feel free to deduct a couple of percent for the inconvenience, and so you send them the £990 of your own free will, and the original £1000 transfer turns out to be fraudulent and gets reversed, leaving you out of pocket.

Or someone contacts you allegedly from the bank and because they have your personal account details you willingly reveal personal information about yourself that you would not have otherwise done.

Or someone who has already socially-engineered other personal information out of you is able to pose as you on the phone to your bank because they now know more details of the accounts you hold and can appear more natural on the phone.

Bottom line, the scams that involve your bank account always need some action on your part because you are the only person with authority to pay money out of the accounts. The Clarkson one above, and the ones where they impersonate you, are things that would be a hassle but ultimately you would get the money back.

As such, the bank have not committed a heinous travesty by giving you your information direct to the email address you supplied them; it doesn't allow anyone to legally empty your account and it is no less secure than putting the information in an envelope that could be opened by literally anyone en route. Still, many banks take the approach of sending you the details by post and redacting some characters from what they send by email, which gives more cyber-security but takes longer.

Plenty of organisations send account password resets or reset links through email because, while it's not "secure" the threat is not exactly high because there are billions of emails sent each day and snoopers are not going to open them all.

Rollinghome

eskbanker wrote: »

I don't know about you but I don't present my debit cards to shop assistants, I put them into secure pinpads! Even on the rare occasions where it might be necessary to physically hand over a card I certainly wouldn't let it out of my sight and think I'd probably spot someone writing down the numbers from it....

But a lot easier to read it from your card than hacking your email account wouldn't you say?

Especially if one of these is used:


(Which are still used by some: http://smallbusiness.chron.com/manual-vs-electric-credit-card-processors-28951.html )

When you say a "secure pinpad" is that to say you would instantly spot an insecure pinpad with a skimmer fitted? Because thousands of people don't. Several hundred were caught in a garage near me before it was spotted.

eskbanker

Rollinghome wrote: »

But a lot easier to read it from your card than hacking your email account wouldn't you say?

I'd say that was a false dichotomy!

Rollinghome wrote: »

Especially if one of these is used:


(Which are still used by some: http://smallbusiness.chron.com/manual-vs-electric-credit-card-processors-28951.html )

Obviously your mileage may vary and all that but I can't recall the last time I saw one of those and am not really persuaded by an article from 2011 in a small-time local newspaper in the USA, where card security has long been a very different beast from how things are on this side of the pond!

masonic

Countless businesses and even individuals who accept payments by bank transfer include their account details on websites, emails etc. Sort code and account number are not supposed to be kept secret.

I treat my account details as analogous to my email address. In fact, I'd be more concerned about my email address getting into the wrong hands than my bank account number and sort code.

At the end of the day, I don't see much more risk in a company confirming account details by email than simply possessing those details. The weak link is invariably the company's own IT infrastructure.

Rollinghome

eskbanker wrote: »

Obviously your mileage may vary and all that but I can't recall the last time I saw one of those and am not really persuaded by an article from 2011 in a small-time local newspaper in the USA, where card security has long been a very different beast from how things are on this side of the pond!

You're not persuaded of what? Your remarks about the US sound a tad chavinistic.

If it helps you, that image of a manual card imprinter (also known as a zip-zap machine) is from the website of the UK Cards Association which is the trade body for the card payments industry in the UK: http://www.theukcardsassociation.org.uk/cards-transactions/card-present-transactions.asp

They also helpfully provide instructions on their use:

"Where merchants are processing transactions on paper vouchers, they will be using a manual imprinter or ‘zip-zap’ machine. You should place your customer’s card into the machine with a paper voucher and makes an imprint of the card onto the voucher. You then manually complete the purchase details on the voucher and ask your customer to sign."

The last time my card was processed in one was in a garage near Gatwick not long ago. I assume there are still plenty of them about and they are also kept as a backup by bigger stores. They can be widely bought including from Amazon UK http://www.amazon.co.uk/Addressograph-Bartizan-flatbed-credit-imprinter/dp/B0055BZE8W

So yes, they are still in use, including here in the UK and not just in backward countries like the USA.