HMRC payment and NI number disclosure

GeoffTF

Here is the page:

https://www.gov.uk/pay-self-assessment-tax-bill/by-debit-or-credit-card-online

masonic

The reference field of a bank transfer is sufficiently private to contain things like an account number, credit card number, UTR, or NINO. I'm not sure what the concern here is. That bad guys will break into HMRC's bank account and download its transaction history? Is that more or less likely than hacking into one of its other systems where taxpayer information is stored? Likely the sending bank will also have your NINO on file.

friolento

Lots and lots of banks and building societies hold your NINO on your savings accounts

sheramber

GeoffTF said:

When I have to make Self Assessment payments, I get a Bank Giro slip which has my UTR with a K at the end as the reference, not my NINO. I pay by debit card using that reference (without the K) without logging into my account. That seems to be the easiest way to pay.

The OP may not be is self assessment. PAYE  use NI number. 

haze23

Well this at least opened a bit of a discussion. Apologies I can't reply to every comment.

HMRC provided the reference, this will have be to used for them to accept the payment.

Yes, debit card is an option. I thought bank transfer would be easier and am surmising that any email receipt for debit payment would contain the same reference. That is pure speculation. One the whole, I'd think it better to be in the banking system than email servers.

No concerns over the banking or HMRC systems themselves, just sometimes other parties (credit, marketing) etc. have access and it's not clear to what extent.

So it seems the answer here is, yes, being overly paranoid. Still, worth asking first rather finding out later that it's a stupid thing to do and exposing details (transaction history) to unnecessary risks. One of those things that can't be undone.

Thanks all.

GeoffTF

haze23 said:

Yes, debit card is an option. I thought bank transfer would be easier and am surmising that any email receipt for debit payment would contain the same reference. That is pure speculation. One the whole, I'd think it better to be in the banking system than email servers.

That speculation is wrong. You have the option requesting of an email acknowledgement, but the email does not contain the full reference. Instead it says Payment reference ending with nnnnK, where nnnn is the last four digits of your payment reference.