Take the 2-minute tour ×
Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It's 100% free, no registration required.

There seem to be many conflicting points on this issue, most prominently this story published in the Daily Mail not so long ago , so I ask the nice community on stackexchange to shed (researched) light on the issue:

My mental model of the name / account number / sort code combo was that of the public key: it allows people to send (but not to receive, or authorize any other operation) money to me with it. Yet, above, and many references on the net seem to also imply direct debit, and money withdrawal via cheques.

Questions:

  • Is it safe to eg. post these details on public internet?

  • If not, what potential risks might it pose?

Many thanks in advance!

Edit: as tag says, question is specifically concerning the UK, and assume that security tokens (password, 2 factor authentication, etc) are NOT compromised (post address is).

share|improve this question
    
Google your name and see what you get. The moment I get your birthday and your address (from google), I can use the account and sort code to get all your money. It is so simple. Direct debit only needs your name and bank SC and Acc number. So it is easy to set it up. But you have the safety that the money will be returned back if proof is there of an illegal thing. –  DumbCoder Jan 4 '13 at 15:06
    
DumbCoder, could you clarify whether one could, and how one would set up a Direct Debit with only these informations available? –  Silver Dragon Jan 5 '13 at 21:29
    
Have you ever set up a direct debit in UK ?? If yes then you should know. –  DumbCoder Jan 6 '13 at 10:45
    
No, I mean, how a different organisation would set up direct debit to them, using only my account information? –  Silver Dragon Jan 7 '13 at 4:48
add comment

3 Answers

I think the answer to this must differ from country to country. I have lived in several countries where the normal everyday way of making a payment is to instruct my bank to transfer the money to the recipient's account. Of course this means I must know his name, SC and account number – but this is an accepted part of the system; businesses routinely display that information on invoices and correspondence. It is simply not regarded as confidential.

DumbCoder's comment suggests that if he has that information he can take money from my account without my permission – in other words, my bank will pay money out of my account on someone else's request, without my authority. Is this correct? In which country or countries can this happen?

(I must go there quickly and begin stealing people's money.)

share|improve this answer
    
It can happen very easily in the US, for example. As the OP shows - also in the UK. See this famous US example: en.wikipedia.org/wiki/Knuth_reward_check –  littleadv Jan 4 '13 at 18:54
    
I am citing the case in UK. I can access my telephone banking based on this information, some banks have introduced a secret word. But it will not take much time for a resouceful crook to figure out the secret word with the plethora of information available online about oneself, nowadays. Don't assume you are safe too in your country, wherever you are from. –  DumbCoder Jan 4 '13 at 21:58
    
As edited question says: this is specifically for the UK, and without compromised passwords. –  Silver Dragon Jan 5 '13 at 21:26
    
I admit that when I wrote my answer, it had not occurred to me that any bank would accept a payment instruction from a customer without either a signature on paper or a password on line. I still have doubts about whether that can happen; I wouldn't keep my money in a bank that would allow it. –  abacus Jan 6 '13 at 15:12
add comment

When you want to pay a bill on line there are several ways to do it.

  • You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.

  • You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are.

  • You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.

In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.

The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud.

share|improve this answer
add comment

I disagree with Dumbcoder's response.

Setting up a DD is not easily approved by the banks as you must prove a existing business cash flow.

And secondly you cannot empty someone's account via DD as they are protected by the DD mandate. (Money goes out, complaint is made, money goes back in, the registered business with the DD facility has some serious explaining to do to the bank and FCA).

Dumbcoder you likely work in a middle position of a company..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.