What could a malicious party potentially achieve by having *just* a name, account number, and sort code?

Question

There seem to be many conflicting points on this issue, most prominently this story published in the Daily Mail not so long ago , so I ask the nice community on stackexchange to shed (researched) light on the issue:

My mental model of the name / account number / sort code combo was that of the public key: it allows people to send (but not to receive, or authorize any other operation) money to me with it. Yet, above, and many references on the net seem to also imply direct debit, and money withdrawal via cheques.

Questions:

• Is it safe to eg. post these details on public internet?

• If not, what potential risks might it pose?

Many thanks in advance!

Edit: as tag says, question is specifically concerning the UK, and assume that security tokens (password, 2 factor authentication, etc) are NOT compromised (post address is).

Answer 1

I think the answer to this must differ from country to country. I have lived in several countries where the normal everyday way of making a payment is to instruct my bank to transfer the money to the recipient's account. Of course this means I must know his name, SC and account number – but this is an accepted part of the system; businesses routinely display that information on invoices and correspondence. It is simply not regarded as confidential.

DumbCoder's comment suggests that if he has that information he can take money from my account without my permission – in other words, my bank will pay money out of my account on someone else's request, without my authority. Is this correct? In which country or countries can this happen?

(I must go there quickly and begin stealing people's money.)

Answer 2

When you want to pay a bill on line there are several ways to do it.

• You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.

• You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are.

• You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.

In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.

The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud.