Security with Email and Bank Accounts [closed]

Question

I emailed a pdf of a bank statement to a small number of board members of a small volunteer organization. The account has additional security measures on it which include requiring two signatories on all withdrawals or account changes. Another board member, who is in IT, wants to go to the trouble of changing the bank account number (a hassle for us) and insists this was a high security breach. One link she sent to us all explained the risks of plain text. The account number was not in plain text, but a pdf. The link also used high risk million dollar transactions as an example of what could go wrong ie: at the last moment before depositing your millions a hacker could change one number and the money would be deposited into the wrong account. The bank fraud department and others I've reached out to think this is excessive, as do I. She also referred to a Q&A on this site to support their argument.

Additional thoughts? Or, is this a little like crying fire in a crowded theatre?

Answer 1

I'm no security expert, but here is my two cents:

Bank account numbers are indeed sensitive, but not much use without other information (e.g. routing number, social security). Every time I've ever needed to withdraw from an account, I needed the routing number or valid identification. I suppose it depends on the bank, but fraud prevention is not a new idea. In summary, it's like someone finding out your username, but not your password.

Answer 2

It CAN be a security risk, but the hacker would need to have the link between your computer, the mail servers, or the recipient's computer. Then they could potentially listen on the line and reconstruct the PDF from the output, then read it. I don't know how they can use the account numbers, as most of the movies look quite bogus for money transfers, but it is theoretically possible. The Security Stackexchange site would know more about this though