Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I emailed a pdf of a bank statement to a small number of board members of a small volunteer organization. The account has additional security measures on it which include requiring two signatories on all withdrawals or account changes. Another board member, who is in IT, wants to go to the trouble of changing the bank account number (a hassle for us) and insists this was a high security breach. One link she sent to us all explained the risks of plain text. The account number was not in plain text, but a pdf. The link also used high risk million dollar transactions as an example of what could go wrong ie: at the last moment before depositing your millions a hacker could change one number and the money would be deposited into the wrong account. The bank fraud department and others I've reached out to think this is excessive, as do I. She also referred to a Q&A on this site to support their argument.

Additional thoughts? Or, is this a little like crying fire in a crowded theatre?

share|improve this question

closed as off topic by soandos, Tom Wijsman, Daniel Beck, random Jan 6 '12 at 1:29

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

How did the PDF guarantee security? What is the problem being faced? How did plain text come into your story as I see no earlier reference to it? In any case, better to be safe than sorry. – Tom Wijsman Jan 6 '12 at 0:46
IT personnel are always paranoid, they see the guts of IT infrastructure and know what "can" happen, even though this risk is minuscule, they tend to be overly cautious for a good reason in their mind. I think it is total BS to change the account number. – Moab Jan 6 '12 at 0:47
@Moab: Depends, if I were a VIP I wouldn't want my account number to be publicly known. Sadly, most information to log in are on my card and it requires a PIN code of four numbers to get in. Luckily that disables itself after three attempts or so though. Although, you'd never know. Hackers from Russia have been capable of transferring money away from accounts in our country; but that was because of software on the computer, which should be the first concern of an IT administrator anyway... :) – Tom Wijsman Jan 6 '12 at 0:49
If you pay someone with a check, then that payee and anyone who views that check will have the DDA account holder name and account number. Is this any different from seeing the account statement? Does this other person consider paying by check a security issue? – sawdust Jan 6 '12 at 0:55
In Australia, the only thing you can do with someone else's bank account number is deposit money into. – random Jan 6 '12 at 1:36

I'm no security expert, but here is my two cents:

Bank account numbers are indeed sensitive, but not much use without other information (e.g. routing number, social security). Every time I've ever needed to withdraw from an account, I needed the routing number or valid identification. I suppose it depends on the bank, but fraud prevention is not a new idea. In summary, it's like someone finding out your username, but not your password.

share|improve this answer

It CAN be a security risk, but the hacker would need to have the link between your computer, the mail servers, or the recipient's computer. Then they could potentially listen on the line and reconstruct the PDF from the output, then read it. I don't know how they can use the account numbers, as most of the movies look quite bogus for money transfers, but it is theoretically possible. The Security Stackexchange site would know more about this though

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.