Take the 2-minute tour ×
Skeptics Stack Exchange is a question and answer site for scientific skepticism. It's 100% free, no registration required.

With a credit-card number, validity date and CVV-code, people can make purchases, so this information should be strictly protected. But if I post my bank account details online (IBAN + BIC/SWIFT), does this put me at any risk at all? In my understanding, this allows people to transfer money to my account; not from my account. But with direct debit, companies may be able to withdraw people from my account. Can they? Am I at risk?

On Yahoo Answers the answer is "not safe", whereas on Money.SX the answer is "it depends", but neither answer is sourced very well. In fact, many different websites say different things...

Does anyone have a reliably sourced answer laying out the risks of doing so in different banking systems and different parts of the world?

share|improve this question
    
What is the claim you are skeptical of? From the FAQ Skeptics is about applying skepticism — it is for researching the evidence behind claims you encounter. It is not for speculation, philosophical discussions or investigating original claims. You are asking for us to investigate the risks... You have several notable claims to be skeptical of, but you are not asking us to show proof or contradiction to any of them. That makes this a poor question for skeptics. –  Chad Aug 21 '12 at 14:22
1  
What reason would you have to post your bank account number in a public forum? –  Sam I Am Aug 21 '12 at 18:56
2  
I think this is on-topic, but the answers should not contain any personal research. Possible valid facts to find: cases in which accounts have been compromised this way; studies by security firms which recommend against similar practices or at least that specify account numbers should be crypted when stored in a database; &c. –  Sklivvz Aug 21 '12 at 19:24
    
This could be a better fit for money.se. –  coleopterist Aug 22 '12 at 20:19
2  
@gerrit: even experimentally, this question can only be answered for single countries as the safety will very much depend on the local transaction laws. –  cbeleites Jan 12 '13 at 19:33
show 3 more comments

2 Answers

up vote 19 down vote accepted

An experiment was conducted by Jeremy Clarkson in 2008 to test the hypothesis that it was safe. He published his bank details in the newspaper.

The Top Gear host revealed his account numbers after rubbishing the furore over the loss of 25 million people's personal details on two computer discs.

He wanted to prove the story was a fuss about nothing.

But Clarkson admitted he was "wrong" after he discovered a reader had used the details to create a £500 direct debit to the charity Diabetes UK.

[...]

"I opened my bank statement this morning to find out that someone has set up a direct debit which automatically takes £500 from my account," he said.

"The bank cannot find out who did this because of the Data Protection Act and they cannot stop it from happening again.

"I was wrong and I have been punished for my mistake."

My personal recollection of the incident (that I haven't been able to verify with references) is that, while it was legally possible for Clarkson to dispute the charge and demand that the bank reverse the transaction, he elected not to because the money went to a worthwhile charity.

share|improve this answer
1  
@Chad: you're giving example from US, which uses billing system completely different from European ones. In Europe directly charging bills from account is standard. Electricity, gas, water, phone companies only need your account number, full name and address to bill you. –  vartec Aug 21 '12 at 16:24
1  
@Chad I don't see how my saying that an advert is not an adequate reference is different from your saying that an anecdote is not an adequate reference. –  DJClayworth Aug 21 '12 at 16:40
    
@Chad. OK good point. –  DJClayworth Aug 21 '12 at 16:46
4  
It is a confirmed example of it not being safe. One example is all I needed. The fact that the UK bank couldn't prevent it from recurring shows that even if he eventually got his money back, the problem wasn't over; it remains unsafe. The perpetrators use of a charity was the trick; the charity couldn't be blamed for the transaction. If the perpetrator tried to directly benefit, they might expect to be detected and charged with fraud. –  Oddthinking Aug 21 '12 at 17:26
    
I remembered there was something like the Jeremy Clarkson incident, wanted to add it to my question, but couldn't remember enough details to google what it was again –  gerrit Aug 21 '12 at 19:35
show 6 more comments

It does depend. In the USA, the Federal Trade Commission says that you can limit your liability for fraudulent electronic transactions that are reported within 60 days.

What if I find unauthorized transactions on my account?. - Generally, if you find unauthorized electronic check conversion on your account (or someone has fraudulently obtained your banking account information), notify your financial institution immediately. Your level of loss depends on how quickly you report the problem.

Under federal law, for unauthorized electronic check conversion, you have 60 days to report these transfers after your bank account statement containing the problem is mailed to you. If you fail to report the unauthorized transfers within this time period, you risk losing all the money in your account and the unused portion of your maximum line of credit for overdrafts. It’s also a good idea to report any other unauthorized transfers on your account or problems regarding any loss or theft of your checks immediately.

Contact your financial institution about any additional limits on liability they may offer.

Of course, they recognize that giving up your banking information to anybody is still dangerous. (Note: While your bank is investigating if the withdrawals were legal, you may not have access to your account or the money that should be in it. This can last from 45-90 days. (FDIC: laws and regulations))

Be especially cautious about sharing your bank and checking account numbers. Do not give out personal information – particularly on the telephone, by e-mail or otherwise online – unless you have initiated the contact or know who you’re dealing with. Scam artists can use your personal information to commit fraud – such as identity theft. That’s where someone uses your personal information, such as your checking account number, Social Security number, mother’s maiden name, or birth date, without your knowledge or permission, to commit fraud or theft.

These recommendations are based on the Electronic Funds Transfer act, the details of which can be found here. It might be as little as $50.

share|improve this answer
    
This answer is badly worded. Need to just expand on the federal regulations link at the bottom of the page ($50 max with 2 day notice, $500 of within 60 days, $all if not notified...barring state regulations. –  user1873 Aug 21 '12 at 15:04
    
Not an answer. The question is whether it's unsafe, not whether any consequences of it being unsafe enjoy protections by the law. –  Sklivvz Aug 21 '12 at 20:41
    
@Sklivvz - they recognize that giving up your banking information to anybody is still dangerous. that is from the OP's post... –  Chad Aug 21 '12 at 20:53
    
@Chad surely "they recognize that xxx" is not a viable skeptics answer. It's just someone's opinion, not the conclusion of a specific study. –  Sklivvz Aug 21 '12 at 21:24
    
@Sklivvz, Not an answer? I must be misunderstanding, "am I at risk? What are the risks under different banking systems" Certainly, you risk losing money from your account. –  user1873 Aug 22 '12 at 1:59
show 4 more comments

protected by Oddthinking Jan 22 '13 at 11:20

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.