What could a malicious party potentially achieve by having *just* a name, account number, and sort code?
I think the answer to this must differ from country to country.  I have lived in several countries where the normal everyday way of making a payment is to instruct my bank to transfer the money to the recipient's account.  Of course this means I must know his name, SC and account number – but this is an accepted part of the system; businesses routinely display that information on invoices and correspondence.  It is simply not regarded as confidential. DumbCoder's comment suggests that if he has that information he can take money from my account without my permission – in other words, my bank will pay money out of my account on someone else's request, without my authority.  Is this correct?  In which country or countries can this happen?   (I must go there quickly and begin stealing people's money.) When you want to pay a bill on line there are several ways to do it. You can give them your credit card details: Name on Card, zip code, credit card number, and 3 or 4 digit security code on the back. Most of the information is available on the card or via an easy Google search. If the crook has your card they can use it to buy something.  You can contact your bank's website and establish a one time or recurring transfer. You provide the information about the person/company. Your bank knows who you are because you used a secure system and your password. Their bank accepts the money because who would refuse money, they don't care who you are. You can provide the company with your bank info (bank number, your account number, and your name). If your bank limits their transactions via this method only to legitimate organizations, then your money will only be sent to legitimate organizations. But if the organization has no way of knowing who is on the other end of the phone or webpage, they may be withdrawing money from a bank account without the account owners permission.  In the example article a person found a charity that had lax security standards, they were recognized by the bank as a legitimate organization, so the bank transferred the money. The charity will point to the form and say they had permission from the owner, but in reality they didn't.  The subject of the article was correct, all the info required is on every check. It is just that most people are honest, and the few security hurdles that exist do stop most of the fraud. I disagree with Dumbcoder's response. Setting up a DD is not easily approved by the banks as you must prove a existing business cash flow. And secondly you cannot empty someone's account via DD as they are protected by the DD mandate. (Money goes out, complaint is made, money goes back in, the registered business with the DD facility has some serious explaining to do to the bank and FCA). Dumbcoder you likely work in a middle position of a company..
"No, the best you can do is (probably) determine the bank, from the sort code. using an online checker such as this one from the UK payments industry trade association. Revealing the name of an account holder is something the bank would typically require a warrant for, I'd expect, or whatever is covered in the account T&Cs under ""we provide all lawfully required assistance to the authorities"" Switching to what I suspect is your underlying problem - if this is a dispute that's arisen at the end of your tenancy, relating to the return of the deposit, then there are plenty of people to help you, for free. Use those rather than attempting your own detective work. Start with the UK government How to Rent guide, which includes links on to Shelter's pages about deposits. The CAB has lots of good info here too. Note that if your landlord didn't put your deposit in a deposit protection scheme, then as a professional landlord they could be penalised four times (I think) the deposit amount by a court, so stick to your guns on this." "Here are a handful of measures I take myself: I check my credit reports once in a while and look for anything out of the ordinary. If somebody calls me on the telephone claiming to be from my bank or credit card company, utility, etc. I ask for their number, check it, and call them back.  I don't give personal information to people merely claiming to be from a place I do business with. I never fill out ballots for free contests.  Most of the time these are scams.  When I get a call telling me ""you won a free cruise"" for a ballot I supposedly filled out at the mall, I say they're lying through their teeth.  For excitement, I'll sometimes buy a lotto ticket instead. I'm careful when I surf the web.  I don't give my personal information to web sites I can't trust.  If they look the least bit shady, I'm out.  Also, I use different passwords at different web sites.  I avoid using a password from a public terminal, but when I must, I change my password soon after. I'm careful when I download software.  I don't install anything I didn't get from a trusted source.  I pay for software when necessary, so finding a trusted source is not hard.  But, I've heard of people who – to save a buck – would download a pirated application from a shady warez site only to be ""gifted"" a trojan horse key logging or other spyware along with it. When I no longer need a bill, receipt, statement, etc. or any document containing personal information, I shred it, and I use a shredder that does a micro-cut, not just a strip- or cross-cut.  The micro-cut remains go in the green bin with wet and yucky organic waste. When I no longer need a hard drive, I use a secure wiping tool like Darik's Boot & Nuke before reusing.  If the drive isn't worth reusing, I'll wipe first then take apart with my Torx screwdriver.  Once I have the drive platter, I scratch the heck out of it.  Remains go to the community recycling depot. That's all I can think of right now; I probably missed a few :-) So, what do others do?  I'm curious, too." "You've touched on a very abstract concept that exist partly due to fractional-reserves and directly due to currency having no base (ex. not backed by gold), money can and does just pop into existence. To answer your question, we have to understand that the criminal is irrelevant. ""Can't a cyber criminal increase/decrease a bank's holdings just by changing a number in a computerized ledger book?"" The bank wouldn't need the cyber criminal's aid, they could change their own holdings. They have their own computers after all. Money's value is derived from trust. A bank that would change its own books would be black-balled. Similarly, a bank that un/consciously allows a cyber criminal change their holdings would lose trust. If this was a small transaction, they bank bottom line is unaffected. If these scandal is large enough to affect a bank's bottom line, the difference would be noticeable and raise suspicion." With Mint you are without a doubt telling a third party your username and password.  If mint gets compromised, or hires a bad actor, technically there isn't anything to stop shenanigans.  You simply must be vigilant and be aware of your rights and the legal protections you have against fraud. For all the technical expertise and careful security they put in place, we the customers have to know that there is not, nor will there ever be, a perfectly secure system. The trade off is what you can do for the increased risk.  And when taken into the picture of all the Other* ways you banking information is exposed, and how little you can do about it, mint.com is only a minor increase in risk in my opinion. *See paypal, a check's routing numbers, any e-commerce site you shop at, every bank that has an online facing system, your HR dept's direct deposit and every time you swipe your debit / credit card somewhere. These are all technically risks, some of which are beyond your control to change.  Short of keeping your money in your mattress you can't avoid risk.  (And then your mattress catches fire.) The reason people like Mint is because it allows you to see all of your financial details in one place. When you create an account, you’re able to link all of your bank accounts, credit cards, and investment accounts. This linking enables Mint to update your transactions automatically. The catch is that you have to provide the username and password you use for each one, which can certainly make you feel jittery if you’re worried about a security breach. Mint is designed to be a read-only service, which means you can’t transfer money back and forth between accounts. If someone were to get their hands on your Mint login, all they’d be able to do is view your balances and transactions. Your full account numbers aren’t displayed, nor are your bank account or credit card usernames and passwords. The only thing that would be visible would be your email address. If a hacker was interested in taking things a step further, there’s always the possibility that they could physically steal the information from Mint’s secure servers – but that’s really a long shot. That would require knowing where the servers are located, bypassing the physical security measures that are in place, and cracking the code on how the data is encrypted. If that were to happen, then your personal information might be at risk, but so far, there’s no record of it being attempted. I was very skeptical of Mint and how secure it truly was. I did my fair share of research. Try looking at: "It's anonymous/automated. They don't know who you are, just that customer x1a bought y. If your name isnt given to employees ""your"" privacy isnt being volated because the dont know its ""you.""  I imagine the government justifies their intrusions on our digital privacy the same way." Yes. It is a scam. The story makes no sense. They just want your info to steal your money. regarding requests to know how it works:  the scammer is requesting:  username, password, routing number, checking account number, and   security question/answers. they now have access to your bank account. they will have access until you are able to shut it down. Once they have your password, they can change it to whatever they want.  it can be used to launder money, steal money from other accounts you have, proof of identity... I would worry more about identity theft than your credit score at first.  I would want an explanation of how it happened and confirm that no one has used it.  I don't think it will be too big of a deal on your credit in the longer term. Aside from the fact that you could now get spam calls and mailings, nothing negative at all. With your account number, anyone can send you money (which you probably wouldn't mind), but otherwise, no access is possible. In Germany, every company and many people publish their account number, so they can receive payment. Every invoice contains address, phone number, and account numbers of the company that bills you, so you are able to send them money to pay the invoice. Nobody can access the money or details of your account with only the name and number; it needs your online login user id and password, or your (government issued) ID to do so. You don't need to worry at all. "Answers to your questions: (1) Do bank account numbers have a checksum. NO. (2) Is it plausible that they found out your number after sending you the money by ""accident"". NO. There is no way to find out who possesses a particular bank account just by the number. Also, how they even know they made a mistake? They targeted you and knew who you were and your bank account number before the ""money"" was sent. (3 and 4) Is this a scam? YES. They never paid you any money. They forged a check for a large amount and deposited it in an account. Then divided it up, wiring pieces to multiple people, all of whom they investigated beforehand. Since it is a bank to bank transfer it clears. Once the forgery is discovered, all the transfers will be unwound. If you had sent them money, you would have lost that money. Other things to note: There is zero chance of a wire transfer going to the wrong person because the sender has to list the name and address on the account as well as the number. You basically did the right thing which is to notify your bank that you received an unauthorized transfer into your account. Never accept money into your account from someone you don't know. If money ""appears"" in your account tell the bank it is an error and probably proceeds from a forgery and they will take care of it." "Unfortunately, Australian bureocrats made it impossible to register a small business without making the person's home address, full name, date of birth and other personal information available to the whole world. They tell us the same old story about preventing crime, money laundering and terrorism, but in fact it is just suffocating small business in favour of capitalistic behemoths. With so many weirdos and identity thieves out there, many people running a small business from home feel unsafe publishing all their personal details. I use a short form of my first name and real surname for my business, and reguraly have problems cashing in cheques written to this variation of my name. Even though I've had my account with this bank for decades and the name is obviously mine, just a pet or diminitive form of my first name (e.g. Becky instead of Rebecca). This creates a lot of inconvenience to ask every customer to write the cheque to my full name, or make the cheque ""bearer"" (or not to cross ""or bearer"" if it is printed on the cheque already). It is very sad that there is protection for individual privacy in Australia, unless you can afford to have a business address. But even in this case, your name, date of birth and other personal information will be pusblished in the business register and the access to this information will be sold to all sorts of dubious enterprises like credit report companies, debt collectors, market researchers, etc. It seems like Australian system is not interested in people being independent, safe, self-sufficient and working for themselves. Everyone has to be under constant surveliance." As far as I understand, equifax collects data about individuals and scores their credit worthiness. The ceo did Jack shit about keeping all that private data safe, so they got hacked and all that data is now in someone else's hands. The possible implications? Large scale identify fraud of anyone whose details got stolen, since it encompasses everything  that is needed for that. And that is besides the privacy violation. "Mostly ditto to @grade'eh'bacon, but let me add a couple of comments: Before I did anything, I'd find out more about what's going on. Anytime someone tells me that there's a problem with ""security codes or something"", I get cautious. Think about what the possibilities are here. Your relative is being scammed. In that case, helping him to transfer his money to the scammer is not the kind of help you really want to give. Despite your firm belief in your relative's integrity, he may have been seduced by the dark side. If he's doing something illegal, I'd be very careful about getting involved. My friends and relatives don't ask me to commit crimes for them, especially not in a way that leaves me holding the bag if things go wrong. Assuming that what is going on here is all legal and ethical, still there is the possibility that you could be making yourself liable for taxes, fees, whatever. At the very least I'd want to know what those are up front. As @Grade'eh'bacon, if he really has a problem with a lost password or expired account, by all means help him fix that problem. But become someone else's financial intermediary has many possible pitfalls." If its JavaScript-based you can check the source code to see if any messages are being sent, again this doesn't mean the code's malicious.  if there's any type of form submission you can't tell.  You could always implement it yourself, SHA1 is publicly accessible although not the easiest algorithm to build. I spoke to HMRC and they said #1 is not allowable but #2 is. They suggested using either their published exchange rates or I could use another source. I suggested the Bank of England spot rates and that was deemed reasonable and allowable.