Hacker News Reader

Comment by TillE | Hacker News Reader

> I don't know off the top of my head my account number or routing info. Looking it up is a pain and typing it in can be done incorrectly. This isn't something I want to do regularly.

But how is that any different from a credit card number? I have all my bank info in my pocket, right on my Maestro card. No expiration date, no CVV code. Just an account number and a publicly-known bank number. If I'm authorizing a direct debit, that's all I have to enter.

View on HN

As davidhansen said, a typo on a credit card number is likely to be an invalid number. In addition to that, I almost never give anyone my credit card number directly. I swipe the card so there's basically no chance that I'll get the number wrong. And the security is addressed by the credit card company, who guarantees that fraudulent or incorrect charges will be credited or reversed. There's no such guarantee with a direct debit, and that makes it a much larger security risk. (This is one of the reasons that Visa charges 2%, of course. You're paying for insurance.)

My guess would be the size of the collision space. Bank account numbers tend to be shorter, and depending on date of opening and institution, may have been sequentially assigned. It would be much more difficult to accidentally enter someone else's credit card number than someone else's bank account number. In addition, if you accidentally sent $5k to 61-019341 instead of 61-018341, chances are the recipient would be less than willing to be a good citizen and admit it was an erroneous deposit.

UK bank account numbers is a 6 digit sort code + 8 digits account number. The account number is unique for the bank, and assigned however the bank wants. It might very well have been sequentially assigned for some institutions.

The 6 digit sort code is unique for the bank branch across all UK banks, generally the branch on record for the account (most UK banks use the sort-code for the branch the account was opened at). Unless you happen to mistakenly enter an account number and sort-code that matches, and you manage to mistakenly enter the name of the account holder for that bank account, they'll usually catch it.

The situation is similar across Europe, so if this is a problem in the US, it's a problem of the banks own making, and one easily solved the same way it was in the UK: By adding a sort-code, and matching on the name as well.

Reply on news.ycombinator.com