The sensitivity of the traditional bank account and sort number combination is totally backwards, at least in the uk, the only things you can do with a sort code and account number is pay in funds (or set up a direct debit but that's why the direct debit guarantee requirement exists). I'd feel uncomfortable extending my data exposure with my card number when I just want to receive funds.