25

I've looked at a number of question/answer threads and docs about PCI compliance, including various results on Google and have not found a definitive answer to this question:

Does a web app fall under PCI compliance rules/regs if it collects the bank account-routing number combination via a web form and passes it along to a 3rd party for persistence/validation (assuming that it also logs the web requests in transit)?

zealoushacker
  • 353
  • 1
  • 3
  • 5
  • 2
    If all you are doing is storing the rounting number, that information is public, the banks provide this information on their own. If you are storing the user's bank account number then you should treat it as PII, because the only information require to make a withdraw, is the checking account number and the rounting number. The fact you are asking this question means you have no business collecting this information because, YOU WILL store it in an insecure way, because your asking if it calls under these compliance rules. – Ramhound Jul 10 '12 at 12:14
  • 2
    DO NOT collect this information, DO NOT store this information in plain text, otherwise the information WILL be leaked eventually and every single one of those accounts will be at risk. – Ramhound Jul 10 '12 at 12:15

2 Answers2

17

Since PCI stands for Payment Card Industry the short answer is no.

However that information is sensitive so you should treat it like any other sensitive data and store and transmit it in a secure, encrypted form.

PCI is a great baseline for dealing with any secure data so it certainly wouldn't hurt to treat it the same.

mjallday
  • 286
  • 2
  • 4
3

First off - thanks for asking the question. Second, the respondent that stated its PII and should be protected is accurate.

At a minimum I'd employ field level encryption. Along with N tiered architecture for an app on a site managing this - or consider outsourcing payment management to a third party, avoiding many issues.

We manage payments for a few hundred thousand transactions a month and we don't touch credit cards in house (small number for us), we use PCI like controls on checking within the limitations of our finance software and leverage field level encryption of account numbers Active Shooter - location = a mitigation.

Isaac
  • 31
  • 1