Can my e-banking account be hacked just using an IBAN number, address and copy of my iden­tity card? No, but ...

With many types of fraud, attackers demand per­sonal data such as your name, address and tele­phone number. In many cases, they also ask for an IBAN or request that their vic­tims submit a copy of their pass­port or iden­tity card.

Since bank secu­rity processes are improving all the time, attackers nowa­days usu­ally resort to social engi­neering. They obtain infor­ma­tion by spying on their vic­tims, deceiving and manip­u­lating them, for instance using faked e-mails and websites.

When looking at existing e-banking accounts, such data are not really rel­e­vant to an actual fraud, but only serve to estab­lish the victim’s trust and to under­line an offer’s pur­ported integrity. These cases might for instance involve some kind of reim­burse­ment or profit dis­tri­b­u­tion. It is not pos­sible to with­draw money from your account just using an IBAN number and a copy of your iden­tity card. It is how­ever pos­sible to exploit your IBAN, for instance when someone arranges for a direct debit pay­ment using your IBAN when online shop­ping. How­ever, this is not very lucra­tive for fraud­sters, since you can object to pay­ment orders with your bank for up to a year to have them posted back to your account.

As far as the col­lec­tion of address data and copies of pass­port or iden­tity cards in the con­text of appli­ca­tions for new accounts with for­eign banks and credit insti­tu­tions are con­cerned though, things are han­dled a bit dif­fer­ently. Once they have sub­mitted an appli­ca­tion using such address data together with a copy of a pass­port or iden­tity card, fraud­sters are suc­cess­fully taken on by finan­cial insti­tu­tions. These scam­mers’ smart­phones or com­puters are reg­is­tered with the bank, so that two-factor authen­tifi­ca­tion doesn’t pose any obsta­cles either. Fraud­sters obtain full con­trol over the account set up in the victim’s name and use such accounts for crim­inal activ­i­ties. It is not the scammer’s name appearing in such cases then, but the one of the victim, so that charges are brought against the latter – some­thing which can result in com­pli­cated and long-winded pro­ceed­ings if proof is required that it wasn’t the victim who com­mitted a crime, but that they fell victim to fraud instead.

Gen­er­ally, you should be scep­tical and cau­tious about passing on any per­sonal details. If you notice any incon­sis­ten­cies, you should imme­di­ately con­tact your bank and the police.