138

I accepted a job offer for a student support position in a major bank in Austria. As expected, they require me to send some documentation before I start working there.

What surprised me is that they asked me to send a photo of both sides of my bank account card. Is it safe to do so?

I interviewed in person at the bank's headquarters office, so I don't think anything suspicious is going on.

Note that my card has a CVV.

EDIT

So I asked HR about this and they told me that it is due to internal rules which apply for all candidates. So I asked some of my friends who work there about this “rule” and they told me that they had to send pictures of their cards as well and that it is okay.

EDIT

After pressuring the HR with questions about these internal rules, they resigned and told me that it is sufficient to send only IBAN and BIC code. Thank you all for help!

Improve this question
35
  • 175
    "due to internal rules which apply for all candidates" is NOT an answer to the question "Why do you need this?"
    – DJClayworth
    Commented Jul 15, 2019 at 20:33
  • 23
    Are you absolutely certain this is a real job, and not a scam? If it is, they may be testing you..
    – Jonas Czech
    Commented Jul 16, 2019 at 5:56
  • 37
    So I asked HR about this and they told me that it is due to internal rules Me: ok show me those rules. Where is that policy written down?
    – Pieter B
    Commented Jul 16, 2019 at 9:27
  • 8
    @undefined: Please don't talk about "EC cards". EC cards (short for "Eurocheque card") where abolished in 2002! What you probably mean is a "Girocard" - but that is a German system, not used in Austria.
    – sleske
    Commented Jul 16, 2019 at 10:20
  • 7
    @sleske no, EC means nowadays "Electronic Cash". But yes, EC Cards are today called girocard. Everyone still know what one means when on say EC Card
    – undefined
    Commented Jul 16, 2019 at 10:40

11 Answers 11

Reset to default
268

DO NOT DO THIS

You are interviewing at a bank. They SHOULD know better than to ask you for this information.

It is possible that they believe your "bank account card" is just a simple "EC card" which may not contain any security features. They may not be aware that there are some banks that use a single card for transactions as well as for bank purposes. See undefined's answer for more information.

However, don't be caught in the game where you ask for reasons on why you should send pictures of your card. There is NO REASON why they need actual pictures of your bank card. So don't even invite them to say things that are not true and attempt to confuse you.

Here are some examples of common BS reasons given:

  • It's company policy
  • Everybody is required to
  • We can't pay you without it
  • It's required by government regulations
  • You can trust us, we are a bank
  • We just need some information from it
  • We need to verify your identity
  • So you can be protected from cyber attacks
  • (Anything else that is said)

They may say they are trying to prevent transcription errors, if you were to type out, for instance, your IBAN. However, it is far better to copy and paste that from an online statement, and allow them to copy and paste from the email into their HR system, than take photos and hope their staff manually transcribe correctly.

Regarding the card, there is often not just a CVV number, but there can be other security measures on that card, that you leak by trying to be clever, taking a screenshot, and blurring things out. For instance, on my Visa card, there is an additional code that some merchants use to verify the card is in my possession. So DON'T SEND A PICTURE OF THE CARD, even with blurring.

Because you are in Austria, simply send them either your IBAN, or your bank name, branch name, and account number. If they need more than that, contact YOUR bank, and ask for their advice.

Improve this answer
4
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    Commented Jul 16, 2019 at 11:40
  • This is why I have removed the CVV from the back of my card: not because I took a photo, but to prevent anyone else from doing so.
    – KlaymenDK
    Commented Jul 18, 2019 at 8:07
  • Transcription Errors with actual consequences are very uncommon with IBAN, since the IBAN-Number contains an error-checking code, so a simple typo will usually result in an invalid IBAN, which is directly detected.
    – Falco
    Commented Jul 18, 2019 at 8:51
  • Also, blurring doesn't necessarily make something unreadable. It's theoretically possible for computer analysis to figure out what numbers are there from something that looks unreadable. A blurred 1, for instance, should be lighter than a blurred 8 (assuming dark text on a light background). "For instance, on my Visa card, there is an additional code that some merchants use to verify the card is in my possession" To what are you referring?
    – Acccumulation
    Commented Jul 18, 2019 at 17:28
139

Is it safe to do so?

Based on my experience this is not normal practice and not safe.

The company doesn't need a copy of your debit card in order to pay you. There are several security concerns when faxing, emailing, or sharing this information in general.

What I would do is provide my checking account number and routing number so they can pay me. If that is not acceptable to the company, I would be very cautious of going to work for them.

Improve this answer
6
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    Commented Jul 15, 2019 at 13:46
  • 53
    To add to this, storing the CVV of a card in any way is against PCI Standards generally: smallbusiness.findlaw.com/business-operations/… That a bank would not know this and would chose to insist on having such card information on file is difficult for me to believe. Of all the people who must know better, absolutely anyone in banking or finance must have at least this level of competence expected of them.
    – BrianH
    Commented Jul 15, 2019 at 17:50
  • 11
    FOR THOSE IN THE UNITED STATES rather than Austria, there's a caveat. Bank account numbers here are bidirectional. So while it's true that your employer should ask for your account number to pay you, it's also a strange situation because if you don't trust someone with your debit card number, you should definitely not trust them with your bank account number.
    – user541686
    Commented Jul 15, 2019 at 21:45
  • 6
    @Mehrdad: While bank account numbers here in the USA can be used to set up transfers in either direction, merely knowing an account number is not considered any sort of evidence of authority to transact on the account, while having card details is prima facie evidence of authorization. I definitely provide ACH routing and account numbers to persons and institutions which I would never share my debit card data with, and I think you are backwards -- if you wouldn't pay someone by check, you should definitely not trust them with your debit card number.
    – Ben Voigt
    Commented Jul 16, 2019 at 5:25
  • 1
    @BenVoigt: I mean, it's not exactly hard to order a check and put someone else's account number on it. So it just depends on if you're more worried about losing a few hundred bucks to someone who cares about their reputation, or your entire bank account's worth to someone who might, well, not. Personally I find the latter far more worrying but it sounds like you're more worried about the former.
    – user541686
    Commented Jul 16, 2019 at 5:52
44

NOPE! BIG RED FLAG!

The information on both sides of your card is enough to put some nasty charges on your account. People interviewing at the bank should absolutely know better. The person who asked this of you (it might not be the interviewer) could well be a rogue employee.

Either that or they are gauging how susceptible to social engineering you might be. Unlikely though, as this would be a poor way to start employer-employee relations.

I would send the email asking for pictures of the card to their fraud department either way.

Improve this answer
4
  • 1
    It might not even be an employee necessarily. Getting access to a conference room at an office building does not take much
    – Layman
    Commented Jul 16, 2019 at 8:05
  • 2
    @VictorS For a typical office building you are correct. The offices at sizable financial institutions are typically more locked-down. With that said it still isn't impossible for a non-employee to get in.
    – 520 says Reinstate Monica
    Commented Jul 16, 2019 at 9:17
  • 1
    Not necessarily. The building I work in hosts a BofA team. A MitM attacker could simply greet a candidate right off the public elevator at the BofA floor and get them to some other floor for their interview. The attacker does not need actual access, just the illusion of it
    – Layman
    Commented Jul 17, 2019 at 2:18
  • 1
    @VictorS Fair enough. Its disturbing how easy your scenario seems.
    – 520 says Reinstate Monica
    Commented Jul 17, 2019 at 9:22
20

The request from the bank is NOT scam.
Seems like the OP is talking about a so called "Debit-Bankomatkarte" which indeed have a CVV.
But I still think that the employer in question did not mean that card. It is more likely that the the employer isn't aware that OP already got this new card (because those cards are kinda new in Austria).


[please note I'm excluding foreign bank accounts and foreign cards from my answer (foreing for Austria)]

In contrast to all other answers, for me this is a normal behaviour, which I have already experienced with several employers.
There are no security features or the same on the EC card.

The employers who wanted me to do this in the past said they needed it so they could be sure that the salary payments were in the right account.
Because such an incorrect transfer is difficult or impossible to reverse.

It seems like OP is having a so called Debit-Bankomat-Card. Those cards are kinda new in Austria (first issued in early april 2019):

Seit Kurzem gibt es in Österreich eine neue Karte zum Geldabheben, die die bisherige Bankomatkarte ersetzt: die Debitkarte. Ausgegeben von Erste Bank und Sparkassen kann die neue Karte, eine Mischung aus Bankomat- und Kreditkarte, auch für Onlinezahlungen verwendet werden. source

(A new card for withdrawing money has recently been introduced in Austria, replacing the previous ATM card: the debit card. Issued by Erste Bank and Sparkassen, the new card, a mixture of ATM and credit card, can also be used for online payments.)

Further information:

... Ab sofort geben Erste Bank und Sparkassen statt Maestro-Bankomatkarte eine Mastercard Debit aus.
Der größte Unterschied im Vergleich zur früheren Maestro-Debit-Karte liegt beim Bezahlen im Internet. Überall dort, wo gewöhnliche Mastercard-Kreditkarten akzeptiert werden, kann auch mit der Mastercard Debit bezahlt werden.

Die entsprechende Nummer findet sich auf der Karte auf der Vorderseite, genauso wie bei einer Kreditkarte. Der oft abgefragt CVC2-Code befindet sich auf der Rückseite neben der Unterschrift. ...

... Erste Bank and Sparkassen are now issuing a Mastercard Debit instead of a Maestro ATM card.
The biggest difference compared to the former Maestro debit card is when paying on the Internet. Wherever ordinary Mastercard credit cards are accepted, payment can also be made with Mastercard Debit.

The corresponding number can be found on the front of the card, just like on a credit card. The often requested CVC2 code is located on the back next to the signature. ...

OP should not send a photo of this card to the new employer, instead OP should tell them that OP is having a so called Debit-Bankomat-Card which contains sensitive information.

Improve this answer
28
  • 1
    From the wikipedia article on CVV: "Diners Club, Discover, JCB, MasterCard, and Visa credit and debit cards have a three-digit card security code."
    – Gregory Currie
    Commented Jul 16, 2019 at 10:27
  • 2
    @GregoryCurrie yes, which are all not "normal" bank account cards.
    – undefined
    Commented Jul 16, 2019 at 10:33
  • 1
    They are where I am from, and would appear to be the same for the OP.
    – Gregory Currie
    Commented Jul 16, 2019 at 10:34
  • 1
    All good. I'm going to update my answer anyway. This is the most likely source of confusion.
    – Gregory Currie
    Commented Jul 16, 2019 at 11:17
  • 3
    I'll say as an Austrian myself, I never heard of "Debit-Bankomat-Cards" myself and a normal debit card will not contain any sensitive information (name, IBAN, valid through, card number in my case). While I don't understand why anybody would ask for more than simply the IBAN, it seems like such a weird exception to the case that it's probably the first time this comes up.
    – Voo
    Commented Jul 16, 2019 at 16:33
19

IMHO, sounds like a scammer phishing for personal information. No employer needs your card for payroll setup. Bank information provided on the first day of employment when filling up the forms does that.

DO NOT SEND them these pictures and no more personal information.

Instead, start researching the party you are in communication with.

Improve this answer
2
  • This was my first thought, that this is a particularly good spoofing attempt. I recall reading a blog post from someone in security who'd recently fallen for a fake account reset email...because they had actually used a password reset link moments before they got the fake email. Scams like this hinge on luck: they are counting on at least one person actually expecting an email from the person/business they're pretending to be.
    – BSMP
    Commented Jul 15, 2019 at 16:11
  • 12
    Might even me a MitM attack sourcing candidates for a real bank, without the bank being aware.
    – Jeffrey
    Commented Jul 15, 2019 at 22:22
12

The best thing to do is ask for an explanation and provide appropriate information. In all likelihood, your employer is working to set up payroll for you.

It doesn't hurt to make a quick call or email to a recruiter or manager inquiring about the request. You can always phrase your question as "I want to make sure I get you the right information, can you share what my banking information is needed for?"

A photo of your IBAN/BIC card is fine if your employer is looking for your account number and sort code for payroll. If your card doubles as an ATM card, you should obscure anything except your name and the account numbers.

If the employer provides a reasonable explanation and asks for appropriate information, be prompt in providing it.

Improve this answer
19
  • 31
    No. Just no. No matter what they say, never share the CVV with anyone.
    – Gregory Currie
    Commented Jul 15, 2019 at 13:11
  • 22
    It doesn't matter what they say -- they don't need a copy of your card and three digit code period.
    – Neo
    Commented Jul 15, 2019 at 13:41
  • 6
    @MisterPositive what if they say "we need your account info for direct deposit" and the discussion of the card was a misunderstanding by OP? I agree sending the right information is best, but asking for clarification is an important step here.
    – Jay
    Commented Jul 15, 2019 at 13:44
  • 8
    Are we totally dismissing the possibility the OP could be confused about what was requested? I'm surprised the popular reaction is to be uncooperative with a future employer without seeking some clarification.
    – Jay
    Commented Jul 15, 2019 at 13:47
  • 4
    At my place of work, accounting asks for a photo or scan of the bank card of a new employee. This happens as a bunch of people have proven to be unable to write legible. They only want the front for the IBAN, though.
    – Hermann
    Commented Jul 15, 2019 at 21:22
5

Don’t do this, some cards have the 3 digit confirmation code on the back .

Sending the account number which can also be the IBAN number and a sorting code should be sufficient.

Improve this answer
1
  • 1
    My card has it and that is the main reason of my worries
    – Maria
    Commented Jul 15, 2019 at 12:47
3

I have seen similar silly request several times.
The real reason is the employer assumes you are not able to 'spell' your IBAN and BIC without making an error, so your salary would go into the wrong account, and the you'd whine and complain, and they have to run after it.
In the US, employers and banks typically insist to get a voided check, for the same reason - the numbers are printed on it.

[Working in IT, I can confirm that half the people are sloppy or dumb enough to really 'misspell' their account numbers]

So there is probably nothing bad going to happen, but it is still a silly rule. Just make sure you don't give them accidentially the wrong number...

Improve this answer
1
  • 1
    I wouldn't trust myself to spell it correctly, and instead I'd copy and paste it from my online banking site.
    – Gregory Currie
    Commented Jul 18, 2019 at 7:33
1

As others have pointed out, this does sound very suspicious. I certainly wouldn't do this, however what I could consider is sending them scans of front and back of the card with the card number on the front and CVV and signature on the back blacked out. This way they'll only get your name and account details (account number, branch/sort code, and name).

I would further encrypt the images before emailing and only disclose the encryption password over the phone to the person I have personally dealt with.

Improve this answer
7
  • Or print the photos and send them by snail mail.
    – Keith Thompson
    Commented Jul 15, 2019 at 22:20
  • @KeithThompson yes, that works with too. With the right bits blacked out. And send by registered post with proof of delivery required.
    – Aleks G
    Commented Jul 15, 2019 at 22:31
  • 1
    And if you send a photo by email, some methods of blacking out parts of it can leave information that can be recovered.
    – Keith Thompson
    Commented Jul 15, 2019 at 22:36
  • True, although the simplest one of scanning to an image, then painting black pixels will usually work.
    – Aleks G
    Commented Jul 15, 2019 at 22:37
  • Or, just go there in person.
    – Gregory Currie
    Commented Jul 16, 2019 at 1:16
1

3 EASY SOLUTIONS
IF it's a job that one CANNOT afford to loose, and (as the OP stated), they insist with the so called "regulations", forcing you to give up those card photos (which i ABSOLUTELY DON'T RECOMMEND, because it's INSANE no matter how you look at it), you could do the following:

  1. Simply tell them that you do NOT own a credit card. You have a bank account, but you... "were scammed once" or something alike, and didn't get one after. It's your word against their's, and its very possible they will offer the alternative below.
  2. If you already told them you own a credit card (...well, you can't undo it), or you said you don't own one, and they still make it a requirement, even with their regulations, you should strongly express your concerns, politely refuse, AND, since it's a bank we're talking about, offer them an alternative, to open an account with them. Whatever information they are after, they would now own, and you would not be required to give it anymore.
  3. by using solution 1 or 2, you are technically covered, because you are complying with their regulations, and should they deny you the job, or they still insist that you give them a copy of your card, go and buy a prepaid card, never put money on it, and you should be safe. But if you come down to doing this, then surely (100%), something else is going on, and you should refuse all together. Banks should not require that info on the first place. It's illegal and should be reported.

P.S. IMPORTANT!!! - take note, that there are still "places" in the world (maybe not Austria) that can charge your credit card with ONLY the 16 digits on the front and the expiration date (no need for CVV). FYI, just as a(nother) side note, why giving up even half that info could be dangerous.

I have a feeling the OP is going to give up those photos one way or another, because i know what a job at a bank means, at an early age, and the opportunities that present with itself. Furthermore, the friends, HR and the bank will seem a more reliable source, and eventually he will give in... though he shouldn't,...no matter what.

Improve this answer
0

Based on your edits it sounds like HR requested photos of the card in your best interest.

One

They have had too many people typo their banking information so direct deposit was messed up or delayed.

If they get a picture with numbers then the blame would be 100% on them if something goes amiss.

Two

HR departments deal with direct deposit fraud. It is very likely that they have encountered people that try to intercept someone else's direct deposit by providing their account information instead.

If they get a picture of your card with your numbers and your name then they can rest more assured that their not being phished.

If you're worried about the CVV code then cover it up before taking the picture.

Personally, I always supply them with a physical check which has VOID written on it with permanent marker in several locations.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .