Security of Online Donations

[dh249]

What security protocols and processes have been implemented to ensure member bank account information used in conjunction with the new online donation functionality cannot be hacked, intercepted, or stolen?

[aebrown]

What security protocols and processes have been implemented to ensure member bank account information used in conjunction with the new online donation functionality cannot be hacked, intercepted, or stolen?

This is a community forum, so it's unlikely that any forum users know the answer. I'm confident that the Church exercised great care in setting up the security, but I don't know any specifics, nor is it likely that any such details would be published.

[mevans]

In a previous job, I did a lot of work with implementing USA (and sometimes Canada) ACH and Credit Card transactions through various service providers. Credit cards have the PCI compliance standard for security, but I'm not aware of a similar ACH security standard. I do remember that our clients often times had more difficulty getting approval from service providers for ACH transactions than credit card transactions, so someone is reviewing who they let into the system.

The church is already experienced in processing payments from things like the distribution center, so they have some in-house expertise in this area. Like aebrown, I believe the church was very careful in implementing this system. I would expect they have taken appropriate safeguards. They've also previously implemented online donations in other countries, some of which may have more strict standards than the USA.

[gregwanderson]

Here's my solution to a lot of security concerns: I have more than one checking account but there's only one bank account that is used for online transactions. Through my bank's website I can transfer money into that account but I do not grant third-party access to any other account. So if my online activities are hacked (excluding the bank itself getting hacked) then I know that it only involves that one bank account, which will have a balance of only a few dollars more than is needed for online transactions I have already scheduled. My bank offers a "free" checking account with no monthly fees, so having a separate account to handle online transactions doesn't cost me anything. (It is subject to terms like a limited number of checks written each month, but I don't write checks from that one anyway and there is no restriction to the number of online transactions per month.) So I could get another one if I wanted to do certain online business with one and other online business with the other too. But it's simple enough to just have all outsiders using the one account and I'm just careful about transfers to maintain the correct balance.