IBAN secret or not about php-iban

[globalcitizen]

This is a good thing to think about.

Fundamentally, however, one should not assume that an IBAN is a secret, because it is in many cases generated from previous predictable systems or is broadcast to business partners or the public internet.

It is true that identifiers do have some privacy significance. However, I believe in the context of conventional banking systems their use is expected, so they should not be expected to be secret.

Once you have told anyone, the 'cat is out of the bag' (you cannot 'reset' the secret-ness of your IBAN).

I recommend reading about 'security through obscurity' for more discussion on these concerns.