How to Change Bank Account Details in WooCommerce

Problem Statement & Impact

Modifying financial routing information within an e-commerce platform such as WooCommerce introduces significant operational and security challenges. Whether transitioning between commercial banking institutions, restructuring merchant accounts, or separating operational entities, updating banking parameters directly impacts cash flow integrity, transaction validation pipelines, and customer trust. Inaccurate updates or improper execution during this administrative process can lead to immediate payment routing failures, interrupted checkout sequences, severe revenue leakage, and exposure of sensitive financial credentials to unauthorized actors if administrative interfaces are compromised.

The affected environments encompass the WordPress application core, the active WooCommerce plugin layer, underlying database tables containing payment gateway configurations, and third-party payment processor integrations (such as Stripe, PayPal, or localized Direct Bank Transfer setups). From a security perspective, unauthorized modification of bank account details represents a critical vector for financial fraud, specifically Business Email Compromise (BEC) and man-in-the-middle exploits targeting administrative sessions. If an attacker gains unauthorized privileges to the WordPress dashboard or database, altering BACS (Bank Automated Clearing System) or automated clearing house instructions redirects customer funds directly to malicious accounts without triggering standard application errors.

Ensuring absolute accuracy, maintaining rigorous access controls, and verifying data integrity across the entire application stack are essential to prevent transaction hijacking and administrative downtime. Organizations must execute these updates using secure protocols, strict session management, and programmatic verification frameworks.

Root Cause Analysis & Architecture

To understand how bank account details are stored and processed within WooCommerce, administrators must examine the application’s data architecture. WooCommerce stores payment gateway configurations within the WordPress database inside the wp_options table. Specifically, settings for built-in payment methods such as BACS (Direct Bank Transfer) are serialized and saved under option keys corresponding to the gateway ID—most commonly woocommerce_bacs_settings.

When an administrator updates account numbers, routing codes, or SWIFT/BIC identifiers via the WordPress dashboard, WooCommerce executes a form submission handled by the Settings API. The data is sanitized, serialized into an associative array, and written directly to the database. Below is a structural representation of how these settings are serialized within the database:

// Example of serialized BACS account data stored in wp_options (option_name: woocommerce_bacs_settings)
array(
    'enabled'      => 'yes',
    'title'        => 'Direct Bank Transfer',
    'description'  => 'Make your payment directly into our bank account.',
    'instructions' => 'Please use your Order ID as the payment reference.',
    'accounts'     => array(
        array(
            'account_name'   => 'SiteSuraksha Operations LLC',
            'account_number' => '****1234',
            'sort_code'      => '12-34-56',
            'bank_name'      => 'Global Commercial Bank',
            'iban'           => 'US12GLBL00000012345678',
            'bic'            => 'GLBLUS33XXX'
        )
    )
);

During the HTTP request lifecycle, when a customer selects Direct Bank Transfer at checkout and completes an order, WooCommerce retrieves this array dynamically. The stored account details are injected into the order meta table (wp_woocommerce_order_items and associated post meta) and displayed on the Order Received (Thank You) endpoint, as well as appended to transactional customer emails.

Vulnerabilities arise when administrators perform these updates over unencrypted HTTP connections, utilize compromised administrative accounts lacking multi-factor authentication (MFA), or rely on improper file permissions that allow local file inclusion or database tampering. Furthermore, caching layers—such as Redis, Memcached, or server-side page caches—can occasionally serve stale payment instructions to end users if object cache flushing is omitted after database writes occur.

Step-by-Step Implementation / Remediation Guide

Updating bank account details securely requires a structured approach encompassing administrative verification, database modification, and cache invalidation. Follow these precise procedures to update Direct Bank Transfer configurations without risking downtime or data corruption.

Phase 1: Administrative Access and Session Hardening

Before modifying financial parameters, verify that your administrative session is secure and encrypted via Transport Layer Security (TLS 1.3). Access the WordPress administrative dashboard using an account with the manage_woocommerce capability.

1. Log into the WordPress administration panel (/wp-admin/).
2. Navigate to WooCommerce > Settings from the primary navigation sidebar.
3. Click on the Payments tab to view all registered payment gateways.

Phase 2: Updating Direct Bank Transfer (BACS) Parameters

Locate the Direct bank transfer row within the payment methods table and click the Manage button (or click the gateway title directly) to access its configuration interface.

Scroll down to the Account details section. Here, you will find tabular inputs corresponding to account names, account numbers, sort codes, IBANs, and BIC/SWIFT codes. Input your updated banking credentials carefully, ensuring exact alignment with your financial institution’s verification documents.

If utilizing WP-CLI for programmatic configuration or headless environment deployments, you can update these settings directly via the command line to prevent dashboard exposure risks:

# Update WooCommerce BACS settings using WP-CLI
wp option update woocommerce_bacs_settings '{"enabled":"yes","title":"Direct Bank Transfer","accounts":[{"account_name":"SiteSuraksha Operations LLC","account_number":"987654321","sort_code":"56-78-90","bank_name":"Secure Trust Bank","iban":"US99STRT00000098765432","bic":"STRTUS44XXX"}]}' --format=json

After executing the command or saving via the dashboard interface, immediately flush the WordPress object cache to ensure that front-end checkout pages do not serve cached, obsolete banking information:

# Flush object cache and transient data
wp cache flush
wp transient delete --all

Production Hardening & Edge Cases

Production environments introduce unique edge cases, particularly regarding existing orders, caching behaviors, and multi-currency configurations. Administrators must account for these variables before declaring the implementation complete.

Impact on Existing Orders

Modifying the global BACS options via WooCommerce settings does not alter historical order meta. Orders placed prior to the modification retain the banking instructions stored within their respective order post-meta at the time of checkout. This architectural separation ensures that customers who have already initiated a transfer receive consistent instructions. However, if an order is unfulfilled and requires manual generation of a new payment request email, administrators must ensure that customer service representatives do not inadvertently distribute obsolete account numbers.

Multi-Currency and Regional Gateways

If your installation utilizes currency-switching plugins or region-specific payment gateways (such as localized bank transfer plugins for European or Asian banking networks), global BACS settings may be overridden by currency-specific rules. Verify each currency tab individually to ensure that banking identifiers match the corresponding domestic or international clearing networks.

Validation and Verification Checklist

Execute the following verification protocols in a staging environment prior to deploying changes to production, and repeat post-deployment validation immediately.

Diagnostic Verification & Checklist

To maintain ongoing security posture and verify that financial parameters remain uncompromised, administrators should implement continuous monitoring rules. Review the following diagnostic metrics and log locations regularly:

• Server Error Logs: Monitor /var/log/nginx/error.log or Apache equivalent for PHP warnings related to unserialization failures or memory exhaustion during settings saves.
• Database Change Monitoring: Implement database integrity monitoring (such as checksum validation on wp_options) to detect unauthorized, out-of-band modifications to financial routing options.
• HTTP Response Headers: Ensure security headers (Strict-Transport-Security, Content-Security-Policy) are strictly enforced to protect administrative sessions against cross-site scripting (XSS) vectors that could target payment gateway forms.
• File Permissions Audit: Verify that wp-config.php and core directories maintain restrictive permissions (e.g., 644 for files, 755 for directories) to prevent local privilege escalation.