[OMBUG]

I know Halifax at least uses a separate string for those checks, which presumably is stored unencrypted.