[paulddraper]

A bank account number (assuming that is what are talking about, not some token) is already very sensitive information. Like, legal status protected information.

Knowing approximate age is a relatively small leak compared to that.

[zie]

bank account numbers are printed on every check you ever wrote. Most people don't write checks anymore, though online bill pay sends physical checks still sometimes. They never really were sensitive information.

Bank security does not depend on your bank account being private information. Pretty much all bank security rounds to the bank having a magic undo button, so they can undo any bad transactions after it comes to light that it was a bad transaction. Sure they do some filtering on the front-end now to eliminate the need to use the magic undo button, but that's just extra icing to keep the undo button's use to a dull roar.