Responsible Disclosure Program
PNC Security is continually adapting to the changing cybersecurity landscape and to stay ahead of bad actors and threats to our systems and applications. However, keeping our customer and employee information safe is not achieved by technology alone – it takes alert employees, customers and partners, who know how to recognize and report issues.
PNC’s Responsible Disclosure program allows our customers and partners to submit vulnerabilities that they may find on any public-facing website or application owned, operated or controlled by PNC Financial Services. Any services provided or hosted by a third-party are not eligible. If you are unsure if the vulnerability you are reporting meets this criteria, please contact us at ResponsibleDisclosure@pnc.com
Email Vulnerability Reports to:
Customer Service Numbers
If you have questions about your account or want to bank by phone, we have a number for you to call.
Call Us at 1-888-PNC-Bank (1-888-762-2265)
Visit Customer Service »
Visit our Branches »
How to Submit a Vulnerability
Vulnerability reports can be emailed to ResponsibleDisclosure@pnc.com.
The information you provide will be reviewed by members of PNC Financial Services. Your report should include the following information:
- The application, service, product, or system involved.
- The type of issue discovered.
- An estimated impact of the vulnerability.
- Suggested mitigation or remediation.
- A detailed description of the potential vulnerability.
- A complete walk-through describing the steps necessary to reproduce the vulnerability.
A detailed report is crucial to the team to remedy your submitted vulnerability. If the above requirements have been met, we will confirm receiving your report within three business days. The information you provide will be used to correct vulnerabilities and improve the security of our applications and infrastructure. A member of the Security team will reach out to you if additional details are needed.
While confirming the vulnerability, PNC Financial Services will attempt to keep you informed of the status on a reasonable basis.
By submitting your vulnerability disclosure to PNC Financial Services you agree that you will keep information related to the vulnerability confidential and not disclose the vulnerability to any third-party unless PNC Financial Services has provided you with written authorization to do so. Submission of this vulnerability report provides your permission for PNC Financial Services to use, create derivatives of, disclose, or modify any information that you have provided.
PNC Financial Services assumes no obligation or responsibility for providing financial or other types of compensation to you for reporting this vulnerability.
Program Rules and Guidelines
Compliancy with this program requires that you read the following carefully and abide by all of the specific scoping guidelines. Questions regarding these restrictions can be sent to: ResponsibleDisclosure@pnc.com.
When performing any actions relating to your vulnerability submission, PNC requires you act in accordance with the following guidelines. Engaging in any activities that are inconsistent with applicable laws or this program may subject you to criminal and/or civil liabilities. To remain in compliance with this program, you must not:
- Violate privacy.
- Negatively impact the user experience.
- Destroy or manipulate data.
- Use exploits unless they are absolutely necessary to confirm a vulnerability.
- Exfiltrate data under any circumstances, establish command line access and/or persistence, or "pivot" to other systems.
- Once you've established a vulnerability exists or encountered personally identifiable, financial, proprietary information, or trade secrets you must stop your test and notify PNC Security immediately.
Do not perform any of the following actions:
- Destruction, alteration, disclosure, or access denial of PNC or customer data.
- Causing or attempting to cause harm against PNC, PNC employees, affiliates, or customers.
- Denial of service testing.
- Social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing.
- Intentionally accessing any data or information being stored or transmitted by PNC with exception to what is absolutely necessary to validate the existence of the vulnerability.
- Exfiltration of data; customer, financial, intellectual property, personally identifiable or otherwise.
- Public disclosure of the vulnerability without written consent from PNC Financial Services.
- Intentional compromise of sensitive or confidential data, intellectual property, or financial interests of PNC, its third parties, or personnel.
STOP your activities and notify us immediately if you encounter any of the information below while testing within the scope of this program:
- Personally identifiable information.
- Financial information (e.g. credit card or bank account numbers).
- Proprietary information or trade secrets of companies of any party.
Authorization
Responsible disclosure reports must be submitted by persons who are 18 years or older.
You must comply with all applicable laws and regulations. PNC Financial Services does not permit, allow, or authorize any actions that are inconsistent with this program. PNC Financial Services reserves all legal rights in the event of noncompliance with these guidelines.
If you make a good faith effort to comply with this program, we will work with you to understand and quickly resolve the issue, and PNC Financial Services will not recommend legal action in relation to your submitted vulnerability.
PNC Financial Services may modify this program and associated terms at any time.
Important Legal Disclosures and Information
Read a summary of privacy rights for California residents which outlines the types of information we collect, and how and why we use that information.
