> HMAC the account number with a reasonably long secret key By "reasonably long" you mean "of the correct length"? That is to say, equal to the block size of t

> HMAC the account number with a reasonably long secret key By "reasonably long" you mean "of the correct length"? That is to say, equal to the block size of the underlying hash (e.g. 64 bytes for HMAC-SHA256). Any longer that that does not increase strength. Shorter keys will be zero-padded out to the block size and are therefore weaker.