Yes. This is not only perfectly legal, but a very common practice. My bank and my cable provider (both LARGE organizations) have been doing this for years. Several companies I've worked for in the past have done this, and are quite possibly still doing it.