13 ms·

It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. I

by njovin 11y ago

It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. I ran into an issue last year where I was unable to get an insurance company to stop pulling money, unauthorized and automatically, from my account. Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. So in that way it's a bit like oAuth, except you only have one key and when you revoke it, everybody loses access.

Johnie 11y ago
This is the CRAZIEST part of the banking system. The information to withdraw money from your account is on the bottom of the paper checks that you freely give out. Anyone with the routing number and account number can drain the entire account. ACH fraud in the US is in the ballpark of $100M / year. This is why I think we're only in the opening days of the FinTech shift. There's a lot to be done and a lot to fix.
- julianz 11y ago
  "paper checks"... wow. You guys still have those? I found a book of them when I moved house recently, unused, from 10 years ago. Don't miss them even slightly.
  - raverbashing 11y ago
    Yeah, in the US and Canada they're pretty popular, since apparently nobody bothered to upgrade what ACH runs on
    - exelius 11y ago
      Also, because my wife and I use different banks but pay bills jointly, I just have her write me a check every month for her part of the bills. I then accept it using my bank's mobile check deposit feature. While we could do ACH transfers, it's way easier to just write a check.
      - techsupporter 11y ago
        It amazes me the kinds of workarounds we have to do just to move money. I am a member of two credit unions, both of which participate in the Co-Op Shared ATM network so I can use most credit union ATMs to make withdrawals and deposits. One credit union holds my regular checking account. The other has my mortgage. Until the automatic payment gets set up, I pay my mortgage by going to a third-credit-union ATM (owned by a CU that is also on the shared ATM network) and withdrawing a pile of cash with one CU's card. I then stick that cash back into the ATM as a deposit with the other CU's card. The payment can thus be made as a "transfer" on the mortgage CU's online banking platform. It takes minutes to do that versus approximately 3 days to do an account-to-account transfer.
        lukebennett 11y ago
        3 days to do a bank transfer, ouch, that's a blast from the past. Sounds like you desperately need the Faster Payments system we have in the UK - allows you to transfer money between accounts (at different banks) instantly. Other than collections at church and the occasional business that doesn't take card, I hardly ever use cash these days.
        jdhawk 11y ago
        We need a whole lot more than just F.P.
        Johnie 11y ago
        Same Day ACH has been in talks in the US for years. It may actually come this year. https://www.nacha.org/rules/same-day-ach-moving-payments-faster https://www.nacha.org/rules/same-day-ach-moving-payments-fas...
        kevin_thibedeau 11y ago
        > The Rule includes a “Same Day Fee” on each Same Day ACH transaction so that RDFIs would recover, on average, their costs for enabling and supporting Same Day ACH. Never doubt the American banking system's capacity to gouge the customer.
  - username223 11y ago
    What do you use to pay rent? That's the only use I still have for them, but landlords don't tend to take credit cards, and a check is easier than an envelope of cash.
    - itcmcgrath 11y ago
      Direct Deposit and/or BillPay is what I used in Australia before moving to the US. I also miss things like BPay where I can pay all my bills via my Internet Banking portal. Moving to the US felt like a 10+ year regression in money related systems.
      - MetallicCloud 11y ago
        Yep, I moved to the US two years ago from Australia having never written a check in my life. The banking system here was probably the biggest culture shock for me.
        csirac2 11y ago
        Agreed; also in .au, the last time I presented a cheque (in 2011) the poor newbie teenage bank teller strained to recall his training. He processed it ok, but panicked so badly he accidentally handed it back. The branch manager drove out to my workplace to retrieve it from me in person...
    - dtech 11y ago
      In the Netherlands it's always bank transfer, the larger ones usually offer direct debit. Cash is reserved for shady landlords and tax evasion.
      - jdhawk 11y ago
        Tell me about it, I'm trying to get an expense reimbursement from the NL to my personal bank account in the US. No IBAN, only SWIFT - nobody seems to know how to function with out antiquated system of very expensive wire transfers.
  - superuser2 11y ago
    Paper checks are the only free and universally accepted way to move an arbitrary amount of money in the US. Most consumer spending runs through Visa/MasterCard credit or debit cards; the interchange fee is baked into the prices of consumer products. Most people have something that processes as MC/Visa (whether it is backed by a traditional bank account, line of credit, or non-check-writing account) but most people cannot accept such payments, and no one can accept them for free. Tech-savvy consumers can pay each other small amounts of money through Venmo and Square Cash, and that is typically how smartphone-native millennials settle restaurant bills and alcohol purchases among each other. They are free, but you can't move more than a few grand. Very large organizations usually have a web portal where you can type your checking account and routing number to pull money from your bank account with 3-5 day latency through ACH. Perversely, many of them will charge a "convenience fee" for this service that is not applied to payments by check. This is also strictly less secure than payment by check, because it's at least a little bit difficult to get authentic-looking checks for account numbers that are not mine. I can type whatever I want into the box on your website. Most consumer bank accounts have an Online Bill Pay feature with the ability to push money to organizations of this kind of size. Sometimes they work by transferring your money to a service provider who physically prints and mails a check on your behalf. Usually they're just the Push (rather than Pull) variant of ACH. Only some banks have the ability to push ACH transfers by account and routing number, letting you pay smaller-time recipients (as long as they trust you with their account number). Sometimes you can also input an email address, and the bank emails them asking for the account details to push the payment to (because that's not reminiscent of a phishing scam at all). There are plenty of uses cases not served by any of these options. The car dealership. The family member you're supporting. Your small-time landlord, or the friend you're subletting from. Small town governments, suburban school districts, etc. I'd guess most adults don't use checks frequently, but we still need them every once in a while.
    - pbhjpbhj 11y ago
      Free (gratis) to the consumer only presumably, we have to pay at work (an SME) to deposit cash, cheques, and pay a third party for DD and CC processing. Pretty much only get cheques from charities/clubs now, haven't written one in maybe 10 years.
  - kwhitefoot 11y ago
    You were still using them that recently? Must be fifteen since I used a cheque here in Norway. My sister still uses them in the UK though, you even see people writing them at supermarket checkouts (but not often).
pault 11y ago
I ran into this recently when my girlfriend paid her ~$5,000 credit card bill just by typing in my account/routing number. No authorization was required from me. I'm still confused and slightly outraged that this is possible.
- sp332 11y ago
  The system is based more on forgiveness than permission.
- astazangasta 11y ago
  It is cheaper to insure against theft than prevent it.
- plaguuuuuu 11y ago
  This is completely impossible in Australia and, I suspect, many other places on earth.
dsmithatx 11y ago
The good news is that for personal accounts you should have 60 days to recover. Although if someone drained your account and you have to wait to pay rent, that might not be so comforting. Businesses I believe only get one day. This ACH fraud is crazy that it exist. My landlord gives me his account number to pay rent. The routing number is trivial to google but, lucky for him, I'm not a thief.
KirinDave 11y ago
> It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. Fortunately Intuit has really, really poor coverage for this. Comically poor. Plaid only supports a few FIs. Never sign up for a service with Yodlee and you're statistically covered here. > Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. For future reference, your bank should have offered to migrate you to a new ACH number for free. It's really quite illegal for them to allow ongoing fraud to occur once you've informed them of it. It's no different than if someone loads your Chase Debit number into an Apple Pay device and then adds biometrics (which btw: true tragedy and incredibly stupid. Chase needs to implement yellow path. I closed my accounts due to waves of fraud via this method). You're still not liable for damage, it's just scary and frustrating and time wasted.
occamrazor 11y ago
Doesn't the bank require previous written authorisation? I've used banks in several European countries, and on all cases I had to tell my bank explicitly who could send bills to be debited to my account. Moreover, all the authorisations were revokable at any time (although charge backs were not possible).

by njovin 11y ago

Johnie 11y ago

This is the CRAZIEST part of the banking system. The information to withdraw money from your account is on the bottom of the paper checks that you freely give out. Anyone with the routing number and account number can drain the entire account. ACH fraud in the US is in the ballpark of $100M / year. This is why I think we're only in the opening days of the FinTech shift. There's a lot to be done and a lot to fix.

julianz 11y ago
"paper checks"... wow. You guys still have those? I found a book of them when I moved house recently, unused, from 10 years ago. Don't miss them even slightly.
- raverbashing 11y ago
  Yeah, in the US and Canada they're pretty popular, since apparently nobody bothered to upgrade what ACH runs on
  - exelius 11y ago
    Also, because my wife and I use different banks but pay bills jointly, I just have her write me a check every month for her part of the bills. I then accept it using my bank's mobile check deposit feature. While we could do ACH transfers, it's way easier to just write a check.
    - techsupporter 11y ago
      It amazes me the kinds of workarounds we have to do just to move money. I am a member of two credit unions, both of which participate in the Co-Op Shared ATM network so I can use most credit union ATMs to make withdrawals and deposits. One credit union holds my regular checking account. The other has my mortgage. Until the automatic payment gets set up, I pay my mortgage by going to a third-credit-union ATM (owned by a CU that is also on the shared ATM network) and withdrawing a pile of cash with one CU's card. I then stick that cash back into the ATM as a deposit with the other CU's card. The payment can thus be made as a "transfer" on the mortgage CU's online banking platform. It takes minutes to do that versus approximately 3 days to do an account-to-account transfer.
      - lukebennett 11y ago
        3 days to do a bank transfer, ouch, that's a blast from the past. Sounds like you desperately need the Faster Payments system we have in the UK - allows you to transfer money between accounts (at different banks) instantly. Other than collections at church and the occasional business that doesn't take card, I hardly ever use cash these days.
        jdhawk 11y ago
        We need a whole lot more than just F.P.
        Johnie 11y ago
        Same Day ACH has been in talks in the US for years. It may actually come this year. https://www.nacha.org/rules/same-day-ach-moving-payments-faster https://www.nacha.org/rules/same-day-ach-moving-payments-fas...
        kevin_thibedeau 11y ago
        > The Rule includes a “Same Day Fee” on each Same Day ACH transaction so that RDFIs would recover, on average, their costs for enabling and supporting Same Day ACH. Never doubt the American banking system's capacity to gouge the customer.
- username223 11y ago
  What do you use to pay rent? That's the only use I still have for them, but landlords don't tend to take credit cards, and a check is easier than an envelope of cash.
  - itcmcgrath 11y ago
    Direct Deposit and/or BillPay is what I used in Australia before moving to the US. I also miss things like BPay where I can pay all my bills via my Internet Banking portal. Moving to the US felt like a 10+ year regression in money related systems.
    - MetallicCloud 11y ago
      Yep, I moved to the US two years ago from Australia having never written a check in my life. The banking system here was probably the biggest culture shock for me.
      - csirac2 11y ago
        Agreed; also in .au, the last time I presented a cheque (in 2011) the poor newbie teenage bank teller strained to recall his training. He processed it ok, but panicked so badly he accidentally handed it back. The branch manager drove out to my workplace to retrieve it from me in person...
  - dtech 11y ago
    In the Netherlands it's always bank transfer, the larger ones usually offer direct debit. Cash is reserved for shady landlords and tax evasion.
    - jdhawk 11y ago
      Tell me about it, I'm trying to get an expense reimbursement from the NL to my personal bank account in the US. No IBAN, only SWIFT - nobody seems to know how to function with out antiquated system of very expensive wire transfers.
- superuser2 11y ago
  Paper checks are the only free and universally accepted way to move an arbitrary amount of money in the US. Most consumer spending runs through Visa/MasterCard credit or debit cards; the interchange fee is baked into the prices of consumer products. Most people have something that processes as MC/Visa (whether it is backed by a traditional bank account, line of credit, or non-check-writing account) but most people cannot accept such payments, and no one can accept them for free. Tech-savvy consumers can pay each other small amounts of money through Venmo and Square Cash, and that is typically how smartphone-native millennials settle restaurant bills and alcohol purchases among each other. They are free, but you can't move more than a few grand. Very large organizations usually have a web portal where you can type your checking account and routing number to pull money from your bank account with 3-5 day latency through ACH. Perversely, many of them will charge a "convenience fee" for this service that is not applied to payments by check. This is also strictly less secure than payment by check, because it's at least a little bit difficult to get authentic-looking checks for account numbers that are not mine. I can type whatever I want into the box on your website. Most consumer bank accounts have an Online Bill Pay feature with the ability to push money to organizations of this kind of size. Sometimes they work by transferring your money to a service provider who physically prints and mails a check on your behalf. Usually they're just the Push (rather than Pull) variant of ACH. Only some banks have the ability to push ACH transfers by account and routing number, letting you pay smaller-time recipients (as long as they trust you with their account number). Sometimes you can also input an email address, and the bank emails them asking for the account details to push the payment to (because that's not reminiscent of a phishing scam at all). There are plenty of uses cases not served by any of these options. The car dealership. The family member you're supporting. Your small-time landlord, or the friend you're subletting from. Small town governments, suburban school districts, etc. I'd guess most adults don't use checks frequently, but we still need them every once in a while.
  - pbhjpbhj 11y ago
    Free (gratis) to the consumer only presumably, we have to pay at work (an SME) to deposit cash, cheques, and pay a third party for DD and CC processing. Pretty much only get cheques from charities/clubs now, haven't written one in maybe 10 years.
- kwhitefoot 11y ago
  You were still using them that recently? Must be fifteen since I used a cheque here in Norway. My sister still uses them in the UK though, you even see people writing them at supermarket checkouts (but not often).

pault 11y ago

I ran into this recently when my girlfriend paid her ~$5,000 credit card bill just by typing in my account/routing number. No authorization was required from me. I'm still confused and slightly outraged that this is possible.

sp332 11y ago
The system is based more on forgiveness than permission.
astazangasta 11y ago
It is cheaper to insure against theft than prevent it.
plaguuuuuu 11y ago
This is completely impossible in Australia and, I suspect, many other places on earth.

dsmithatx 11y ago

The good news is that for personal accounts you should have 60 days to recover. Although if someone drained your account and you have to wait to pay rent, that might not be so comforting. Businesses I believe only get one day. This ACH fraud is crazy that it exist. My landlord gives me his account number to pay rent. The routing number is trivial to google but, lucky for him, I'm not a thief.

KirinDave 11y ago

> It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. Fortunately Intuit has really, really poor coverage for this. Comically poor. Plaid only supports a few FIs. Never sign up for a service with Yodlee and you're statistically covered here. > Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. For future reference, your bank should have offered to migrate you to a new ACH number for free. It's really quite illegal for them to allow ongoing fraud to occur once you've informed them of it. It's no different than if someone loads your Chase Debit number into an Apple Pay device and then adds biometrics (which btw: true tragedy and incredibly stupid. Chase needs to implement yellow path. I closed my accounts due to waves of fraud via this method). You're still not liable for damage, it's just scary and frustrating and time wasted.

occamrazor 11y ago

Doesn't the bank require previous written authorisation? I've used banks in several European countries, and on all cases I had to tell my bank explicitly who could send bills to be debited to my account. Moreover, all the authorisations were revokable at any time (although charge backs were not possible).