3 ms·

It seems like it would be very easy to just photoshop in a new value, and drain someone's account. Much easier than doctoring a physical check.

aresant 17y ago
Good point - maybe offer only to customers with X years of banking, or minimum account value . . .
patio11 17y ago
You realize that all you need is the routing number and account number and you can print a demand draft which looks nothing like the original, write "AUTHORIZED BY ACCOUNT HOLDER" for the signature, and just deposit that demand draft, right? No doctoring skills required, and the information needed to drain the banking account is handily written on every single check drawn on it. Checks are among the least secure payment methods ever devised by man -- that is why banks are trying to kill them. (The fact that banks subsidize them instead of earning fat interchange fees on their usage doesn't hurt, either.)
- Poiesis 17y ago
  Incidentally, this is why Don Knuth stopped giving out checks. http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
InclinedPlane 17y ago
This is not as big a risk as it may seem. Making use of a fraudulent check in this system requires opening a bank account (presumably using a fake identity), depositing the check, waiting for it to clear, then withdrawing the money (from an atm or other means). The first time this type of fraud is discovered you won't be able to use or open a bank account using that identity (it'll be flagged in chexsystems). And you can bet that depositing a large check or a large number of checks will result in your account being flagged and human beings calling around determining if those checks are legit before you can withdraw the funds. The only way to successfully pull off a significant level of fraud with this method is to open up a large number of bank accounts and use them simultaneously. However, a perfectly simple roadblock to that is to only offer this service to people who have had their accounts open for longer than X years (where X is at least 1). Meanwhile, in order to successfully steal a lot of money using fraudulent physical checks all one needs is a fake identity (or not even that if you plan to go into hiding and/or don't mind burning your current identity) and the knowledge of making fraudulent checks (which can extend as low as stealing someone else's checkbook). Then, you simply cash lots of checks at various locations around town in a short period of time. By the time the fraud is detected money is already in your pocket and you may be in another town already (depending on how savvy you are).
nroach 17y ago
Except that this is fraud. And the USAA app requires you to log in first, so the depositor has been authenticated. Trying to pass off a photoshopped check via USAA's deposit@home would be about as wise as walking into a bank to rob it after first presenting two valid forms of photo ID.

aresant 17y ago

Good point - maybe offer only to customers with X years of banking, or minimum account value . . .

patio11 17y ago

You realize that all you need is the routing number and account number and you can print a demand draft which looks nothing like the original, write "AUTHORIZED BY ACCOUNT HOLDER" for the signature, and just deposit that demand draft, right? No doctoring skills required, and the information needed to drain the banking account is handily written on every single check drawn on it. Checks are among the least secure payment methods ever devised by man -- that is why banks are trying to kill them. (The fact that banks subsidize them instead of earning fat interchange fees on their usage doesn't hurt, either.)

Poiesis 17y ago
Incidentally, this is why Don Knuth stopped giving out checks. http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html

InclinedPlane 17y ago

This is not as big a risk as it may seem. Making use of a fraudulent check in this system requires opening a bank account (presumably using a fake identity), depositing the check, waiting for it to clear, then withdrawing the money (from an atm or other means). The first time this type of fraud is discovered you won't be able to use or open a bank account using that identity (it'll be flagged in chexsystems). And you can bet that depositing a large check or a large number of checks will result in your account being flagged and human beings calling around determining if those checks are legit before you can withdraw the funds. The only way to successfully pull off a significant level of fraud with this method is to open up a large number of bank accounts and use them simultaneously. However, a perfectly simple roadblock to that is to only offer this service to people who have had their accounts open for longer than X years (where X is at least 1). Meanwhile, in order to successfully steal a lot of money using fraudulent physical checks all one needs is a fake identity (or not even that if you plan to go into hiding and/or don't mind burning your current identity) and the knowledge of making fraudulent checks (which can extend as low as stealing someone else's checkbook). Then, you simply cash lots of checks at various locations around town in a short period of time. By the time the fraud is detected money is already in your pocket and you may be in another town already (depending on how savvy you are).

nroach 17y ago

Except that this is fraud. And the USAA app requires you to log in first, so the depositor has been authenticated. Trying to pass off a photoshopped check via USAA's deposit@home would be about as wise as walking into a bank to rob it after first presenting two valid forms of photo ID.