4 ms·

It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it. Am

by patio11 10y ago

It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it. Americans are, accordingly, leery about giving out account numbers. Americans are not historically leery about giving out checks but, fun fact, we put all the information needed to empty an account on every check. Why? Long story; legacy systems rule the world. The industry's main defense is a) surveillance of use of accounts, b) reversing transactions which appear fraudulent, and c) aggressively prosecuting fraudsters where their identity can be readily ascertained.

_wmd 10y ago
The same is true in the UK, a direct debit instruction can be setup on an account using just the name, number and sort code, but it doesn't make us more wary, much in the same way that supplying one's home address is enough to take out lines of credit in that person's name
- cerved 10y ago
  This sounds incredibly insecure, is it exploited much?
  - zAy0LfpBZLC8mAC 10y ago
    My guess is that it's the same as elsewhere in the EU: Your bank will reverse the charge if you ask it to, the risk stays almost entirely with the payee/the payee's bank.
  - stordoff 10y ago
    It's difficult to exploit Direct Debits, as you are entitled to a full and immediate refund: https://www.directdebit.co.uk/DirectDebitExplained/pages/directdebitguarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...
  - the-dude 10y ago
    To do this, your business requires permission from your bank. If you abuse it, your bank will probably revoke your permission.
  - rmc 10y ago
    As far as I know, the ability to use direct debits is not given to everyone. You can't just start making direct debits just because you have a bank account.
mamon 10y ago
>> It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it. Wait, what? The only thing needed to send a payment is a target account number. So, if banks in US consider that enough info to DEBIT the account then something went terribly wrong there. In Europe, to take money out of the account you need to either - go to the bank, and show your photo ID to prove that you're you. - login to online transaction system and prove your identity by knowing the login password and one-time SMS password. That's why many charity institutions simply put their account number on their website and ask for donations - there's zero risk someone will debit their account.

by patio11 10y ago

_wmd 10y ago

The same is true in the UK, a direct debit instruction can be setup on an account using just the name, number and sort code, but it doesn't make us more wary, much in the same way that supplying one's home address is enough to take out lines of credit in that person's name

cerved 10y ago
This sounds incredibly insecure, is it exploited much?
- zAy0LfpBZLC8mAC 10y ago
  My guess is that it's the same as elsewhere in the EU: Your bank will reverse the charge if you ask it to, the risk stays almost entirely with the payee/the payee's bank.
- stordoff 10y ago
  It's difficult to exploit Direct Debits, as you are entitled to a full and immediate refund: https://www.directdebit.co.uk/DirectDebitExplained/pages/directdebitguarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...
- the-dude 10y ago
  To do this, your business requires permission from your bank. If you abuse it, your bank will probably revoke your permission.
- rmc 10y ago
  As far as I know, the ability to use direct debits is not given to everyone. You can't just start making direct debits just because you have a bank account.

mamon 10y ago

>> It is useful to know that, in the US, if you have sufficient information to send a payment into an account you also have sufficient information to debit it. Wait, what? The only thing needed to send a payment is a target account number. So, if banks in US consider that enough info to DEBIT the account then something went terribly wrong there. In Europe, to take money out of the account you need to either - go to the bank, and show your photo ID to prove that you're you. - login to online transaction system and prove your identity by knowing the login password and one-time SMS password. That's why many charity institutions simply put their account number on their website and ask for donations - there's zero risk someone will debit their account.