5 ms·

The interview is very light on details. Is it really so plainly simple to draft from a person’s bank account using only the information on a check?

throwaway2048 9y ago
yes, there is zero confirmation on stuff like ACH transfers, all you need is an account number, which is contained on the checks.
- cdubzzz 9y ago
  But how exactly does an ACH transfer work? I assume it can’t be done anonymously. Wouldn’t it be incredibly simple to find the culprit and reclaim the funds (using the article’s gas station clerk example)?
  - justboxing 9y ago
    > But how exactly does an ACH transfer work? If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series. How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-2/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-3/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-4/ http://engineering.gusto.com/how-ach-works-a-developer-persp... and HN Meta Discussion : https://news.ycombinator.com/item?id=7636066 https://news.ycombinator.com/item?id=7636066
  - wmf 9y ago
    I'm not a cybercrime expert, but AFAIK once the fraudulent ACH goes through it's a matter of cashing out the money (to literal cash or resalable goods) before the ACH is inevitably reverted. This leaves the recipient account with a negative balance so it can basically only be used once.
    - hydrogen18 9y ago
      That's pretty much it exactly. You use two stolen accounts. One with a large balance, one without. ACH from one to the other with a fraudulent. Hire someone to go into the bank in person and withdraw cash. You're done.
  - kijin 9y ago
    The account to which your money is fraudulently transferred might not even belong to the criminals. They probably have access to multiple compromised accounts and can shuffle money between them to throw off investigators.
    - deleted 9y ago
      [deleted]
sprintf 9y ago
Don Knuth has considered it dangerous for years. http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
- radicaldreamer 9y ago
  You can very easily avoid this by opening two bank accounts in the same bank and using online interface to transfer just as much as you need into your working account. Don't write or even create checks for the secondary account and don't disclose the account number to anyone for any reason.
  - patcheudor 9y ago
    I prefer two separate institutions for one reason: things like the Equifax breach. If someone attempts to impersonate you at your bank they could gain access to both accounts. If you have a 'silent' account somewhere else, they'd need to do account recovery at that location as well. The odds of that happening tends to be much lower.
    - greggarious 9y ago
      I also like having two institutions, since one of the biggest threats is ATM card skimming. More machines are moving to EMV, but it's trivial for someone to set up a fake ATM or skimmer, siphon up magstripe data and PINs, and drain accounts. While you are not responsible for fraud, most institutions will freeze the account for 30 days (which is legal) while they investigate. If that checking account has money for your rent or credit card bills, it could be disastrous. So I use a separate account at a separate institution for my "spending money". All I use it for is to withdraw money at ATMs.
  - phkahler 9y ago
    >> using online interface to transfer ... I see where you went wrong there. Have them disallow internet access to your accounts. Easy for you, easy for hacking.
stevenwoo 9y ago
Yes. I've had my entire bank account emptied of 25,000 in the 1990's by someone of a different ethnicity and gender who had simply went through a dozen drive throughs of my bank in different city to cash checks in about an hour in an amount under the one that would have required more attention (as explained to me by the bank. They simply wrote checks out for cash and used the memo "to purchase car") I lived in Austin and the thief did this in Houston. I don't know if this same scheme is possible today.
- sliverstorm 9y ago
  Who paid the piper on that one, you or the bank? Not familiar with the laws in Texas.
  - stevenwoo 9y ago
    I had to sign a paper in the bank swearing I did not withdraw the money and would help the bank as a witness if they found the criminal and then they gave me the equivalent amount of money in my account. IIRC it was kind of weird because they had grainy video/photos of the woman committing the crime.
- deleted 9y ago
  [deleted]
Amygaz 9y ago
If you call your bank they will ask you for your account number (found on the check), Name (on the check), Address (on the check) and date of birth (not on the check), information about recurring deposit or last deposit (not on the check), and that's pretty much it. I always feel like this is something you can find out by buying someone a beer.
- jacquesm 9y ago
  Once you have that first batch of data couldn't you forge the last deposit by depositing a small amount of money? After that you'd know when it happened and how much it was.
  - tedeh 9y ago
    True, but that would make it pretty easy to find you unless you use someone else's account.
deleted 9y ago
[deleted]
klenwell 9y ago
Yes. If you can trick senior citizens into giving you the information over the phone, you've got a legitimate business in the eyes of the banking industry. This was a scam that caught my grandmother 10 years ago. The New York Times did a story on the industry: State regulators have tried to protect victims like Mr. Guthrie. In 2005, attorneys general of 35 states urged the Federal Reserve to end the unsigned check system... But the Federal Reserve disagreed. It changed its rules to place greater responsibility on banks that first accept unsigned checks, but has permitted their continued use. ...In all, Wachovia accepted $142 million of unsigned checks from companies that made unauthorized withdrawals from thousands of accounts, federal prosecutors say. Wachovia collected millions of dollars in fees from those companies, even as it failed to act on warnings, according to records. http://www.nytimes.com/2007/05/20/business/20tele.html http://www.nytimes.com/2007/05/20/business/20tele.html I documented my failed effort to get Washington Mutual to reverse the checks written against my grandmother's account: http://wamublamesgrandma.blogspot.com/ http://wamublamesgrandma.blogspot.com/
- tomohawk 9y ago
  Yet another reason to never ever use a big bank.
- 55555 9y ago
  That article is horrible... I'm so sorry.
codingdave 9y ago
Yes, but that is also why people with money don't keep it in their checking account. Checking account just hold the money that you need to pay your immediate bills. your "life savings" flow through other savings, money market, and investment accounts. So if your checking account is compromised, you do lose some money and have some hassles to go through... but they aren't going to get everything else.

throwaway2048 9y ago

yes, there is zero confirmation on stuff like ACH transfers, all you need is an account number, which is contained on the checks.

cdubzzz 9y ago
But how exactly does an ACH transfer work? I assume it can’t be done anonymously. Wouldn’t it be incredibly simple to find the culprit and reclaim the funds (using the article’s gas station clerk example)?
- justboxing 9y ago
  > But how exactly does an ACH transfer work? If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series. How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-2/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-3/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-4/ http://engineering.gusto.com/how-ach-works-a-developer-persp... and HN Meta Discussion : https://news.ycombinator.com/item?id=7636066 https://news.ycombinator.com/item?id=7636066
- wmf 9y ago
  I'm not a cybercrime expert, but AFAIK once the fraudulent ACH goes through it's a matter of cashing out the money (to literal cash or resalable goods) before the ACH is inevitably reverted. This leaves the recipient account with a negative balance so it can basically only be used once.
  - hydrogen18 9y ago
    That's pretty much it exactly. You use two stolen accounts. One with a large balance, one without. ACH from one to the other with a fraudulent. Hire someone to go into the bank in person and withdraw cash. You're done.
- kijin 9y ago
  The account to which your money is fraudulently transferred might not even belong to the criminals. They probably have access to multiple compromised accounts and can shuffle money between them to throw off investigators.
  - deleted 9y ago
    [deleted]

sprintf 9y ago

Don Knuth has considered it dangerous for years. http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html

radicaldreamer 9y ago
You can very easily avoid this by opening two bank accounts in the same bank and using online interface to transfer just as much as you need into your working account. Don't write or even create checks for the secondary account and don't disclose the account number to anyone for any reason.
- patcheudor 9y ago
  I prefer two separate institutions for one reason: things like the Equifax breach. If someone attempts to impersonate you at your bank they could gain access to both accounts. If you have a 'silent' account somewhere else, they'd need to do account recovery at that location as well. The odds of that happening tends to be much lower.
  - greggarious 9y ago
    I also like having two institutions, since one of the biggest threats is ATM card skimming. More machines are moving to EMV, but it's trivial for someone to set up a fake ATM or skimmer, siphon up magstripe data and PINs, and drain accounts. While you are not responsible for fraud, most institutions will freeze the account for 30 days (which is legal) while they investigate. If that checking account has money for your rent or credit card bills, it could be disastrous. So I use a separate account at a separate institution for my "spending money". All I use it for is to withdraw money at ATMs.
- phkahler 9y ago
  >> using online interface to transfer ... I see where you went wrong there. Have them disallow internet access to your accounts. Easy for you, easy for hacking.

stevenwoo 9y ago

Yes. I've had my entire bank account emptied of 25,000 in the 1990's by someone of a different ethnicity and gender who had simply went through a dozen drive throughs of my bank in different city to cash checks in about an hour in an amount under the one that would have required more attention (as explained to me by the bank. They simply wrote checks out for cash and used the memo "to purchase car") I lived in Austin and the thief did this in Houston. I don't know if this same scheme is possible today.

sliverstorm 9y ago
Who paid the piper on that one, you or the bank? Not familiar with the laws in Texas.
- stevenwoo 9y ago
  I had to sign a paper in the bank swearing I did not withdraw the money and would help the bank as a witness if they found the criminal and then they gave me the equivalent amount of money in my account. IIRC it was kind of weird because they had grainy video/photos of the woman committing the crime.
deleted 9y ago
[deleted]

Amygaz 9y ago

If you call your bank they will ask you for your account number (found on the check), Name (on the check), Address (on the check) and date of birth (not on the check), information about recurring deposit or last deposit (not on the check), and that's pretty much it. I always feel like this is something you can find out by buying someone a beer.

jacquesm 9y ago
Once you have that first batch of data couldn't you forge the last deposit by depositing a small amount of money? After that you'd know when it happened and how much it was.
- tedeh 9y ago
  True, but that would make it pretty easy to find you unless you use someone else's account.

deleted 9y ago

[deleted]

klenwell 9y ago

Yes. If you can trick senior citizens into giving you the information over the phone, you've got a legitimate business in the eyes of the banking industry. This was a scam that caught my grandmother 10 years ago. The New York Times did a story on the industry: State regulators have tried to protect victims like Mr. Guthrie. In 2005, attorneys general of 35 states urged the Federal Reserve to end the unsigned check system... But the Federal Reserve disagreed. It changed its rules to place greater responsibility on banks that first accept unsigned checks, but has permitted their continued use. ...In all, Wachovia accepted $142 million of unsigned checks from companies that made unauthorized withdrawals from thousands of accounts, federal prosecutors say. Wachovia collected millions of dollars in fees from those companies, even as it failed to act on warnings, according to records. http://www.nytimes.com/2007/05/20/business/20tele.html http://www.nytimes.com/2007/05/20/business/20tele.html I documented my failed effort to get Washington Mutual to reverse the checks written against my grandmother's account: http://wamublamesgrandma.blogspot.com/ http://wamublamesgrandma.blogspot.com/

tomohawk 9y ago
Yet another reason to never ever use a big bank.
55555 9y ago
That article is horrible... I'm so sorry.

codingdave 9y ago

Yes, but that is also why people with money don't keep it in their checking account. Checking account just hold the money that you need to pay your immediate bills. your "life savings" flow through other savings, money market, and investment accounts. So if your checking account is compromised, you do lose some money and have some hassles to go through... but they aren't going to get everything else.