5 ms·

But how exactly does an ACH transfer work? I assume it can’t be done anonymously. Wouldn’t it be incredibly simple to find the culprit and reclaim the funds (us

But how exactly does an ACH transfer work? I assume it can’t be done anonymously. Wouldn’t it be incredibly simple to find the culprit and reclaim the funds (using the article’s gas station clerk example)?

justboxing 9y ago
> But how exactly does an ACH transfer work? If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series. How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-2/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-3/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-4/ http://engineering.gusto.com/how-ach-works-a-developer-persp... and HN Meta Discussion : https://news.ycombinator.com/item?id=7636066 https://news.ycombinator.com/item?id=7636066
wmf 9y ago
I'm not a cybercrime expert, but AFAIK once the fraudulent ACH goes through it's a matter of cashing out the money (to literal cash or resalable goods) before the ACH is inevitably reverted. This leaves the recipient account with a negative balance so it can basically only be used once.
- hydrogen18 9y ago
  That's pretty much it exactly. You use two stolen accounts. One with a large balance, one without. ACH from one to the other with a fraudulent. Hire someone to go into the bank in person and withdraw cash. You're done.
kijin 9y ago
The account to which your money is fraudulently transferred might not even belong to the criminals. They probably have access to multiple compromised accounts and can shuffle money between them to throw off investigators.
- deleted 9y ago
  [deleted]

justboxing 9y ago

> But how exactly does an ACH transfer work? If you want this from a developer perspective, the subject is discussed in great detail in the following blog post series. How ACH works: A developer perspective - Part 1 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-1/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 2 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-2/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 3 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-3/ http://engineering.gusto.com/how-ach-works-a-developer-persp... How ACH works: A developer perspective - Part 4 => http://engineering.gusto.com/how-ach-works-a-developer-perspective-part-4/ http://engineering.gusto.com/how-ach-works-a-developer-persp... and HN Meta Discussion : https://news.ycombinator.com/item?id=7636066 https://news.ycombinator.com/item?id=7636066

wmf 9y ago

I'm not a cybercrime expert, but AFAIK once the fraudulent ACH goes through it's a matter of cashing out the money (to literal cash or resalable goods) before the ACH is inevitably reverted. This leaves the recipient account with a negative balance so it can basically only be used once.

hydrogen18 9y ago
That's pretty much it exactly. You use two stolen accounts. One with a large balance, one without. ACH from one to the other with a fraudulent. Hire someone to go into the bank in person and withdraw cash. You're done.

kijin 9y ago

The account to which your money is fraudulently transferred might not even belong to the criminals. They probably have access to multiple compromised accounts and can shuffle money between them to throw off investigators.

deleted 9y ago
[deleted]