4 ms·

Don Knuth has considered it dangerous for years. http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html

radicaldreamer 9y ago
You can very easily avoid this by opening two bank accounts in the same bank and using online interface to transfer just as much as you need into your working account. Don't write or even create checks for the secondary account and don't disclose the account number to anyone for any reason.
- patcheudor 9y ago
  I prefer two separate institutions for one reason: things like the Equifax breach. If someone attempts to impersonate you at your bank they could gain access to both accounts. If you have a 'silent' account somewhere else, they'd need to do account recovery at that location as well. The odds of that happening tends to be much lower.
  - greggarious 9y ago
    I also like having two institutions, since one of the biggest threats is ATM card skimming. More machines are moving to EMV, but it's trivial for someone to set up a fake ATM or skimmer, siphon up magstripe data and PINs, and drain accounts. While you are not responsible for fraud, most institutions will freeze the account for 30 days (which is legal) while they investigate. If that checking account has money for your rent or credit card bills, it could be disastrous. So I use a separate account at a separate institution for my "spending money". All I use it for is to withdraw money at ATMs.
- phkahler 9y ago
  >> using online interface to transfer ... I see where you went wrong there. Have them disallow internet access to your accounts. Easy for you, easy for hacking.
  - patcheudor 9y ago
    I'm amazed what banks will re-enable with a simple phone call as long as you have a name, current address, SSN, and birthdate. But yes, it's a good step to take and makes it just that much harder to compromise an account so it's a good thing to do.
    - phkahler 9y ago
      The odd this is, most people have physical access to a local branch of their bank. I know those are closing as people do more stuff online, but that's my point. We're trading convenience for security. Apparently the banking system isn't all that secure to begin with, so moving it online may really be the wrong thing to do.
patcheudor 9y ago
Dangerous is relative. In the US you have roughly 60 days after a statement is received to escalate fraudulent transfers out of your account. If you file a complaint within this timeframe, your money will be returned. The problem of course is that if because that money was taken you miss your mortgage payment or car payment or student loan payment there could be associated fees from those lenders which you would be out. For businesses I think this timeframe may be as short as three days from the fraudulent transaction so in those cases it's a real problem. Generally I recommend having two bank accounts, one which is rarely used other than for deposits and functions as a backup in the event your primary account is compromised. I also recommend not using a debit card and instead get the financial discipline to just pay off credit card balances each month and then use credit-cards for as much as you can from banks not tied to either your primary or backup checking account.
- timr 9y ago
  "In the US you have roughly 60 days after a statement is received to escalate fraudulent transfers out of your account." You have 30 days from receipt of your bank statement. It's in the audio interview of which this article is an exerpt.
  - patcheudor 9y ago
    From the actual law: "1. Unlimited liability applies. The standard of unlimited liability applies if unauthorized transfers appear on a periodic statement, and may apply in conjunction with the first two tiers of liability. If a periodic statement shows an unauthorized transfer made with a lost or stolen debit card, the consumer must notify the financial institution within 60 calendar days after the periodic statement was sent; otherwise, the consumer faces unlimited liability for all unauthorized transfers made after the 60-day period. The consumer's liability for unauthorized transfers before the statement is sent, and up to 60 days following, is determined based on the first two tiers of liability: up to $50 if the consumer notifies the financial institution within two business days of learning of the loss or theft of the card and up to $500 if the consumer notifies the institution after two business days of learning of the loss or theft." https://www.fdic.gov/regulations/laws/rules/6500-580.html https://www.fdic.gov/regulations/laws/rules/6500-580.html

radicaldreamer 9y ago

You can very easily avoid this by opening two bank accounts in the same bank and using online interface to transfer just as much as you need into your working account. Don't write or even create checks for the secondary account and don't disclose the account number to anyone for any reason.

patcheudor 9y ago
I prefer two separate institutions for one reason: things like the Equifax breach. If someone attempts to impersonate you at your bank they could gain access to both accounts. If you have a 'silent' account somewhere else, they'd need to do account recovery at that location as well. The odds of that happening tends to be much lower.
- greggarious 9y ago
  I also like having two institutions, since one of the biggest threats is ATM card skimming. More machines are moving to EMV, but it's trivial for someone to set up a fake ATM or skimmer, siphon up magstripe data and PINs, and drain accounts. While you are not responsible for fraud, most institutions will freeze the account for 30 days (which is legal) while they investigate. If that checking account has money for your rent or credit card bills, it could be disastrous. So I use a separate account at a separate institution for my "spending money". All I use it for is to withdraw money at ATMs.
phkahler 9y ago
>> using online interface to transfer ... I see where you went wrong there. Have them disallow internet access to your accounts. Easy for you, easy for hacking.
- patcheudor 9y ago
  I'm amazed what banks will re-enable with a simple phone call as long as you have a name, current address, SSN, and birthdate. But yes, it's a good step to take and makes it just that much harder to compromise an account so it's a good thing to do.
  - phkahler 9y ago
    The odd this is, most people have physical access to a local branch of their bank. I know those are closing as people do more stuff online, but that's my point. We're trading convenience for security. Apparently the banking system isn't all that secure to begin with, so moving it online may really be the wrong thing to do.

patcheudor 9y ago

Dangerous is relative. In the US you have roughly 60 days after a statement is received to escalate fraudulent transfers out of your account. If you file a complaint within this timeframe, your money will be returned. The problem of course is that if because that money was taken you miss your mortgage payment or car payment or student loan payment there could be associated fees from those lenders which you would be out. For businesses I think this timeframe may be as short as three days from the fraudulent transaction so in those cases it's a real problem. Generally I recommend having two bank accounts, one which is rarely used other than for deposits and functions as a backup in the event your primary account is compromised. I also recommend not using a debit card and instead get the financial discipline to just pay off credit card balances each month and then use credit-cards for as much as you can from banks not tied to either your primary or backup checking account.

timr 9y ago
"In the US you have roughly 60 days after a statement is received to escalate fraudulent transfers out of your account." You have 30 days from receipt of your bank statement. It's in the audio interview of which this article is an exerpt.
- patcheudor 9y ago
  From the actual law: "1. Unlimited liability applies. The standard of unlimited liability applies if unauthorized transfers appear on a periodic statement, and may apply in conjunction with the first two tiers of liability. If a periodic statement shows an unauthorized transfer made with a lost or stolen debit card, the consumer must notify the financial institution within 60 calendar days after the periodic statement was sent; otherwise, the consumer faces unlimited liability for all unauthorized transfers made after the 60-day period. The consumer's liability for unauthorized transfers before the statement is sent, and up to 60 days following, is determined based on the first two tiers of liability: up to $50 if the consumer notifies the financial institution within two business days of learning of the loss or theft of the card and up to $500 if the consumer notifies the institution after two business days of learning of the loss or theft." https://www.fdic.gov/regulations/laws/rules/6500-580.html https://www.fdic.gov/regulations/laws/rules/6500-580.html