13 ms·

You had to provide your bank user/pass to Coinbase? I only had to provide routing and account numbers, then verify the ACH amounts (edit: and driver's license p

You had to provide your bank user/pass to Coinbase? I only had to provide routing and account numbers, then verify the ACH amounts (edit: and driver's license photo). But I'm only in the shallow end of the kiddie pool here.

asaph 9y ago
Coinbase offers both options: bank username & password or routing & account numbers. If you choose to provide bank username & password, verification is instant. If you choose to provide routing & account numbers, verification via deposit/withdrawal of small amounts takes days.
- stephengillie 9y ago
  I must have missed the user/pass option during the sign-up flow.
joering2 9y ago
ACH does not work in read or in write-only mode. Once you provide someone your ACH info, they can deposit you money.. or empty out your bank account! I had few rough service providers who tried to come up with some magical charges (technical fee of $500 per year) after agreement was signed and had to change bank numbers to make sure they wont take the money out since it would be more than $500 to fight them in court. The company is called EMS Merchants btw.. you can read horrible stories of merchants screwed by them in this way via ACH on online forums.
- droidist2 9y ago
  So if you write someone a personal check they can empty your account?
  - zkms 9y ago
    Of course. There's no inherent technical countermeasures against someone doing so.
  - wmf 9y ago
    Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
    - b1daly 9y ago
      This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
      - acdha 9y ago
        It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).
  - balls187 9y ago
    Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.
    - stephengillie 9y ago
      It is like transactions are in P-time and disputes are in NP-time.
  - joering2 9y ago
    Not unless they either have physical check from you, OR are enrolled into MSP (merchant service provider). But MSPs will monitor fraudulent activity just like providing CC in any online store gives them access to empty your CC doesnt mean they will get away with it :)
    - droidist2 9y ago
      But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?
      - wmf 9y ago
        Yeah, normal people cannot initiate ACHes but merchants can.
    - mnm1 9y ago
      No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.
      - njarboe 9y ago
        And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.
        acdha 9y ago
        That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.
- curun1r 9y ago
  It's pretty simple to do a hot/cold account setup at most banks. I've got a checking account which is unlinked to all other accounts and I try to keep it at a $0 balance. The online banking site makes it easy to transfer money into and out of that account from the accounts I keep money in. It's a little more work to stay on top of transferring out money when it gets deposited and putting it in when I want to spend it, but it gives me a bit more piece of mind when giving out routing/account numbers.
  - mancerayder 9y ago
    That's an excellent idea. My bank(s) have a so-called Savings Account (separate from the main Checking Account) that yields a microscopic amount of interest, which I never use since I 'save' money elsewhere. That might be a great use case for what you describe.

asaph 9y ago

Coinbase offers both options: bank username & password or routing & account numbers. If you choose to provide bank username & password, verification is instant. If you choose to provide routing & account numbers, verification via deposit/withdrawal of small amounts takes days.

stephengillie 9y ago
I must have missed the user/pass option during the sign-up flow.

joering2 9y ago

ACH does not work in read or in write-only mode. Once you provide someone your ACH info, they can deposit you money.. or empty out your bank account! I had few rough service providers who tried to come up with some magical charges (technical fee of $500 per year) after agreement was signed and had to change bank numbers to make sure they wont take the money out since it would be more than $500 to fight them in court. The company is called EMS Merchants btw.. you can read horrible stories of merchants screwed by them in this way via ACH on online forums.

droidist2 9y ago
So if you write someone a personal check they can empty your account?
- zkms 9y ago
  Of course. There's no inherent technical countermeasures against someone doing so.
- wmf 9y ago
  Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
  - b1daly 9y ago
    This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
    - acdha 9y ago
      It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).
- balls187 9y ago
  Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.
  - stephengillie 9y ago
    It is like transactions are in P-time and disputes are in NP-time.
- joering2 9y ago
  Not unless they either have physical check from you, OR are enrolled into MSP (merchant service provider). But MSPs will monitor fraudulent activity just like providing CC in any online store gives them access to empty your CC doesnt mean they will get away with it :)
  - droidist2 9y ago
    But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?
    - wmf 9y ago
      Yeah, normal people cannot initiate ACHes but merchants can.
  - mnm1 9y ago
    No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.
    - njarboe 9y ago
      And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.
      - acdha 9y ago
        That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.
curun1r 9y ago
It's pretty simple to do a hot/cold account setup at most banks. I've got a checking account which is unlinked to all other accounts and I try to keep it at a $0 balance. The online banking site makes it easy to transfer money into and out of that account from the accounts I keep money in. It's a little more work to stay on top of transferring out money when it gets deposited and putting it in when I want to spend it, but it gives me a bit more piece of mind when giving out routing/account numbers.
- mancerayder 9y ago
  That's an excellent idea. My bank(s) have a so-called Savings Account (separate from the main Checking Account) that yields a microscopic amount of interest, which I never use since I 'save' money elsewhere. That might be a great use case for what you describe.