5 ms·

So if you write someone a personal check they can empty your account?

zkms 9y ago
Of course. There's no inherent technical countermeasures against someone doing so.
wmf 9y ago
Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
- b1daly 9y ago
  This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
  - acdha 9y ago
    It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).
balls187 9y ago
Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.
- stephengillie 9y ago
  It is like transactions are in P-time and disputes are in NP-time.
joering2 9y ago
Not unless they either have physical check from you, OR are enrolled into MSP (merchant service provider). But MSPs will monitor fraudulent activity just like providing CC in any online store gives them access to empty your CC doesnt mean they will get away with it :)
- droidist2 9y ago
  But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?
  - wmf 9y ago
    Yeah, normal people cannot initiate ACHes but merchants can.
- mnm1 9y ago
  No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.
  - njarboe 9y ago
    And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.
    - acdha 9y ago
      That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.

zkms 9y ago

Of course. There's no inherent technical countermeasures against someone doing so.

wmf 9y ago

Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html

b1daly 9y ago
This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
- acdha 9y ago
  It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).

balls187 9y ago

Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.

stephengillie 9y ago
It is like transactions are in P-time and disputes are in NP-time.

joering2 9y ago

Not unless they either have physical check from you, OR are enrolled into MSP (merchant service provider). But MSPs will monitor fraudulent activity just like providing CC in any online store gives them access to empty your CC doesnt mean they will get away with it :)

droidist2 9y ago
But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?
- wmf 9y ago
  Yeah, normal people cannot initiate ACHes but merchants can.
mnm1 9y ago
No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.
- njarboe 9y ago
  And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.
  - acdha 9y ago
    That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.