10 ms·

NY Payroll Company Vanishes with $35M

164 points by campuscodi 7y ago

DoofusOfDeath 7y ago
Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs? I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?
- Moto7451 7y ago
  This is what I do. Not sure if it’ll work for this case, but my primary reason was to remove a single point of failure from my “banking architecture” and avoid the headaches publicized by people on HN that lost access or to their only bank. Hopefully I never will have to find out if it works!
- itake 7y ago
  I think that this doesn't protect you and you would just end up over drafting your account, resulting in fees.
  - misterprime 7y ago
    Can't you disable overdraft?
  - roywiggins 7y ago
    Sure, but at least you'll still be able to pay rent etc without late-payment fees. A single overdraft fee is way less bad.
  - notyourday 7y ago
    Overdraft fees caused by fraud will probably be reversed. I have never heard of it not happening -- it would be a terrible PR for a bank that allowed for it. It will simply take time.
    - ThrustVectoring 7y ago
      It ought to be a regulatory incident, not just bad PR.
      - notyourday 7y ago
        I'm sure it will be, but bad PR triggers resolution much faster than OCC.
- gumby 7y ago
  Yes, and if you don't bank with one of the big banks (BofA, Wells Fargo etc) you'll be fine (those bigger banks deal with so many screwups that they'll just debit a different one of your accounts assuming it was a mistake). Or use two different banks if you can move money back and forth easily and for free. If you have a company it's really important to create a special account solely for auto debits and move money in there manually. This saved my bacon when ADP mis-debited a couple of hundred $K from a payroll run once.
- deleted 7y ago
  [deleted]
- notyourday 7y ago
  Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy is this: 1. Have an incoming account. That's the account number that you would be giving to payroll companies/account into which you would get deposits. You should presume that information about this account is known and all the money in this account is at risk. Which means that as soon as money becomes marked as "available" in this account, you have to move the money away. 2. Have a main funds account that has a positive pay type service turned on if your bank offers it. Positive Pay service is the "Notify customer about pending transactions and wait for customer to acknowledge them. If a customer does not acknowledge them by the cut off window, decline a transaction." This is typically done on a treasury management or cash management website of the bank though as recently as two years ago a certain reasonably well known bank still used a fax as a method of sending positive pay requests to customers and getting it back from customers. If your bank does not offer a positive pay type service, have this account coded for no withdrawals. This means that all debit transactions against this account will be declined unless someone on a platform side of the bank overrides it ( most banks have teller sides and platform sides -- platform side are people that you go to talk to inside the branch to deal with the issues with your account ). 3. Have a payment account that you would use to pay others. If your bank has a positive pay service, add it to this account as well. This is the account that you will fund from (2) when you know the amounts of outgoing payments. Money in this account is also at risk which is why you should only fund it with the minimum needed to cover the outstanding payments. If you have "enough money not to care if you are out of a few thousand for a couple of months" you can keep $3k-5k here at all times and just replenish it from (2) once or twice a month -- while this would leave you exposed for $3k-5k it will still protect a bulk of your cash and make your life easier. All of this is a matter of convenience vs. risk -- you should know what's your average monthly spend is and you want to expose not more than that plus a few percent for variance. 4. Have a nightly/daily/hourly sweep of all available funds from account (1) to account (2). It can either be done using a service the bank provides, or using online account transfer. Definitely sweep away immediately after a large payment ( such as a paycheck ) or electronic/non-electronic checks post to this account. 5. No debit transactions can post to the account (2) [including bank internal transactions] without an override ( for a coded account) or without a positive pay acknowledgement for a positive pay account. That of course means that if this is not a positive pay account, you would need to show up physically at the bank and have one of the tellers after the teller checks your ID process a transfer of funds from (2) to (3). If you have a significant amount of money, you should have this setup in several banks. Remember, your goal is to make issues with money less stressful while you are resolving them. At the end of the day, you will be made whole because we have a fairly strong legal system to get redress. You are trying to make sure that you still have the money while you are using the legal system to deal with the issues. Source: Did consulting for execs at medium sized banks.
ahnick 7y ago
ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.
- eli 7y ago
  Wouldn't a flag on the ACH that makes it irreversible accomplish the same goal with considerably less overhead? I think it's already possible to do this with a wire transfer.
  - ahnick 7y ago
    You can't currently do that can you? If you can, please tell me how because I would love to know. :-) If you mean that this could be implemented, then great I'm all for it. From a technical perspective it doesn't seem like it should be difficult. I'm under the impression it doesn't exist most likely because the banks don't want it to. Hence the benefit of using cryptocurrency.
  - roywiggins 7y ago
    I'm not sure these ACH transactions are actually processed like reversals. Otherwise, you wouldn't be able to reverse the same transaction twice, as happened here. They just pulled money back out.
- Broken_Hippo 7y ago
  Yeah, until you need to pay rent, loans, credit cards, or buy groceries, or prove you are paying folks at least minimum wage.
  - ahnick 7y ago
    Converting out to fiat is completely doable. People in countries where their own currency is experiencing issues make it work. Of course, ideally, ACH reversals couldn't be done without your permission.
    - 7y ago
C1sc0cat 7y ago
Interesting, and a bit frightening about the lack of security. I have had to work with the equivalent process for payments in the UK - we where fixing up a problem when the accounts receivable system would not cut the BACS tape for 6 months! Submitting a BACS Tape required the use of onetime codes and a physical device and this was in the late 80's
soneil 7y ago
This does seem like a nightmare scenario for the vast majority (4 in 5?) of Americans who live cheque-to-cheque. Your pay is yanked, life doesn't stop and the bills keep coming. A few days, a week later, it's corrected and the pay reappears. Who's on the hook for your overdraft fees?
- the-dude 7y ago
  What is an overdraft fee? How much is it? Is it interest?
  - ska 7y ago
    This is a flat fee assessed if your account goes into "overdraft" to cover a check (or other liability). If your account is set up to do this (pretty standard in the US) rather than a check failing to clear your bank will cover the check and charge, e.g. $30-$50 for covering it. Of course you owe the overdraft amount as well.
    - mattwad 7y ago
      I also think it's mostly meant to be a deterrent. When I had BofA, any time I got overdraft I just called and they would take it off, usually without an explanation.
      - ska 7y ago
        That's true, but as in other areas I think it probably has a lot to do with how much they value your future business.
  - penagwin 7y ago
    Overdrafting is when the balance goes below 0. Policies vary by bank, but generally it's a $25~$50 (could be more or less) for _each_ transaction the bank processes while your account has a negative balance. So looking at this case, let's say you have to go 7 days until this issue is resolved and the employees are given their paychecks. If they got automatic payments they could find that itunes, spotify, bills, etc, automatically charge them during that period. EACH charge might be 45$. Say 5 services do it, boom over 200$ in the hole in fees alone. (If you're ever in the situation listen to the other comments about how to approach the bank about reversing over-draft fees)
gregmac 7y ago
This was confusing to understand, because multiple bad things happened. Normally: * Step 1: Transfer funds from each Employer's account to Cachet's holding account * Step 2: Transfer funds from Cachet's holding account to each Employee account Both of these steps are handled with an 'instructions file'. --- The crime (or horrible mistake that really looks like a crime): Step 1's file was changed so that the funds went to an account at Pioneer Savings Bank (controlled by MyPayrollHR) Step 2's file was sent as it normally would be. ---- Mistake 1: The file for Step 2 was processed, and funds from Cachet's holding account were transferred to employees, despite funds from Employers not coming in. Apparently Cachet had at least $26M extra in their holding account for this to work. As a result of this, Cachet tried to reverse these transactions, since basically they hadn't actually been paid. ---- Mistake 2: The reversal file was improperly formatted. NACHA rules say these files should be ignored or rejected, but.. ---- Mistake 3: Some financial institutions processed the improperly formatted file anyway. ---- To fix Mistake 2, Cachet submitted a new reversal file, which was then also processed by the companies. It sounds like this "reversal file" was actually just a transfer in the other direction (as opposed to "undo transaction ID 937641745"), so of course it would make sense that it was processed. ---- As a result, all employees paid via MyPayrollHR were paid, then had that payment removed. Some also had the same payroll amount removed a second time. One thing I haven't figured out, is apparently the MyPayrollHR account at Pioneer Savings Bank is 'frozen' -- but I can't find any reporting about whether it has $26M in it or not. Meanwhile the CEO has disappeared.. So did he get the money, or just cause a massive life disruption for thousands of people?
- jmuguy 7y ago
  Thanks for the explanation, based on the way Krebs worded the post I couldn't tell what actually happened.
- apacheCamel 7y ago
  Thank you for explaining it, you did a great job at helping me understand what happened. The whole process seems way too convoluted for something as serious as paychecks. It really relies on everybody acting in good-faith and in the proper fashion. By Cachet working Step 2 before Step 1 and possibly assuming Step 1 was going to happen, they already were too far gone and only made the situation worse for them and a bunch of employees.
Kiro 7y ago
Why such a complicated transfer chain just to pay salaries? In my country you just export a bank file from your payroll system and that's it.
- danaris 7y ago
  I suspect it's partly because there's a complicated employment arrangement going on, with the employees being sorta employed by the payroll management company ("employer of record"), and sorta employed by the company they actually work for, which then pays the payroll management company to handle all that stuff so they don't have to.
- ars 7y ago
  > from your payroll system The payroll system is a 3rd party here. Which is pretty normal, there are a lot of different taxes and things that need to be tracked, and it's easier to let a specialist handle that.
seibelj 7y ago
And people say crypto exchanges are bad because of exit scams. The same thing essentially happened here, except the authorities are actually investigating.
- sofaofthedamned 7y ago
  Bollocks. Once a crypto exchange is gone your money is gone.
antaviana 7y ago
In the US anyone with your bank account number can debit your account irreversibly? In Europe (with SEPA Core) we have 8 weeks to reject any debit even if the entity issuing the debit has a signed mandate to debit the account.
- dahdum 7y ago
  Any other bank can debit your checking account, but they become responsible for refunding in the case fraud/error. Since no access card (atm card, pin, etc) was used, customers have $0 liability for the same 60 days as you do. This is partly why banks are strict with merchant processing, holding back variable reserves to cover refunds/fraud based on your history and business type.
- patio11 7y ago
  Knowledge of a bank account number is sufficient to attempt to debit it. Whether it will appear to succeed or not depends on the bank and a variety of factors. Regardless of whether it initially successes, it is (very) reversible. There’s a lot of technical nuance here which I’d ordinarily geek out on but don’t quite have the time to today.
- fooey 7y ago
  NACHA just uses FTP for their file transfers too
- ska 7y ago
  There are (broadly) similar guarantees in the US. So they will get the money back, at least eventually. The problem is the effect it has when the account has sometimes been debited 2x. If this has made, say your rent or car payment bounce, you have an big hassle at minimum.
- londons_explore 7y ago
  In the UK, direct debit (the equivalent to ACH) allows a consumer to request an instant refund of any payment they believe to be in error. The bank must refund first, and ask questions later. As you might imagine, some people use that to steal money...
apacheCamel 7y ago
Honestly, this is really scary. Personally, I would be unable to take a [2x my bi-weekly salary] hit to my account and that would result in a pretty negative balance. I think I recently saw an article about a bank depositing too much money into an account and the account owner spent it then got arrested. It just seems like the people in charge of how we get/hold our money can screw up with minimal blow back, yet the receiver of the money is almost always the one who draws the short straw. I could be wrong, but it really makes me question the safety of (what little) money I have.
- isostatic 7y ago
  If you earn 3k a month, one month you get paid 100k, and you spend 5k on normal things, you aren't going to be arrested. If you earn 3k a month, one month you get paid 100k, and you spend 95k on stuff you don't normally buy, you are going to be arrested. If you pick up 20 centrs from the floor and spend it, you won't be arrested. If you find $50k in a bag and spend it, you will be.
  - notfromhere 7y ago
    I'm pretty sure if you find a bag of money on public property, you're under no obligation to actually return it.
    - harryh 7y ago
      This is not correct. If you find a bag of money (or, much more common: a wallet) and you can identify the owner you are obligated to return it. Not doing so is a crime. As it should be.
      - isostatic 7y ago
        California Civil Code section 2080.1 for example "the person saving or finding the property shall, if the property is of the value of one hundred dollars ($100) or more, within a reasonable time turn the property over to the police department of the city" https://codes.findlaw.com/ca/civil-code/civ-sect-2080-1.html https://codes.findlaw.com/ca/civil-code/civ-sect-2080-1.html
ydnaclementine 7y ago
Really makes me appreciate the non-obvious complexity for companies like justworks (and all the other companies) to operate in this space
patio11 7y ago
Since this is sort of my beat: If this ever happens to you, immediately call bank, say “Electronic transaction posted in error.”, specifically identify the transaction, and ask what address the bank takes Regulation E written complaints at. If the CSR doesn’t know that answer, their supervisor does, or in the alternative FedEx HQ addressed to chief counsel or head of compliance. The letter just needs to state transaction details, date you first called them, and your desired action (“Credit me back $X.”), but it’s marginally more effective to say Regulation E in it since that will put the fear of God into whomever opens it. You’ll get the money back.
- october_sky 7y ago
  Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?
  - dfcowell 7y ago
    The guy works for Stripe. I’d say as a company they’re pretty savvy about banking regulations in general, and transaction disputes specifically.
    - ThrustVectoring 7y ago
      His blog also mentions that he's ghostwritten a few hundred letters to various financial institutions in order to resolve errors in credit reports (https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...).
  - korethr 7y ago
    I suspect it's because he works for Stripe now, which handles the electronic transfer of monies. Therefore, Stripe would have to know about Regulation E to be able to operate effectively in that space. It has been my experience that when working at a company, even if you didn't know or care about the industry/field that company does business in before starting there, you can't help but learn the ins and outs of that field or industry while working there, to at least a partial degree. The particulars of that field will necessarily influence business operations, and therefore, what you do in that company in some form or another. How much one absorbs, and how much he is aware of this will depend on both the individual and the duties of his position, and whether this comes from deliberate training or cultural osmosis. But I don't think that a person could remain completely ignorant of the particulars of an industry after being employed by a company in that space. That's my theory, anyway. Watch Patrick prove me wrong by describing how he came into knowledge of Regulation E by some other path than training or cultural osmosis while working at Stripe
MBCook 7y ago
It seems the FBI in the NY Albany office is now looking into this. https://twitter.com/FBIAlbany/status/1171827423333289985 https://twitter.com/FBIAlbany/status/1171827423333289985
JJMcJ 7y ago
Besides the banking issues, when do the people get paid? If the disappeared payroll company got money from employers, it's possible some employers may not have enough cash to pay a second time. Then they out of business, or close to it. The old businessman's phrase "You've never had to meet a payroll" is really meaningful here, the scramble to pay everyone.
- kaikai 7y ago
  The article said that Cachet is covering the transactions, even though they haven't been paid. The companies will have to find a new payroll provider before their next payroll, but not have to come up with the extra cash.
  - londons_explore 7y ago
    If I were Cachet's shareholders, I wouldn't be happy about that...
    - notfoss 7y ago
      If I was one of their shareholders, I would be happy instead, as they seem to have come out as the real good guys in the whole story (unless they were legally obligated for covering the mess).
      - philpem 7y ago
        If they begin to offer payroll services directly to some of the affected companies, I imagine the shareholders would be quite happy. They might be out the money until the insurance pays up, but ongoing fees and goodwill could well cover that inside of a year or two.
orf 7y ago
What form of financial network allows a random company to take money from people without any authorization or interaction on their part? If the employees had somehow set up whatever the USA calls a direct debit, then sure, I can see a reason for this to happen. But through mistake or malice they are still able to dip into peoples account - that's the real issue here, surely?
throw7 7y ago
Shades of office space! I'm calling it... the crack coder screwed up the instructions files! Instead of redirecting fractional pennies from each employee to his pioneer bank account, he redirected the whole shebang! boom! ruh ohh!
xoraes 7y ago
This may be tangential and specific to United States, but is there a way to prevent someone from withdrawing money from your account if they know the account and routing number? Both of those numbers are on checks.
- ThrustVectoring 7y ago
  There isn't a good way to do that. Electronic funds transfers are generally reversible, though. After informing your bank of an unauthorized electronic funds transfer, they are required to investigate and provide you at least a provisional credit for the amount within ten business days.
Samix10 7y ago
ok

164 points by campuscodi 7y ago

Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs? I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?

Moto7451 7y ago
This is what I do. Not sure if it’ll work for this case, but my primary reason was to remove a single point of failure from my “banking architecture” and avoid the headaches publicized by people on HN that lost access or to their only bank. Hopefully I never will have to find out if it works!
itake 7y ago
I think that this doesn't protect you and you would just end up over drafting your account, resulting in fees.
- misterprime 7y ago
  Can't you disable overdraft?
- roywiggins 7y ago
  Sure, but at least you'll still be able to pay rent etc without late-payment fees. A single overdraft fee is way less bad.
- notyourday 7y ago
  Overdraft fees caused by fraud will probably be reversed. I have never heard of it not happening -- it would be a terrible PR for a bank that allowed for it. It will simply take time.
  - ThrustVectoring 7y ago
    It ought to be a regulatory incident, not just bad PR.
    - notyourday 7y ago
      I'm sure it will be, but bad PR triggers resolution much faster than OCC.
gumby 7y ago
Yes, and if you don't bank with one of the big banks (BofA, Wells Fargo etc) you'll be fine (those bigger banks deal with so many screwups that they'll just debit a different one of your accounts assuming it was a mistake). Or use two different banks if you can move money back and forth easily and for free. If you have a company it's really important to create a special account solely for auto debits and move money in there manually. This saved my bacon when ADP mis-debited a couple of hundred $K from a payroll run once.
deleted 7y ago
[deleted]
notyourday 7y ago
Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy is this: 1. Have an incoming account. That's the account number that you would be giving to payroll companies/account into which you would get deposits. You should presume that information about this account is known and all the money in this account is at risk. Which means that as soon as money becomes marked as "available" in this account, you have to move the money away. 2. Have a main funds account that has a positive pay type service turned on if your bank offers it. Positive Pay service is the "Notify customer about pending transactions and wait for customer to acknowledge them. If a customer does not acknowledge them by the cut off window, decline a transaction." This is typically done on a treasury management or cash management website of the bank though as recently as two years ago a certain reasonably well known bank still used a fax as a method of sending positive pay requests to customers and getting it back from customers. If your bank does not offer a positive pay type service, have this account coded for no withdrawals. This means that all debit transactions against this account will be declined unless someone on a platform side of the bank overrides it ( most banks have teller sides and platform sides -- platform side are people that you go to talk to inside the branch to deal with the issues with your account ). 3. Have a payment account that you would use to pay others. If your bank has a positive pay service, add it to this account as well. This is the account that you will fund from (2) when you know the amounts of outgoing payments. Money in this account is also at risk which is why you should only fund it with the minimum needed to cover the outstanding payments. If you have "enough money not to care if you are out of a few thousand for a couple of months" you can keep $3k-5k here at all times and just replenish it from (2) once or twice a month -- while this would leave you exposed for $3k-5k it will still protect a bulk of your cash and make your life easier. All of this is a matter of convenience vs. risk -- you should know what's your average monthly spend is and you want to expose not more than that plus a few percent for variance. 4. Have a nightly/daily/hourly sweep of all available funds from account (1) to account (2). It can either be done using a service the bank provides, or using online account transfer. Definitely sweep away immediately after a large payment ( such as a paycheck ) or electronic/non-electronic checks post to this account. 5. No debit transactions can post to the account (2) [including bank internal transactions] without an override ( for a coded account) or without a positive pay acknowledgement for a positive pay account. That of course means that if this is not a positive pay account, you would need to show up physically at the bank and have one of the tellers after the teller checks your ID process a transfer of funds from (2) to (3). If you have a significant amount of money, you should have this setup in several banks. Remember, your goal is to make issues with money less stressful while you are resolving them. At the end of the day, you will be made whole because we have a fairly strong legal system to get redress. You are trying to make sure that you still have the money while you are using the legal system to deal with the issues. Source: Did consulting for execs at medium sized banks.

ahnick 7y ago

ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.

eli 7y ago
Wouldn't a flag on the ACH that makes it irreversible accomplish the same goal with considerably less overhead? I think it's already possible to do this with a wire transfer.
- ahnick 7y ago
  You can't currently do that can you? If you can, please tell me how because I would love to know. :-) If you mean that this could be implemented, then great I'm all for it. From a technical perspective it doesn't seem like it should be difficult. I'm under the impression it doesn't exist most likely because the banks don't want it to. Hence the benefit of using cryptocurrency.
- roywiggins 7y ago
  I'm not sure these ACH transactions are actually processed like reversals. Otherwise, you wouldn't be able to reverse the same transaction twice, as happened here. They just pulled money back out.
Broken_Hippo 7y ago
Yeah, until you need to pay rent, loans, credit cards, or buy groceries, or prove you are paying folks at least minimum wage.
- ahnick 7y ago
  Converting out to fiat is completely doable. People in countries where their own currency is experiencing issues make it work. Of course, ideally, ACH reversals couldn't be done without your permission.
  - 7y ago

C1sc0cat 7y ago

Interesting, and a bit frightening about the lack of security. I have had to work with the equivalent process for payments in the UK - we where fixing up a problem when the accounts receivable system would not cut the BACS tape for 6 months! Submitting a BACS Tape required the use of onetime codes and a physical device and this was in the late 80's

soneil 7y ago

This does seem like a nightmare scenario for the vast majority (4 in 5?) of Americans who live cheque-to-cheque. Your pay is yanked, life doesn't stop and the bills keep coming. A few days, a week later, it's corrected and the pay reappears. Who's on the hook for your overdraft fees?

the-dude 7y ago
What is an overdraft fee? How much is it? Is it interest?
- ska 7y ago
  This is a flat fee assessed if your account goes into "overdraft" to cover a check (or other liability). If your account is set up to do this (pretty standard in the US) rather than a check failing to clear your bank will cover the check and charge, e.g. $30-$50 for covering it. Of course you owe the overdraft amount as well.
  - mattwad 7y ago
    I also think it's mostly meant to be a deterrent. When I had BofA, any time I got overdraft I just called and they would take it off, usually without an explanation.
    - ska 7y ago
      That's true, but as in other areas I think it probably has a lot to do with how much they value your future business.
- penagwin 7y ago
  Overdrafting is when the balance goes below 0. Policies vary by bank, but generally it's a $25~$50 (could be more or less) for _each_ transaction the bank processes while your account has a negative balance. So looking at this case, let's say you have to go 7 days until this issue is resolved and the employees are given their paychecks. If they got automatic payments they could find that itunes, spotify, bills, etc, automatically charge them during that period. EACH charge might be 45$. Say 5 services do it, boom over 200$ in the hole in fees alone. (If you're ever in the situation listen to the other comments about how to approach the bank about reversing over-draft fees)

gregmac 7y ago

This was confusing to understand, because multiple bad things happened. Normally: * Step 1: Transfer funds from each Employer's account to Cachet's holding account * Step 2: Transfer funds from Cachet's holding account to each Employee account Both of these steps are handled with an 'instructions file'. --- The crime (or horrible mistake that really looks like a crime): Step 1's file was changed so that the funds went to an account at Pioneer Savings Bank (controlled by MyPayrollHR) Step 2's file was sent as it normally would be. ---- Mistake 1: The file for Step 2 was processed, and funds from Cachet's holding account were transferred to employees, despite funds from Employers not coming in. Apparently Cachet had at least $26M extra in their holding account for this to work. As a result of this, Cachet tried to reverse these transactions, since basically they hadn't actually been paid. ---- Mistake 2: The reversal file was improperly formatted. NACHA rules say these files should be ignored or rejected, but.. ---- Mistake 3: Some financial institutions processed the improperly formatted file anyway. ---- To fix Mistake 2, Cachet submitted a new reversal file, which was then also processed by the companies. It sounds like this "reversal file" was actually just a transfer in the other direction (as opposed to "undo transaction ID 937641745"), so of course it would make sense that it was processed. ---- As a result, all employees paid via MyPayrollHR were paid, then had that payment removed. Some also had the same payroll amount removed a second time. One thing I haven't figured out, is apparently the MyPayrollHR account at Pioneer Savings Bank is 'frozen' -- but I can't find any reporting about whether it has $26M in it or not. Meanwhile the CEO has disappeared.. So did he get the money, or just cause a massive life disruption for thousands of people?

jmuguy 7y ago
Thanks for the explanation, based on the way Krebs worded the post I couldn't tell what actually happened.
apacheCamel 7y ago
Thank you for explaining it, you did a great job at helping me understand what happened. The whole process seems way too convoluted for something as serious as paychecks. It really relies on everybody acting in good-faith and in the proper fashion. By Cachet working Step 2 before Step 1 and possibly assuming Step 1 was going to happen, they already were too far gone and only made the situation worse for them and a bunch of employees.

Kiro 7y ago

Why such a complicated transfer chain just to pay salaries? In my country you just export a bank file from your payroll system and that's it.

danaris 7y ago
I suspect it's partly because there's a complicated employment arrangement going on, with the employees being sorta employed by the payroll management company ("employer of record"), and sorta employed by the company they actually work for, which then pays the payroll management company to handle all that stuff so they don't have to.
ars 7y ago
> from your payroll system The payroll system is a 3rd party here. Which is pretty normal, there are a lot of different taxes and things that need to be tracked, and it's easier to let a specialist handle that.

seibelj 7y ago

And people say crypto exchanges are bad because of exit scams. The same thing essentially happened here, except the authorities are actually investigating.

sofaofthedamned 7y ago
Bollocks. Once a crypto exchange is gone your money is gone.

antaviana 7y ago

In the US anyone with your bank account number can debit your account irreversibly? In Europe (with SEPA Core) we have 8 weeks to reject any debit even if the entity issuing the debit has a signed mandate to debit the account.

dahdum 7y ago
Any other bank can debit your checking account, but they become responsible for refunding in the case fraud/error. Since no access card (atm card, pin, etc) was used, customers have $0 liability for the same 60 days as you do. This is partly why banks are strict with merchant processing, holding back variable reserves to cover refunds/fraud based on your history and business type.
patio11 7y ago
Knowledge of a bank account number is sufficient to attempt to debit it. Whether it will appear to succeed or not depends on the bank and a variety of factors. Regardless of whether it initially successes, it is (very) reversible. There’s a lot of technical nuance here which I’d ordinarily geek out on but don’t quite have the time to today.
fooey 7y ago
NACHA just uses FTP for their file transfers too
ska 7y ago
There are (broadly) similar guarantees in the US. So they will get the money back, at least eventually. The problem is the effect it has when the account has sometimes been debited 2x. If this has made, say your rent or car payment bounce, you have an big hassle at minimum.
londons_explore 7y ago
In the UK, direct debit (the equivalent to ACH) allows a consumer to request an instant refund of any payment they believe to be in error. The bank must refund first, and ask questions later. As you might imagine, some people use that to steal money...

apacheCamel 7y ago

Honestly, this is really scary. Personally, I would be unable to take a [2x my bi-weekly salary] hit to my account and that would result in a pretty negative balance. I think I recently saw an article about a bank depositing too much money into an account and the account owner spent it then got arrested. It just seems like the people in charge of how we get/hold our money can screw up with minimal blow back, yet the receiver of the money is almost always the one who draws the short straw. I could be wrong, but it really makes me question the safety of (what little) money I have.

isostatic 7y ago
If you earn 3k a month, one month you get paid 100k, and you spend 5k on normal things, you aren't going to be arrested. If you earn 3k a month, one month you get paid 100k, and you spend 95k on stuff you don't normally buy, you are going to be arrested. If you pick up 20 centrs from the floor and spend it, you won't be arrested. If you find $50k in a bag and spend it, you will be.
- notfromhere 7y ago
  I'm pretty sure if you find a bag of money on public property, you're under no obligation to actually return it.
  - harryh 7y ago
    This is not correct. If you find a bag of money (or, much more common: a wallet) and you can identify the owner you are obligated to return it. Not doing so is a crime. As it should be.
    - isostatic 7y ago
      California Civil Code section 2080.1 for example "the person saving or finding the property shall, if the property is of the value of one hundred dollars ($100) or more, within a reasonable time turn the property over to the police department of the city" https://codes.findlaw.com/ca/civil-code/civ-sect-2080-1.html https://codes.findlaw.com/ca/civil-code/civ-sect-2080-1.html

ydnaclementine 7y ago

Really makes me appreciate the non-obvious complexity for companies like justworks (and all the other companies) to operate in this space

patio11 7y ago

Since this is sort of my beat: If this ever happens to you, immediately call bank, say “Electronic transaction posted in error.”, specifically identify the transaction, and ask what address the bank takes Regulation E written complaints at. If the CSR doesn’t know that answer, their supervisor does, or in the alternative FedEx HQ addressed to chief counsel or head of compliance. The letter just needs to state transaction details, date you first called them, and your desired action (“Credit me back $X.”), but it’s marginally more effective to say Regulation E in it since that will put the fear of God into whomever opens it. You’ll get the money back.

october_sky 7y ago
Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?
- dfcowell 7y ago
  The guy works for Stripe. I’d say as a company they’re pretty savvy about banking regulations in general, and transaction disputes specifically.
  - ThrustVectoring 7y ago
    His blog also mentions that he's ghostwritten a few hundred letters to various financial institutions in order to resolve errors in credit reports (https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...).
- korethr 7y ago
  I suspect it's because he works for Stripe now, which handles the electronic transfer of monies. Therefore, Stripe would have to know about Regulation E to be able to operate effectively in that space. It has been my experience that when working at a company, even if you didn't know or care about the industry/field that company does business in before starting there, you can't help but learn the ins and outs of that field or industry while working there, to at least a partial degree. The particulars of that field will necessarily influence business operations, and therefore, what you do in that company in some form or another. How much one absorbs, and how much he is aware of this will depend on both the individual and the duties of his position, and whether this comes from deliberate training or cultural osmosis. But I don't think that a person could remain completely ignorant of the particulars of an industry after being employed by a company in that space. That's my theory, anyway. Watch Patrick prove me wrong by describing how he came into knowledge of Regulation E by some other path than training or cultural osmosis while working at Stripe

MBCook 7y ago

It seems the FBI in the NY Albany office is now looking into this. https://twitter.com/FBIAlbany/status/1171827423333289985 https://twitter.com/FBIAlbany/status/1171827423333289985

JJMcJ 7y ago

Besides the banking issues, when do the people get paid? If the disappeared payroll company got money from employers, it's possible some employers may not have enough cash to pay a second time. Then they out of business, or close to it. The old businessman's phrase "You've never had to meet a payroll" is really meaningful here, the scramble to pay everyone.

kaikai 7y ago
The article said that Cachet is covering the transactions, even though they haven't been paid. The companies will have to find a new payroll provider before their next payroll, but not have to come up with the extra cash.
- londons_explore 7y ago
  If I were Cachet's shareholders, I wouldn't be happy about that...
  - notfoss 7y ago
    If I was one of their shareholders, I would be happy instead, as they seem to have come out as the real good guys in the whole story (unless they were legally obligated for covering the mess).
    - philpem 7y ago
      If they begin to offer payroll services directly to some of the affected companies, I imagine the shareholders would be quite happy. They might be out the money until the insurance pays up, but ongoing fees and goodwill could well cover that inside of a year or two.

orf 7y ago

What form of financial network allows a random company to take money from people without any authorization or interaction on their part? If the employees had somehow set up whatever the USA calls a direct debit, then sure, I can see a reason for this to happen. But through mistake or malice they are still able to dip into peoples account - that's the real issue here, surely?

throw7 7y ago

Shades of office space! I'm calling it... the crack coder screwed up the instructions files! Instead of redirecting fractional pennies from each employee to his pioneer bank account, he redirected the whole shebang! boom! ruh ohh!

xoraes 7y ago

This may be tangential and specific to United States, but is there a way to prevent someone from withdrawing money from your account if they know the account and routing number? Both of those numbers are on checks.

ThrustVectoring 7y ago
There isn't a good way to do that. Electronic funds transfers are generally reversible, though. After informing your bank of an unauthorized electronic funds transfer, they are required to investigate and provide you at least a provisional credit for the amount within ten business days.

Samix10 7y ago