4 ms·

Side-note for people switching work, move your money from your direct deposit account before starting a new job. I was talking to a security researcher about a

Side-note for people switching work, move your money from your direct deposit account before starting a new job. I was talking to a security researcher about a friend who had a full interview with a company, sent papers for hiring, filled everything out, and then discovered the company she was interviewing for was named similar to a real company, with the only difference being a hyphen in the website name. The company was fake and once they had direct deposit information, drained her bank account. She was lucky there was only ~$1k in it. still. Do your due diligence. Be careful out there.

_AzMoo 6y ago
How do you drain somebody's bank account with deposit information?
- evgen 6y ago
  It will not stick and is easily reversible, but I am guessing that if I have the info to direct deposit to your account then in the US I also have enough info to generate fake ACH transactions. It really makes no sense to me though because banks are all over check kiting schemes like this and never let you move the money out of the destination account before someone at the originating bank has reversed the transaction.
- xur17 6y ago
  Deposit information in the US is account number + routing number, which is all that is required to pull funds from an account. Amusingly, this is also the information printed at the bottom of every check you use.
  - bad_good_guy 6y ago
    Wow. I don't intend to be inflammatory, but I am continually shocked by how far behind Europe the US appears to be in terms of personal banking and payments.
    - miracle2k 6y ago
      It is literally the same in Europe, via Stripe: https://qry5s.sse.codesandbox.io/ https://qry5s.sse.codesandbox.io/ Any name Any email address Test account number: DE89370400440532013000
      - randoramax 6y ago
        You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.
        miracle2k 6y ago
        It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system. I would imagine the situation in the US to be quite similar.
    - wil421 6y ago
      If someone does this it is pretty serious. The bank would refund a consumer pretty quickly and the FBI would be calling you. It would be harder to get back if they did it to your business account and you didn’t notice.
    - djsumdog 6y ago
      I wrote a post on this years ago: https://battlepenguin.com/tech/the-american-banking-system-is-still-in-the-1990s/ https://battlepenguin.com/tech/the-american-banking-system-i... To be fair, in Australia all I needed to transfer money was your name and account number and it'd appear within 24 hours. Since I've left, I've heard the system is more real time, with funds showing up in seconds. You can pull money from accounts the same way in Australia, but I suspect it's limited by business and there are audits in place to stop and reverse fraud.
- kilbuz 6y ago
  deposit information == withdrawal information, and consent to withdraw is often contained in the fine print of direct deposit agreements
- DanBC 6y ago
  The information you need to deposit money into an account (Name, bank account number, sort code) is almost all you need to withdraw money from an account by setting up direct debits or similar. See for example, Clarkson: https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc...
- chosenbreed37 6y ago
  They probably found a way to impersonate them or through some clause buried in the small print...
baybal2 6y ago
A very different story from my friend still living in Russia. In Russia, a lot of companies are issuing debit cards for their own employees, and those are often their sole bank accounts, especially for people low on social ladder. Once the employer got a whiff of the person switching jobs, he fired him, and tipped the bank to block his account on "fraud" suspicion. Banks are known to tacitly play along in such scenarios. Of course, an avenue to sue is still open for the man, but how do you sue if you have no money to pay the court fee, and your usual income will still be drained if you go to court even for such a trivial case. The man lost 80k roubles, which also close to around $1k Advice: anybody in such relationship should never hold any money in "hostage" bank accounts. Always cash out your income from salary accounts, and, for businesses, their merchant accounts with acquirers (paypal, we are looking at you.)
- rimliu 6y ago
  Either that's not a full story, or Russia has some _interesting_ banking system. Here a card is tied to your bank account but is in no way your account and absolutely not the only way to access your money. Companies only know your account mumber to transfer funds to and sure as hell they have no other access to accounts. It is also hard to imagine why would any bank to want to "play along".
  - baybal2 6y ago
    > It is also hard to imagine why would any bank to want to "play along". More business from companies issuing debit cards for employees. Often such banks are like 3rd tier ones, or complete hole-in-the-wall establishments. Such accounts almost always have near zero interest, or/are laden with high fees for every thing imaginable. > Either that's not a full story, or Russia has some _interesting_ banking system. Russia has a very interesting banking system indeed. If organised crime effectively makes a double digit of country's GDP, what else did you expect?
  - gruez 6y ago
    >Either that's not a full story, or Russia has some _interesting_ banking system. No, we have it in the states as well, see: https://www.nytimes.com/2013/07/01/business/as-pay-cards-replace-paychecks-bank-fees-hurt-workers.html https://www.nytimes.com/2013/07/01/business/as-pay-cards-rep.... Basically what happens is that you don't get a paycheck or deposit to your account. Instead, you get your pay deposited to a debit card, which you can then use to withdraw money or transfer to your own account. Since the account is technically controlled by the company and not you, it's easier for them to seize your money. It probably doesn't help that russia has high corruption and low consumer protection.
yardie 6y ago
Anyone can do this with a canceled check. If she didn’t authorize the withdrawal she calls the bank and they put the money back. And they start their own investigation. Our banking system is trash but it’s not lawless. The company committed bank and wire fraud. They’ll get dealt with by the secret service and FBI.
- SilasX 6y ago
  No? I was defrauded by wire and reported it immediately to the bank and law enforcement but “they couldn’t do anything”.
  - ianhawes 6y ago
    "Direct deposit" is ACH and it is reversible up to 180 days. The parent comment is referring to ACH. "Wire transfer" could be either Fedwire or SWIFT and it is not reversible.
    - simonebrunozzi 6y ago
      Correct. Came to write exactly this. Also, since this is HN: no, Bitcoin or other crypto "transfers" are not reversible.
    - SilasX 6y ago
      Parent also said that law enforcement will investigate all wire fraud. My experience shows that is false, and that is independent of the ACH point. See my downvoted follow-up reiterating this obvious point: https://news.ycombinator.com/item?id=24009403 https://news.ycombinator.com/item?id=24009403
  - yardie 6y ago
    That would be a non-standard account with a non-standard way of withdrawing money. EFT and ACH withdrawals are fully protected. Money wires are different, all the action is sender side. Even for me, Fidelity accountholder, a SWIFT money wire takes days to set up and I have to confirm it multiple times. I get the impression the bank hates doing them and will throw as many roadblocks as possible unless you are absolutely committed to it.
caseysoftware 6y ago
There are a number of banks out there that - once you have an account - you can create additional accounts in minutes. That's useful so you can have one connected to direct deposit for each job, one for Paypal, etc, etc with the bulk of your savings in any account not connected to anything else. If my mortgage company is compromised, there's only ~3 days/month there's any money in that account.. and then it's the exact amount of the mortgage payment. Bank account firewalls ftw.
tinus_hn 6y ago
If a company knows your bank account number they can steal the money in the account? Isn’t that the responsibility of the bank then?
deleted 6y ago
[deleted]

_AzMoo 6y ago

How do you drain somebody's bank account with deposit information?

evgen 6y ago
It will not stick and is easily reversible, but I am guessing that if I have the info to direct deposit to your account then in the US I also have enough info to generate fake ACH transactions. It really makes no sense to me though because banks are all over check kiting schemes like this and never let you move the money out of the destination account before someone at the originating bank has reversed the transaction.
xur17 6y ago
Deposit information in the US is account number + routing number, which is all that is required to pull funds from an account. Amusingly, this is also the information printed at the bottom of every check you use.
- bad_good_guy 6y ago
  Wow. I don't intend to be inflammatory, but I am continually shocked by how far behind Europe the US appears to be in terms of personal banking and payments.
  - miracle2k 6y ago
    It is literally the same in Europe, via Stripe: https://qry5s.sse.codesandbox.io/ https://qry5s.sse.codesandbox.io/ Any name Any email address Test account number: DE89370400440532013000
    - randoramax 6y ago
      You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.
      - miracle2k 6y ago
        It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system. I would imagine the situation in the US to be quite similar.
  - wil421 6y ago
    If someone does this it is pretty serious. The bank would refund a consumer pretty quickly and the FBI would be calling you. It would be harder to get back if they did it to your business account and you didn’t notice.
  - djsumdog 6y ago
    I wrote a post on this years ago: https://battlepenguin.com/tech/the-american-banking-system-is-still-in-the-1990s/ https://battlepenguin.com/tech/the-american-banking-system-i... To be fair, in Australia all I needed to transfer money was your name and account number and it'd appear within 24 hours. Since I've left, I've heard the system is more real time, with funds showing up in seconds. You can pull money from accounts the same way in Australia, but I suspect it's limited by business and there are audits in place to stop and reverse fraud.
kilbuz 6y ago
deposit information == withdrawal information, and consent to withdraw is often contained in the fine print of direct deposit agreements
DanBC 6y ago
The information you need to deposit money into an account (Name, bank account number, sort code) is almost all you need to withdraw money from an account by setting up direct debits or similar. See for example, Clarkson: https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc...
chosenbreed37 6y ago
They probably found a way to impersonate them or through some clause buried in the small print...

baybal2 6y ago

A very different story from my friend still living in Russia. In Russia, a lot of companies are issuing debit cards for their own employees, and those are often their sole bank accounts, especially for people low on social ladder. Once the employer got a whiff of the person switching jobs, he fired him, and tipped the bank to block his account on "fraud" suspicion. Banks are known to tacitly play along in such scenarios. Of course, an avenue to sue is still open for the man, but how do you sue if you have no money to pay the court fee, and your usual income will still be drained if you go to court even for such a trivial case. The man lost 80k roubles, which also close to around $1k Advice: anybody in such relationship should never hold any money in "hostage" bank accounts. Always cash out your income from salary accounts, and, for businesses, their merchant accounts with acquirers (paypal, we are looking at you.)

rimliu 6y ago
Either that's not a full story, or Russia has some _interesting_ banking system. Here a card is tied to your bank account but is in no way your account and absolutely not the only way to access your money. Companies only know your account mumber to transfer funds to and sure as hell they have no other access to accounts. It is also hard to imagine why would any bank to want to "play along".
- baybal2 6y ago
  > It is also hard to imagine why would any bank to want to "play along". More business from companies issuing debit cards for employees. Often such banks are like 3rd tier ones, or complete hole-in-the-wall establishments. Such accounts almost always have near zero interest, or/are laden with high fees for every thing imaginable. > Either that's not a full story, or Russia has some _interesting_ banking system. Russia has a very interesting banking system indeed. If organised crime effectively makes a double digit of country's GDP, what else did you expect?
- gruez 6y ago
  >Either that's not a full story, or Russia has some _interesting_ banking system. No, we have it in the states as well, see: https://www.nytimes.com/2013/07/01/business/as-pay-cards-replace-paychecks-bank-fees-hurt-workers.html https://www.nytimes.com/2013/07/01/business/as-pay-cards-rep.... Basically what happens is that you don't get a paycheck or deposit to your account. Instead, you get your pay deposited to a debit card, which you can then use to withdraw money or transfer to your own account. Since the account is technically controlled by the company and not you, it's easier for them to seize your money. It probably doesn't help that russia has high corruption and low consumer protection.

yardie 6y ago

Anyone can do this with a canceled check. If she didn’t authorize the withdrawal she calls the bank and they put the money back. And they start their own investigation. Our banking system is trash but it’s not lawless. The company committed bank and wire fraud. They’ll get dealt with by the secret service and FBI.

SilasX 6y ago
No? I was defrauded by wire and reported it immediately to the bank and law enforcement but “they couldn’t do anything”.
- ianhawes 6y ago
  "Direct deposit" is ACH and it is reversible up to 180 days. The parent comment is referring to ACH. "Wire transfer" could be either Fedwire or SWIFT and it is not reversible.
  - simonebrunozzi 6y ago
    Correct. Came to write exactly this. Also, since this is HN: no, Bitcoin or other crypto "transfers" are not reversible.
  - SilasX 6y ago
    Parent also said that law enforcement will investigate all wire fraud. My experience shows that is false, and that is independent of the ACH point. See my downvoted follow-up reiterating this obvious point: https://news.ycombinator.com/item?id=24009403 https://news.ycombinator.com/item?id=24009403
- yardie 6y ago
  That would be a non-standard account with a non-standard way of withdrawing money. EFT and ACH withdrawals are fully protected. Money wires are different, all the action is sender side. Even for me, Fidelity accountholder, a SWIFT money wire takes days to set up and I have to confirm it multiple times. I get the impression the bank hates doing them and will throw as many roadblocks as possible unless you are absolutely committed to it.

caseysoftware 6y ago

There are a number of banks out there that - once you have an account - you can create additional accounts in minutes. That's useful so you can have one connected to direct deposit for each job, one for Paypal, etc, etc with the bulk of your savings in any account not connected to anything else. If my mortgage company is compromised, there's only ~3 days/month there's any money in that account.. and then it's the exact amount of the mortgage payment. Bank account firewalls ftw.

tinus_hn 6y ago

If a company knows your bank account number they can steal the money in the account? Isn’t that the responsibility of the bank then?

deleted 6y ago

[deleted]