17 ms·

Robinhood Accounts Looted, No Customer Support

vkou 6y ago
> The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said. I disagree. The Robinhood system includes their disbursement process. In this case, someone with access to a username and password managed to, without passing any of the other typical 2FA checks in finance (Calling the the account holder, snail-mail confirmation, actual 2FA tokens) managed to get Robinhood to wire them money. This is absolutely a compromise of their disbursement system. If a bank gave all my money to some random asshat that showed up to a branch with my debit card, the blame for that lies on my bank. This is typical liability laundering.
- preinheimer 6y ago
  I think it's important not to stop at simply offering security systems, but to require them when appropriate. Hey you've got $1000 in your account now, that's awesome! Let's set up 2FA to protect that money!
  - spatley 6y ago
    more than that. For Robinhood to even allow initial account setup without robust (reda: no SMS) 2FA is bordering on criminal negligence. the only explanation to not doing that is feat that it would reduce their signup completion rate. Which fits Robinhood's prior behavior. This should be a class action at minimum, companies cannot shovel this kind of risk onto the general public.
    - thrill 6y ago
      Hyperbolic much? "Criminal negligence"? There are no laws requiring 2FA. Half the world thinks 2FA means SMS.
      - kube-system 6y ago
        There are laws that require financial services companies to take appropriate steps to protect customer data.
        bigbubba 6y ago
        Sure, but those laws don't require 2FA (maybe they should) and Robinhood is far from the only institution that doesn't require it. A startling lot still think 'state your name, SSN/PIN/ or account number and birthday over the telephone' is sufficient.
        bostik 6y ago
        > Sure, but those laws don't require 2FA Funny that. The PSD2 regulations in Europe do.[0] The downside is that they don't mandate properly secure 2FA, so we have a mishmash of SMS, time-based tokens and whatever else passes for various banks under the regulations.[ß] 0: https://www.bankinfosecurity.com/psd2-authentication-requirements-implementation-hurdles-a-13086 https://www.bankinfosecurity.com/psd2-authentication-require... ß: My UK bank requires locally generated, time-based reader/app tokens, and has done so as long as I've lived here. My Finnish bank uses SMS.
      - medina 6y ago
        Not sure what you mean laws but there is certainly regulatory guidance that assessors will be using. The agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties. Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services. Account fraud and identity theft are frequently the result of single-factor (e.g., ID/password) authentication exploitation. Where risk assessments indicate that the use of single-factor authentication is inadequate, financial institutions should implement multifactor authentication, layered security, or other controls reasonably calculated to mitigate those risks. https://www.ffiec.gov/pdf/authentication_guidance.pdf https://www.ffiec.gov/pdf/authentication_guidance.pdf
    - Wowfunhappy 6y ago
      Enabling 2FA by default is probably a good idea, but I do believe quite strongly that users should be able to turn it off. You don't know the user's situation—maybe they don't have consistent access to a single phone, for instance—and if they actually use a strong and unique password, that should be sufficient. Additional factors are of course always safer, but everything is a trade-off between security and usability, and users should have control.
  - isatty 6y ago
    From what I see on WSB, you can trade options without even fully verifying your email.
- threatofrain 6y ago
  If someone shows up with your debit card and pin, which is similar to knowing someone's account credentials, wouldn't the bank give you that cash up to some amount (without further verification) because it's insured anyway?
  - nkrisc 6y ago
    > If a bank gave all my money A bank would not let you empty an account with just a debit card and PIN, assuming there was some non-trivial amount of money in there.
  - greenshackle2 6y ago
    > up to some amount I think that's a pretty important detail. With my bank they could only get up to $1000 without further verification.
  - vkou 6y ago
    1. It will give that cash up to some amount. It won't let the chap drain my entire account. 2. They will return my money if I reported the theft in a timely fashion. Robin hood seems to be doing neither.
    - threatofrain 6y ago
      For a singular transaction, a thief might limit themselves to something well under $10k. If a thief makes multiple withdrawals totaling $16k, which is over the FDIC insured amount, would a bank really just compensate you for that? Wouldn't that be out of the graciousness of the bank (or PR)?
      - nimih 6y ago
        In the US, as long as you notify the bank within 60 days of receiving a statement that has fraudulent transactions, your maximum liability is $500, and that goes down substantially if you notify the bank promptly of a lost/stolen card, or if the card was not lost in the first place[0]. So yes, the bank really would[1] just compensate you for that, provided you notice the fraud within 2-3 months of it occurring (depending on how quickly you get a bank statement). Edit: You may still be on the hook for overdraft fees from e.g. authorized payments, and it may take some time for the bank to indemnify you, which is why the conventional wisdom is that CCs are safer than debit cards from a fraud perspective. [0] https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-credit-atm-and-debit-cards https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr... [1] and is in fact legally required to: https://www.federalreserve.gov/boarddocs/caletters/2008/0807/08-07_attachment.pdf https://www.federalreserve.gov/boarddocs/caletters/2008/0807...
- rdiddly 6y ago
  Came here to say that. If your system relies on an external system like someone's email, and that gets breached, your system has been breached. You don't get to brag that the successful attack was indirect; most of them are.
- viktorcode 6y ago
  It seems to me that the damage is pretty limited for a cyber criminals with alleged ability to bypass 2FA. That low number of victims among millions of RobinHood customers is highly uncharacteristic for a critical security breach.
- Terr_ 6y ago
  > This is typical liability laundering. Relevant Mitchell & Webb comedy sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- XargonEnder 6y ago
  Liability laundering is an awesome phrase that needs to be used more
bob1029 6y ago
This headline is a bit hyperbolic, but the lack of a direct phone line to someone who can help is why I've moved on to other brokerages. Robinhood worked well for bootstrapping my portfolio with free trades, but after a certain point it got big enough for me to worry about other factors like this.
- cortesoft 6y ago
  Also, the other brokerages have also moved to free trades, so it isn’t an advantage anymore.
- cashewchoo 6y ago
  Charles Schwab has native english speaker support just a phone call away (with no waiting in the handful of times I've used them, so far). And they were the first of the non-robinhood retail brokerages to break rank and offer 0-commission equity trades. Example: I accidentally deposited a check into my IRA once. I called and explained I wasn't sure what to do because 1) the check was post-tax money and 2) if I tried to fix it myself, would it count as an early withdrawal?. The guy picked up almost immediately, said yep lemme transfer you, the <something> department has a button for that. I got transferred, still to a native english speaker, who sorted me out. A couple days later it was all fixed in my account. 10/10. I do all my banking with them and if they offered a 2% cashback credit card, I'd move that to them too. Speaking of which, Citi (I have the doublecash) has been dreadful - my card # got stolen once, and they sent the new credit cards to my old address (that I still - for a bit longer - owned, thankfully) even after I specifically stressed, and confirmed multiple times, that I was 300 miles away from the address and if they sent them there, they'd sit in my porch for 1-2 weeks before I could get to them, and I would also not have a credit card to use. They reassure me, even getting a bit snippy at the end of the call, that they're sending them to the address I gave them (my parents' house) on the call. And since I'm such an important customer, they're overnighting the cards. Sure enough, the next day, I check my security camera and see a dang cardboard envelope that says CITICARDS all over it sitting on my old porch 300 miles away. So I call them up, explain that they did exactly what I asked them not to do, and if they could cancel those cards and try sending them again, because I don't have a credit card right now, and I'm trying to furnish and move into a new house and need to put about $10k of appliances purchases through the cards ASAP. They explain that, sorry, they need to wait a week or two (I was incensed and don't remember clearly at this point) before they can do anything. Luckily a week later when I rolled up to finish cleaning the old house, the cards were still there, albeit a bit damp. In the meantime I'd applied for a Blue Cash Preferred (which gets 6% cashback on instacart!) and they had it to me overnight and dropped it on the doorstep of my new house which was a new construction and not even in some systems yet as a valid address. Their support as been good so far, too, though I haven't had to call them but once so far. (Thanks for coming to my TED talk.)
simpsond 6y ago
At this point I think a more fitting name is: RobberBaron
vmception 6y ago
If I understand public opinion logic correctly: its the customers fault until one of the customers kill themselves, then its the brokerage fault. But for now we can make fun of the customers having their email compromised, while being slightly confused why Robinhood doesn't offer greater verification.
- zamalek 6y ago
  > while being slightly confused why Robinhood doesn't offer greater verification. It sounds like the bigger confusion is that Robinhood doesn't have a way to cancel withdrawals in flight. At least one of the customers caught the transaction with time to cancel, and couldn't reach a human in time to do that.
choppaface 6y ago
How different is this than getting your checking account number stolen? When that happened to me at Bank of America, I went physically into a branch where they just called support and we waited on hold for an hour. The person who eventually answered the phone screwed up the account closure and I had to visit 5 more times (each with the person in the bank just calling into support) to get half of their damage resolved. I’m all for holding higher expectations for Robinhood—- they have an opportunity to make finance less scummy and are failing in many ways—- but it’s incredibly easy to get away with fraud at _any_ financial institution.
- cortesoft 6y ago
  The fact that they were able to even call support is what is different.
rch 6y ago
Is SMS still the only 2FA option on Robinhood? That seems behind the times.
- noradbase 6y ago
  No, it works with authentication token generator apps too
  - CameronNemo 6y ago
    Really? I saw no options on the website. Do I need to use the mobile app to set that up?
zenexer 6y ago
Here's a particularly interesting bit: > Rao said he had previously set up two-factor authentication to access his account, and Bagheri said she’s certain her Robinhood password is unique from all others, including her email. Neither believed they had been duped by phishing scams or malware. Both said they use the same email for Robinhood and other accounts, and that only Robinhood has been affected. Usually, these situations can be at least partially blamed on credential stuffing, but claims such as these warrant further investigation. Credential stuffing isn't supposed to work if 2FA is properly configured, and phishing shouldn't work if something like TOTP is implemented correctly--although it quite often isn't.
- chimeracoder 6y ago
  > and phishing shouldn't work if something like TOTP is implemented correctly TOTP codes can be phished. Hardware-based 2FA is a different matter, but SMS and TOTP 2FA doesn't fully protect against phishing.
  - formercoder 6y ago
    Only for high value targets right? Takes some work to spoof.
    - strombofulous 6y ago
      Typically this takes enough work that it has to be at least somewhat targeted but even some rando with just a few thousand dollars in their account would probably be a large enough target because it doesn't take super long
    - chimeracoder 6y ago
      Depending on the method, it doesn't have to be targeted to the user, just to the platform. For a platform like Robin Hood, most accounts contain enough money that even one account could pay off for the effort.
    - bawolff 6y ago
      No. phising sms/totp tokens works the same as normal phising. You need U2F to protect against phising. The complex attack you are probably thinking of is sim swapping which is a bit different than phising.
alexeiz 6y ago
Paywalled link. Here's the full text: It took Soraya Bagheri a day to learn that 450 shares of Moderna Inc. had been liquidated in her Robinhood account and that $10,000 in withdrawals were pending. But after alerting the online brokerage to what she believed was a theft in progress, she received a frustrating email. The firm wrote it would investigate and respond within “a few weeks.” Now her money is gone. Bagheri is among five Robinhood customers who recounted similar experiences to Bloomberg News, saying they’ve been left in limbo in recent weeks after someone sold their investments and withdrew funds. Because the wildly popular app has no emergency phone number, some said they tried in vain to intervene, only to watch helplessly as their money vanished. “A limited number of customers appear to have had their Robinhood account targeted by cyber criminals because of their personal email account (that which is associated with their Robinhood account) being compromised outside of Robinhood,” a spokesman for the company said in an email. “We’re actively working with those impacted to secure their accounts.” The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said. SEC, Finra Bagheri, a Washington attorney, and three other Robinhood users said they also contacted authorities including the Securities and Exchange Commission and the Financial Industry Regulatory Authority. Two of those customers said they have heard back from an official at the SEC seeking more information. Finra and the SEC declined to comment. Robinhood, founded seven years ago and based in Menlo Park, California, has exploded in popularity this year as millions of Americans stuck at home -- including throngs of millennials -- look to make some money during a pandemic that has sent stock prices swinging. But the no-fee brokerage app has also attracted consumer complaints, with novice investors confused by the vagaries of stock options and margin loans. Now, even though the firm said this year that it has more than doubled its customer-service team, clients complain they’re struggling to get quick help when their funds are disappearing. “They don’t have a customer service line, which I’m quite shocked about,” Bagheri said. ‘Mental Stress’ Pruthvi Rao, a Chicago software engineer, said his account was hit on Oct. 6. His bet on Netflix Inc. was liquidated and $2,850 was soon withdrawn. He said he’s sent more than a dozen emails to Robinhood’s customer support address, and that he even tried messaging some of the brokerage’s executives on LinkedIn. “I’m in tremendous mental stress right now because this is all of my savings,” said Rao, 36, whose account was frozen by Robinhood in response to the fraudulent activity. He said Robinhood contacted him on Friday and unlocked the account after sending several emails late Thursday asking for help. Rao showed Bloomberg the same emailed response from Robinhood that Bagheri received. “We understand the sensitivity of your situation and will be escalating the matter to our fraud investigations team,” Robinhood customer service agents wrote them. “Please be aware that this process may take a few weeks, and the team working on your case won’t be able to provide constant updates.” Rao said he had previously set up two-factor authentication to access his account, and Bagheri said she’s certain her Robinhood password is unique from all others, including her email. Neither believed they had been duped by phishing scams or malware. Both said they use the same email for Robinhood and other accounts, and that only Robinhood has been affected. “Unfortunately, it’s a common occurrence that online accounts of monetary value are bought, sold and traded by cyber-criminals,” said Mark Arena, CEO of Intel 471, which monitors activities of digital criminals. “This shows the importance of people practicing common information-security hygiene such as not re-using the same password across multiple accounts and enabling two-factor authentication, which Robinhood supports.” Stock, Bitcoin They also said Robinhood’s online portal showed their money went to a recipient at Revolut, another popular financial-technology startup. London-based Revolut, which offers a money transfer and exchange app, expanded to the U.S. this year. “Revolut has been made aware of the issue and is investigating urgently,” a company spokesman said Friday in an email. Bill Hurley, who owns a metal-fabrication shop in Windsor, Connecticut, said he received notifications that stock and Bitcoin had been sold from his account on Sept. 21, and that $5,000 was transferred to Revolut accounts in two transactions. He said he emailed Robinhood for assistance while the transactions were pending but received none. “They’ve had more than enough time to deal with this,” he said. Hurley, 56, said he reached out to the SEC and heard back from a lawyer for the regulator, who asked for additional information on what had happened. After more than two weeks of emails seeking help from Robinhood, a customer support representative called him on Thursday, he said. — With assistance by Benjamin Bain, and William Turton
thrownaway954 6y ago
can someone explain to me why you would use RH over something like Fidelity who has 24/7/365 support and no commission trades? honestly the first thing i do when it comes to a service (especially financial) is see if they have a way in getting in touch with someone 24/7/365. i would rather pay to know i can call and talk to a human then save money. seems like these people lost dollars tripping over pennies. even if a trade cost $5 a trade, i would still pay it just to know i can reach someone.
- LeCow 6y ago
  RH keeps almost no tabs on options trading and is very cheap.
  - greyfox 6y ago
    what is meant here by "tabs" like records/logs?
    - ve55 6y ago
      They might mean that they approve users for it more easily and quickly than other brokerages. Logs are definitely kept (and in more locations than just RH).
  - beervirus 6y ago
    Everybody offers free trading nowadays.
    - colinmhayes 6y ago
      Etrade has fees on options. I assume others do too.
- raziel2701 6y ago
  RH has the best user interface experience on mobile. Charges no commissions on options and you get automatic deposits. So it has the smallest barrier to entry. Very straightforward to use, it's very simple and clean. Buy and trade stocks and puts and calls, no problem. Yes if you try more complex option strategies then RH starts to fall apart. But for the majority of people that are just tagging along from wallstreetbets or something like that, RH is the simplest way to get you in the stock market.
lovetocode 6y ago
Not surprised. I submitted a report and POC of an oauth2 vulnerability that they deemed as a low priority. Robinhood users are highly susceptible to phishing attacks. Even 2FA is vulnerable if the attacker is fast enough.
- CameronNemo 6y ago
  Can you explain the 2FA risk?
  - Xavdidtheshadow 6y ago
    Assuming they're talking about TOTP, the 6-digit codes that are valid for 30 seconds: If I'm fishing you and get you to type your password into fakegoogle.com, I'll try to use it with real google immediately. If they send me a 2FA error (and I've got a semi-sophisticated phishing operation) fakegoogle will show you a an input field for that 6 digit code (just like real google). Then I've got a few seconds to send that to $site as well. It's a tighter timing window, but it's likely at this point that I'm into your account. This sort of attack isn't possible with a hardware key, since it only works on the original domain (which presumably I don't control). Does that make sense?
    - im3w1l 6y ago
      Ah, I didn't know hardware keys are domain-bound that's cool. Do they open an encrypted tunnel directly to the server?
      - Xavdidtheshadow 6y ago
        Nope, no tunnel or anything. When you touch the yubikey, it does some math on-device and "types" out a long string that can be mathematically validated with the shared secret the site stored when you set it up. It's an open standard, so you can read all about it: https://webauthn.guide/ https://webauthn.guide/
    - CameronNemo 6y ago
Animats 6y ago
It's become an alien concept to online users that companies can be forced to comply with financial laws. But they can. Here's the FINRA complaint form.[1] Also, here's some FINRA arbitration information.[2] Online users are so used to being powerless, facing unreasonable EULAs, that most are unaware they can push back hard. FINRA has the authority to have brokerage employees fired and barred from the securities industry. So brokerages pay attention when a complaint comes in via FINRA. [1] https://www.finra.org/investors/have-problem/file-complaint/complaint-center https://www.finra.org/investors/have-problem/file-complaint/... [2] https://www.finra.org/arbitration-mediation/resolution-and-results-customers https://www.finra.org/arbitration-mediation/resolution-and-r...
- JackFr 6y ago
  This. A million times.
- Traster 6y ago
  I worry that /r/wallstreetbets has probably saturated those addreses.
- ampdepolymerase 6y ago
  As a reminder, despite having the word "authority" in its name, FINRA is a completely private organisation and does not directly answer to any legislative, judicial, or executive authority. https://nclalegal.org/2019/07/finra-is-a-double-delegation-disaster/ https://nclalegal.org/2019/07/finra-is-a-double-delegation-d...
  - fiberoptick 6y ago
    > does not directly answer to any legislative, judicial, or executive authority. This is patently false. The Securities and Exchange Commission accredits and oversees all national SROs.
    - deleted 6y ago
      [deleted]
    - 6y ago
ydlr 6y ago
Robinhood is playing a game it learned from banks. If I walk into a bank with a gun and demand money, everyone agrees I am robbing the bank. But if I walk into your bank and claim to be you, suddenly I am not robbing the bank. I am committing "identity theft," and the bank will take no responsibility and do as little as legally possible to help resolve the situation. It is a neat trick. Pass all the expense of being a victim of a crime down to your customers.
- cosmie 6y ago
  Same with credit cards. The banks/issuers get the benefit of advertising "no liability" to consumers for fraudulent transactions, yet ensure they're able to contractually shift as much of the cost onto the merchants that were ripped off, rather than eat it themselves[1]. [1] https://www.nerdwallet.com/article/credit-cards/merchants-victims-credit-card-fraud https://www.nerdwallet.com/article/credit-cards/merchants-vi...
- sharkweek 6y ago
  A few fun side notes about bank robberies. I used to be a bank teller and we were instructed under no uncertain terms to hand over whatever we had and enjoy a week of paid vacation to recover from any potential trauma suffered. The bank I worked for had a corporate security team who wouldn’t even stop their lunch break to review one isolated robbery, instead they’d look for serial cases, or occasionally assess how likely it was that it had any “inside job” elements if the robbery didn’t fall within standard profiles. The actual “vault” in most branches is barely bigger than a high school locker inside the room behind the big metal door. Most everything else kept behind that huge metal door is administrative or customer related documents (arguably worth more than the cash itself!). Lastly, about once a week, I was tasked with filling the ATMs for a branch that was in a downtown office building lobby. The ATMs were in a wall and had a little secret door that I’d access to audit the machines and count the money I’d refill them with. Each machine could hold 200k or so and there were two of them but there was no real clear way to get the $400,000 from our secured vault to the machines without armed security or something. In order to avoid having to order an escort every time, we’d just load the cash into a printer paper box and stealthily walk it across the lobby like I was just carrying actual printer paper (insert your federal reserve jokes here). It’d take 2-3 hours to audit and refill the machines, meaning I would have had a nice head start if I had the guts and gray morality to make a run for it.
miohtama 6y ago
Those liquidated sums are so small that Robinhood will pay it from their coffee budget. The larger problem is friendly fraud or claimed "hacks" where the owner hacked himself. Easy policy will attract more of these, like insurance fraud.
WalterBright 6y ago
> “A limited number of customers appear to have had their Robinhood account targeted by cyber criminals because of their personal email account (that which is associated with their Robinhood account) being compromised outside of Robinhood,” I refused to set up online access or email on my brokerage account, because of hackers. I do trades via a phone call, and my broker knows my voice. (This works because I do very little trading, as I practice buy and hold hold hold hold.)
- nichos 6y ago
  It wouldn't take much for a criminal to set it up on your behalf. I think you'd be better setting it up and not using it.
zepearl 6y ago
Robinhood (and other similar companies) is not a bank (not sure what it is registered as?). By not being a bank it doesn't have to implement all kind of security and operational measures (e.g. access limitations by its own employees, active data-transfer analysis, communication "firewalls" between departments, liability based on the degree of the IT-security which is implemented, etc...) that banks HAve to implement/adhere to => that's really A LOT of in/direct effort (therefore $) for both the initial implementation and the ongoing operations => I imagine that platforms like Robinhood (and similar) shrank ALL costs to the minimum, therefore the kind of problems reported in the article are in my opinion not unexpected. The most simple (to understand) IT-security guidelines worldwide (but still quite complicated to interpret, at least for me) are maybe the ones of the Monetary Authority of Singapore ("MAS"): https://www.mas.gov.sg/regulation/cyber-security https://www.mas.gov.sg/regulation/cyber-security They're high-level (as they should be - details are for lawyers & tribunals), but in the end they all scream to you a lot of <embedded> stuff about security. For example if you're (un/willingly) running an old version of Apache that has security bugs (and those bugs were fixed by some patch that you did not apply "timely") then you don't comply to the MAS guidelines therefore you'll be preemptively thrown out of their market, voilà. The adherence to these rules and the results of their controls must be confirmed yearly by a top-mgmt executive => if external audit discovers that that was false, and/or if later events discover that that was false then that/those executive/s will burn and/or you'll be thrown out of their market (all this is the result of the last ~20 years of regulations, which I personally think is generally more good than bad, but which is definitely painful for me to deliver hehe). I don't think that this level of <liability/control/regulation> is in place for Robinhood & Co. - not saying that such companies are bad, they're probably interesting from a certain point of view, but customers should be made more aware of the embedded risks.
WalterBright 6y ago
Be careful about making electronic payments. I once had the revenooers send me a dunning letter about non-payment of taxes. I sent them a copy of my cancelled check. Problem solved. I also had an electronic payment made for $700 to the utility company. They said they never got it, but my account was debited. They said take it up with your bank, the bank said take it up with the utility company. After quite a bit of wrangling, I finally demanded to the bank manager that the debit be labelled as "fraudulent" and it be clawed back. Wonder of wonders, this caused the utility company to magically find the money. Now I send them paper checks. I also pay my credit card with paper checks, as one time they moved the decimal point over two places (!), and the cancelled check saved me a * lot* of hassle.
- ThePowerOfFuet 6y ago
  A digitally-signed (by the bank) copy of the transaction would also suffice instead of a check. Decimal places can't shift with electronic payments. All B2C debits (SDD Core) have the right to be reversed within 55 days for specific reasons; this can be done online by the account holder and they are instantly refunded. This is all across Europe, and has been for years now.
  - yencabulator 6y ago
    > Decimal places can't shift with electronic payments. [...] > This is all across Europe, and has been for years now. Only after living in USA for some time do you realize that many corporations here actually use cheap labor to read electronically submitted information, and then type it back into a computer. I've had my name misspelled on utility accounts where I signed up online, and damn sure did not misspell it like that. Yes, USA is stuck in the 70s.
    - scollet 6y ago
      A mentor of mine made the point IIRC: In eastern Germany they skipped checks for cards and it catapulted their payment systems to transcend the first world payment systems within the decade. Please correct me if I'm wrong. I think great depressions in tech yield necessary solutions; necessity and invention...
MattGaiser 6y ago
Canada's WealthSimple Trade has waiting periods for deposit and withdrawal, which gives them time to intervene if something is wrong.
camgunz 6y ago
How is Robinhood still a company? If you lose your customers millions of dollars, how has some regulator not shut you down?
- deleted 6y ago
  [deleted]
brooklyndude 6y ago
As someone who has been trading for decades, I’m stunned the SEC has not shut them down. Zero phone support. On a scale from 1-100. Support is a 0 for Robinhood. Ameritrade? I give them a 100+. They are amazing. And TOS trading platform is awesome. Sure keep a few $$$s in RH and enjoy the confetti, but for larger accounts, I would NOT be using RH.

vkou 6y ago

> The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said. I disagree. The Robinhood system includes their disbursement process. In this case, someone with access to a username and password managed to, without passing any of the other typical 2FA checks in finance (Calling the the account holder, snail-mail confirmation, actual 2FA tokens) managed to get Robinhood to wire them money. This is absolutely a compromise of their disbursement system. If a bank gave all my money to some random asshat that showed up to a branch with my debit card, the blame for that lies on my bank. This is typical liability laundering.

preinheimer 6y ago
I think it's important not to stop at simply offering security systems, but to require them when appropriate. Hey you've got $1000 in your account now, that's awesome! Let's set up 2FA to protect that money!
- spatley 6y ago
  more than that. For Robinhood to even allow initial account setup without robust (reda: no SMS) 2FA is bordering on criminal negligence. the only explanation to not doing that is feat that it would reduce their signup completion rate. Which fits Robinhood's prior behavior. This should be a class action at minimum, companies cannot shovel this kind of risk onto the general public.
  - thrill 6y ago
    Hyperbolic much? "Criminal negligence"? There are no laws requiring 2FA. Half the world thinks 2FA means SMS.
    - kube-system 6y ago
      There are laws that require financial services companies to take appropriate steps to protect customer data.
      - bigbubba 6y ago
        Sure, but those laws don't require 2FA (maybe they should) and Robinhood is far from the only institution that doesn't require it. A startling lot still think 'state your name, SSN/PIN/ or account number and birthday over the telephone' is sufficient.
        bostik 6y ago
        > Sure, but those laws don't require 2FA Funny that. The PSD2 regulations in Europe do.[0] The downside is that they don't mandate properly secure 2FA, so we have a mishmash of SMS, time-based tokens and whatever else passes for various banks under the regulations.[ß] 0: https://www.bankinfosecurity.com/psd2-authentication-requirements-implementation-hurdles-a-13086 https://www.bankinfosecurity.com/psd2-authentication-require... ß: My UK bank requires locally generated, time-based reader/app tokens, and has done so as long as I've lived here. My Finnish bank uses SMS.
    - medina 6y ago
      Not sure what you mean laws but there is certainly regulatory guidance that assessors will be using. The agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties. Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services. Account fraud and identity theft are frequently the result of single-factor (e.g., ID/password) authentication exploitation. Where risk assessments indicate that the use of single-factor authentication is inadequate, financial institutions should implement multifactor authentication, layered security, or other controls reasonably calculated to mitigate those risks. https://www.ffiec.gov/pdf/authentication_guidance.pdf https://www.ffiec.gov/pdf/authentication_guidance.pdf
  - Wowfunhappy 6y ago
    Enabling 2FA by default is probably a good idea, but I do believe quite strongly that users should be able to turn it off. You don't know the user's situation—maybe they don't have consistent access to a single phone, for instance—and if they actually use a strong and unique password, that should be sufficient. Additional factors are of course always safer, but everything is a trade-off between security and usability, and users should have control.
- isatty 6y ago
  From what I see on WSB, you can trade options without even fully verifying your email.
threatofrain 6y ago
If someone shows up with your debit card and pin, which is similar to knowing someone's account credentials, wouldn't the bank give you that cash up to some amount (without further verification) because it's insured anyway?
- nkrisc 6y ago
  > If a bank gave all my money A bank would not let you empty an account with just a debit card and PIN, assuming there was some non-trivial amount of money in there.
- greenshackle2 6y ago
  > up to some amount I think that's a pretty important detail. With my bank they could only get up to $1000 without further verification.
- vkou 6y ago
  1. It will give that cash up to some amount. It won't let the chap drain my entire account. 2. They will return my money if I reported the theft in a timely fashion. Robin hood seems to be doing neither.
  - threatofrain 6y ago
    For a singular transaction, a thief might limit themselves to something well under $10k. If a thief makes multiple withdrawals totaling $16k, which is over the FDIC insured amount, would a bank really just compensate you for that? Wouldn't that be out of the graciousness of the bank (or PR)?
    - nimih 6y ago
      In the US, as long as you notify the bank within 60 days of receiving a statement that has fraudulent transactions, your maximum liability is $500, and that goes down substantially if you notify the bank promptly of a lost/stolen card, or if the card was not lost in the first place[0]. So yes, the bank really would[1] just compensate you for that, provided you notice the fraud within 2-3 months of it occurring (depending on how quickly you get a bank statement). Edit: You may still be on the hook for overdraft fees from e.g. authorized payments, and it may take some time for the bank to indemnify you, which is why the conventional wisdom is that CCs are safer than debit cards from a fraud perspective. [0] https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-credit-atm-and-debit-cards https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr... [1] and is in fact legally required to: https://www.federalreserve.gov/boarddocs/caletters/2008/0807/08-07_attachment.pdf https://www.federalreserve.gov/boarddocs/caletters/2008/0807...
rdiddly 6y ago
Came here to say that. If your system relies on an external system like someone's email, and that gets breached, your system has been breached. You don't get to brag that the successful attack was indirect; most of them are.
viktorcode 6y ago
It seems to me that the damage is pretty limited for a cyber criminals with alleged ability to bypass 2FA. That low number of victims among millions of RobinHood customers is highly uncharacteristic for a critical security breach.
Terr_ 6y ago
> This is typical liability laundering. Relevant Mitchell & Webb comedy sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
XargonEnder 6y ago
Liability laundering is an awesome phrase that needs to be used more

bob1029 6y ago

This headline is a bit hyperbolic, but the lack of a direct phone line to someone who can help is why I've moved on to other brokerages. Robinhood worked well for bootstrapping my portfolio with free trades, but after a certain point it got big enough for me to worry about other factors like this.

cortesoft 6y ago
Also, the other brokerages have also moved to free trades, so it isn’t an advantage anymore.
cashewchoo 6y ago
Charles Schwab has native english speaker support just a phone call away (with no waiting in the handful of times I've used them, so far). And they were the first of the non-robinhood retail brokerages to break rank and offer 0-commission equity trades. Example: I accidentally deposited a check into my IRA once. I called and explained I wasn't sure what to do because 1) the check was post-tax money and 2) if I tried to fix it myself, would it count as an early withdrawal?. The guy picked up almost immediately, said yep lemme transfer you, the <something> department has a button for that. I got transferred, still to a native english speaker, who sorted me out. A couple days later it was all fixed in my account. 10/10. I do all my banking with them and if they offered a 2% cashback credit card, I'd move that to them too. Speaking of which, Citi (I have the doublecash) has been dreadful - my card # got stolen once, and they sent the new credit cards to my old address (that I still - for a bit longer - owned, thankfully) even after I specifically stressed, and confirmed multiple times, that I was 300 miles away from the address and if they sent them there, they'd sit in my porch for 1-2 weeks before I could get to them, and I would also not have a credit card to use. They reassure me, even getting a bit snippy at the end of the call, that they're sending them to the address I gave them (my parents' house) on the call. And since I'm such an important customer, they're overnighting the cards. Sure enough, the next day, I check my security camera and see a dang cardboard envelope that says CITICARDS all over it sitting on my old porch 300 miles away. So I call them up, explain that they did exactly what I asked them not to do, and if they could cancel those cards and try sending them again, because I don't have a credit card right now, and I'm trying to furnish and move into a new house and need to put about $10k of appliances purchases through the cards ASAP. They explain that, sorry, they need to wait a week or two (I was incensed and don't remember clearly at this point) before they can do anything. Luckily a week later when I rolled up to finish cleaning the old house, the cards were still there, albeit a bit damp. In the meantime I'd applied for a Blue Cash Preferred (which gets 6% cashback on instacart!) and they had it to me overnight and dropped it on the doorstep of my new house which was a new construction and not even in some systems yet as a valid address. Their support as been good so far, too, though I haven't had to call them but once so far. (Thanks for coming to my TED talk.)

simpsond 6y ago

At this point I think a more fitting name is: RobberBaron

vmception 6y ago

If I understand public opinion logic correctly: its the customers fault until one of the customers kill themselves, then its the brokerage fault. But for now we can make fun of the customers having their email compromised, while being slightly confused why Robinhood doesn't offer greater verification.

zamalek 6y ago
> while being slightly confused why Robinhood doesn't offer greater verification. It sounds like the bigger confusion is that Robinhood doesn't have a way to cancel withdrawals in flight. At least one of the customers caught the transaction with time to cancel, and couldn't reach a human in time to do that.

choppaface 6y ago

How different is this than getting your checking account number stolen? When that happened to me at Bank of America, I went physically into a branch where they just called support and we waited on hold for an hour. The person who eventually answered the phone screwed up the account closure and I had to visit 5 more times (each with the person in the bank just calling into support) to get half of their damage resolved. I’m all for holding higher expectations for Robinhood—- they have an opportunity to make finance less scummy and are failing in many ways—- but it’s incredibly easy to get away with fraud at _any_ financial institution.

cortesoft 6y ago
The fact that they were able to even call support is what is different.

rch 6y ago

Is SMS still the only 2FA option on Robinhood? That seems behind the times.

noradbase 6y ago
No, it works with authentication token generator apps too
- CameronNemo 6y ago
  Really? I saw no options on the website. Do I need to use the mobile app to set that up?

zenexer 6y ago

Here's a particularly interesting bit: > Rao said he had previously set up two-factor authentication to access his account, and Bagheri said she’s certain her Robinhood password is unique from all others, including her email. Neither believed they had been duped by phishing scams or malware. Both said they use the same email for Robinhood and other accounts, and that only Robinhood has been affected. Usually, these situations can be at least partially blamed on credential stuffing, but claims such as these warrant further investigation. Credential stuffing isn't supposed to work if 2FA is properly configured, and phishing shouldn't work if something like TOTP is implemented correctly--although it quite often isn't.

chimeracoder 6y ago
> and phishing shouldn't work if something like TOTP is implemented correctly TOTP codes can be phished. Hardware-based 2FA is a different matter, but SMS and TOTP 2FA doesn't fully protect against phishing.
- formercoder 6y ago
  Only for high value targets right? Takes some work to spoof.
  - strombofulous 6y ago
    Typically this takes enough work that it has to be at least somewhat targeted but even some rando with just a few thousand dollars in their account would probably be a large enough target because it doesn't take super long
  - chimeracoder 6y ago
    Depending on the method, it doesn't have to be targeted to the user, just to the platform. For a platform like Robin Hood, most accounts contain enough money that even one account could pay off for the effort.
  - bawolff 6y ago
    No. phising sms/totp tokens works the same as normal phising. You need U2F to protect against phising. The complex attack you are probably thinking of is sim swapping which is a bit different than phising.

alexeiz 6y ago

Paywalled link. Here's the full text: It took Soraya Bagheri a day to learn that 450 shares of Moderna Inc. had been liquidated in her Robinhood account and that $10,000 in withdrawals were pending. But after alerting the online brokerage to what she believed was a theft in progress, she received a frustrating email. The firm wrote it would investigate and respond within “a few weeks.” Now her money is gone. Bagheri is among five Robinhood customers who recounted similar experiences to Bloomberg News, saying they’ve been left in limbo in recent weeks after someone sold their investments and withdrew funds. Because the wildly popular app has no emergency phone number, some said they tried in vain to intervene, only to watch helplessly as their money vanished. “A limited number of customers appear to have had their Robinhood account targeted by cyber criminals because of their personal email account (that which is associated with their Robinhood account) being compromised outside of Robinhood,” a spokesman for the company said in an email. “We’re actively working with those impacted to secure their accounts.” The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said. SEC, Finra Bagheri, a Washington attorney, and three other Robinhood users said they also contacted authorities including the Securities and Exchange Commission and the Financial Industry Regulatory Authority. Two of those customers said they have heard back from an official at the SEC seeking more information. Finra and the SEC declined to comment. Robinhood, founded seven years ago and based in Menlo Park, California, has exploded in popularity this year as millions of Americans stuck at home -- including throngs of millennials -- look to make some money during a pandemic that has sent stock prices swinging. But the no-fee brokerage app has also attracted consumer complaints, with novice investors confused by the vagaries of stock options and margin loans. Now, even though the firm said this year that it has more than doubled its customer-service team, clients complain they’re struggling to get quick help when their funds are disappearing. “They don’t have a customer service line, which I’m quite shocked about,” Bagheri said. ‘Mental Stress’ Pruthvi Rao, a Chicago software engineer, said his account was hit on Oct. 6. His bet on Netflix Inc. was liquidated and $2,850 was soon withdrawn. He said he’s sent more than a dozen emails to Robinhood’s customer support address, and that he even tried messaging some of the brokerage’s executives on LinkedIn. “I’m in tremendous mental stress right now because this is all of my savings,” said Rao, 36, whose account was frozen by Robinhood in response to the fraudulent activity. He said Robinhood contacted him on Friday and unlocked the account after sending several emails late Thursday asking for help. Rao showed Bloomberg the same emailed response from Robinhood that Bagheri received. “We understand the sensitivity of your situation and will be escalating the matter to our fraud investigations team,” Robinhood customer service agents wrote them. “Please be aware that this process may take a few weeks, and the team working on your case won’t be able to provide constant updates.” Rao said he had previously set up two-factor authentication to access his account, and Bagheri said she’s certain her Robinhood password is unique from all others, including her email. Neither believed they had been duped by phishing scams or malware. Both said they use the same email for Robinhood and other accounts, and that only Robinhood has been affected. “Unfortunately, it’s a common occurrence that online accounts of monetary value are bought, sold and traded by cyber-criminals,” said Mark Arena, CEO of Intel 471, which monitors activities of digital criminals. “This shows the importance of people practicing common information-security hygiene such as not re-using the same password across multiple accounts and enabling two-factor authentication, which Robinhood supports.” Stock, Bitcoin They also said Robinhood’s online portal showed their money went to a recipient at Revolut, another popular financial-technology startup. London-based Revolut, which offers a money transfer and exchange app, expanded to the U.S. this year. “Revolut has been made aware of the issue and is investigating urgently,” a company spokesman said Friday in an email. Bill Hurley, who owns a metal-fabrication shop in Windsor, Connecticut, said he received notifications that stock and Bitcoin had been sold from his account on Sept. 21, and that $5,000 was transferred to Revolut accounts in two transactions. He said he emailed Robinhood for assistance while the transactions were pending but received none. “They’ve had more than enough time to deal with this,” he said. Hurley, 56, said he reached out to the SEC and heard back from a lawyer for the regulator, who asked for additional information on what had happened. After more than two weeks of emails seeking help from Robinhood, a customer support representative called him on Thursday, he said. — With assistance by Benjamin Bain, and William Turton

thrownaway954 6y ago

can someone explain to me why you would use RH over something like Fidelity who has 24/7/365 support and no commission trades? honestly the first thing i do when it comes to a service (especially financial) is see if they have a way in getting in touch with someone 24/7/365. i would rather pay to know i can call and talk to a human then save money. seems like these people lost dollars tripping over pennies. even if a trade cost $5 a trade, i would still pay it just to know i can reach someone.

LeCow 6y ago
RH keeps almost no tabs on options trading and is very cheap.
- greyfox 6y ago
  what is meant here by "tabs" like records/logs?
  - ve55 6y ago
    They might mean that they approve users for it more easily and quickly than other brokerages. Logs are definitely kept (and in more locations than just RH).
- beervirus 6y ago
  Everybody offers free trading nowadays.
  - colinmhayes 6y ago
    Etrade has fees on options. I assume others do too.
raziel2701 6y ago
RH has the best user interface experience on mobile. Charges no commissions on options and you get automatic deposits. So it has the smallest barrier to entry. Very straightforward to use, it's very simple and clean. Buy and trade stocks and puts and calls, no problem. Yes if you try more complex option strategies then RH starts to fall apart. But for the majority of people that are just tagging along from wallstreetbets or something like that, RH is the simplest way to get you in the stock market.

lovetocode 6y ago

Not surprised. I submitted a report and POC of an oauth2 vulnerability that they deemed as a low priority. Robinhood users are highly susceptible to phishing attacks. Even 2FA is vulnerable if the attacker is fast enough.

CameronNemo 6y ago
Can you explain the 2FA risk?
- Xavdidtheshadow 6y ago
  Assuming they're talking about TOTP, the 6-digit codes that are valid for 30 seconds: If I'm fishing you and get you to type your password into fakegoogle.com, I'll try to use it with real google immediately. If they send me a 2FA error (and I've got a semi-sophisticated phishing operation) fakegoogle will show you a an input field for that 6 digit code (just like real google). Then I've got a few seconds to send that to $site as well. It's a tighter timing window, but it's likely at this point that I'm into your account. This sort of attack isn't possible with a hardware key, since it only works on the original domain (which presumably I don't control). Does that make sense?
  - im3w1l 6y ago
    Ah, I didn't know hardware keys are domain-bound that's cool. Do they open an encrypted tunnel directly to the server?
    - Xavdidtheshadow 6y ago
      Nope, no tunnel or anything. When you touch the yubikey, it does some math on-device and "types" out a long string that can be mathematically validated with the shared secret the site stored when you set it up. It's an open standard, so you can read all about it: https://webauthn.guide/ https://webauthn.guide/
  - CameronNemo 6y ago

Animats 6y ago

It's become an alien concept to online users that companies can be forced to comply with financial laws. But they can. Here's the FINRA complaint form.[1] Also, here's some FINRA arbitration information.[2] Online users are so used to being powerless, facing unreasonable EULAs, that most are unaware they can push back hard. FINRA has the authority to have brokerage employees fired and barred from the securities industry. So brokerages pay attention when a complaint comes in via FINRA. [1] https://www.finra.org/investors/have-problem/file-complaint/complaint-center https://www.finra.org/investors/have-problem/file-complaint/... [2] https://www.finra.org/arbitration-mediation/resolution-and-results-customers https://www.finra.org/arbitration-mediation/resolution-and-r...

JackFr 6y ago
This. A million times.
Traster 6y ago
I worry that /r/wallstreetbets has probably saturated those addreses.
ampdepolymerase 6y ago
As a reminder, despite having the word "authority" in its name, FINRA is a completely private organisation and does not directly answer to any legislative, judicial, or executive authority. https://nclalegal.org/2019/07/finra-is-a-double-delegation-disaster/ https://nclalegal.org/2019/07/finra-is-a-double-delegation-d...
- fiberoptick 6y ago
  > does not directly answer to any legislative, judicial, or executive authority. This is patently false. The Securities and Exchange Commission accredits and oversees all national SROs.
  - deleted 6y ago
    [deleted]
  - 6y ago

ydlr 6y ago

Robinhood is playing a game it learned from banks. If I walk into a bank with a gun and demand money, everyone agrees I am robbing the bank. But if I walk into your bank and claim to be you, suddenly I am not robbing the bank. I am committing "identity theft," and the bank will take no responsibility and do as little as legally possible to help resolve the situation. It is a neat trick. Pass all the expense of being a victim of a crime down to your customers.

cosmie 6y ago
Same with credit cards. The banks/issuers get the benefit of advertising "no liability" to consumers for fraudulent transactions, yet ensure they're able to contractually shift as much of the cost onto the merchants that were ripped off, rather than eat it themselves[1]. [1] https://www.nerdwallet.com/article/credit-cards/merchants-victims-credit-card-fraud https://www.nerdwallet.com/article/credit-cards/merchants-vi...
sharkweek 6y ago
A few fun side notes about bank robberies. I used to be a bank teller and we were instructed under no uncertain terms to hand over whatever we had and enjoy a week of paid vacation to recover from any potential trauma suffered. The bank I worked for had a corporate security team who wouldn’t even stop their lunch break to review one isolated robbery, instead they’d look for serial cases, or occasionally assess how likely it was that it had any “inside job” elements if the robbery didn’t fall within standard profiles. The actual “vault” in most branches is barely bigger than a high school locker inside the room behind the big metal door. Most everything else kept behind that huge metal door is administrative or customer related documents (arguably worth more than the cash itself!). Lastly, about once a week, I was tasked with filling the ATMs for a branch that was in a downtown office building lobby. The ATMs were in a wall and had a little secret door that I’d access to audit the machines and count the money I’d refill them with. Each machine could hold 200k or so and there were two of them but there was no real clear way to get the $400,000 from our secured vault to the machines without armed security or something. In order to avoid having to order an escort every time, we’d just load the cash into a printer paper box and stealthily walk it across the lobby like I was just carrying actual printer paper (insert your federal reserve jokes here). It’d take 2-3 hours to audit and refill the machines, meaning I would have had a nice head start if I had the guts and gray morality to make a run for it.

miohtama 6y ago

Those liquidated sums are so small that Robinhood will pay it from their coffee budget. The larger problem is friendly fraud or claimed "hacks" where the owner hacked himself. Easy policy will attract more of these, like insurance fraud.

WalterBright 6y ago

> “A limited number of customers appear to have had their Robinhood account targeted by cyber criminals because of their personal email account (that which is associated with their Robinhood account) being compromised outside of Robinhood,” I refused to set up online access or email on my brokerage account, because of hackers. I do trades via a phone call, and my broker knows my voice. (This works because I do very little trading, as I practice buy and hold hold hold hold.)

nichos 6y ago
It wouldn't take much for a criminal to set it up on your behalf. I think you'd be better setting it up and not using it.

zepearl 6y ago

Robinhood (and other similar companies) is not a bank (not sure what it is registered as?). By not being a bank it doesn't have to implement all kind of security and operational measures (e.g. access limitations by its own employees, active data-transfer analysis, communication "firewalls" between departments, liability based on the degree of the IT-security which is implemented, etc...) that banks HAve to implement/adhere to => that's really A LOT of in/direct effort (therefore $) for both the initial implementation and the ongoing operations => I imagine that platforms like Robinhood (and similar) shrank ALL costs to the minimum, therefore the kind of problems reported in the article are in my opinion not unexpected. The most simple (to understand) IT-security guidelines worldwide (but still quite complicated to interpret, at least for me) are maybe the ones of the Monetary Authority of Singapore ("MAS"): https://www.mas.gov.sg/regulation/cyber-security https://www.mas.gov.sg/regulation/cyber-security They're high-level (as they should be - details are for lawyers & tribunals), but in the end they all scream to you a lot of <embedded> stuff about security. For example if you're (un/willingly) running an old version of Apache that has security bugs (and those bugs were fixed by some patch that you did not apply "timely") then you don't comply to the MAS guidelines therefore you'll be preemptively thrown out of their market, voilà. The adherence to these rules and the results of their controls must be confirmed yearly by a top-mgmt executive => if external audit discovers that that was false, and/or if later events discover that that was false then that/those executive/s will burn and/or you'll be thrown out of their market (all this is the result of the last ~20 years of regulations, which I personally think is generally more good than bad, but which is definitely painful for me to deliver hehe). I don't think that this level of <liability/control/regulation> is in place for Robinhood & Co. - not saying that such companies are bad, they're probably interesting from a certain point of view, but customers should be made more aware of the embedded risks.

WalterBright 6y ago

Be careful about making electronic payments. I once had the revenooers send me a dunning letter about non-payment of taxes. I sent them a copy of my cancelled check. Problem solved. I also had an electronic payment made for $700 to the utility company. They said they never got it, but my account was debited. They said take it up with your bank, the bank said take it up with the utility company. After quite a bit of wrangling, I finally demanded to the bank manager that the debit be labelled as "fraudulent" and it be clawed back. Wonder of wonders, this caused the utility company to magically find the money. Now I send them paper checks. I also pay my credit card with paper checks, as one time they moved the decimal point over two places (!), and the cancelled check saved me a * lot* of hassle.

ThePowerOfFuet 6y ago
A digitally-signed (by the bank) copy of the transaction would also suffice instead of a check. Decimal places can't shift with electronic payments. All B2C debits (SDD Core) have the right to be reversed within 55 days for specific reasons; this can be done online by the account holder and they are instantly refunded. This is all across Europe, and has been for years now.
- yencabulator 6y ago
  > Decimal places can't shift with electronic payments. [...] > This is all across Europe, and has been for years now. Only after living in USA for some time do you realize that many corporations here actually use cheap labor to read electronically submitted information, and then type it back into a computer. I've had my name misspelled on utility accounts where I signed up online, and damn sure did not misspell it like that. Yes, USA is stuck in the 70s.
  - scollet 6y ago
    A mentor of mine made the point IIRC: In eastern Germany they skipped checks for cards and it catapulted their payment systems to transcend the first world payment systems within the decade. Please correct me if I'm wrong. I think great depressions in tech yield necessary solutions; necessity and invention...

MattGaiser 6y ago

Canada's WealthSimple Trade has waiting periods for deposit and withdrawal, which gives them time to intervene if something is wrong.

camgunz 6y ago

How is Robinhood still a company? If you lose your customers millions of dollars, how has some regulator not shut you down?

deleted 6y ago
[deleted]

brooklyndude 6y ago

As someone who has been trading for decades, I’m stunned the SEC has not shut them down. Zero phone support. On a scale from 1-100. Support is a 0 for Robinhood. Ameritrade? I give them a 100+. They are amazing. And TOS trading platform is awesome. Sure keep a few $$$s in RH and enjoy the confetti, but for larger accounts, I would NOT be using RH.