8 ms·

Banks help scammers with their bad UI

96 points by ZainRiz 6y ago

ayende 6y ago
Banks are required, by law, to make funds available for checks within a few days. Marking the funds as unavailable would cause great issue for people using checks. For example, a rent check would only be good on six months? Who would accept this? The law was initially written to protect consumers from having their money unavailable
- thibautg 6y ago
  They could show it in their UI: - Pending - Pending with funds available - Cleared
  - kenjackson 6y ago
    Exactly. A check from my dad or my employer -- I'll spend that money as soon as its available. The check from the Nigerian prince -- I'll wait until Cleared before I send the money.
  - LurkersWillLurk 6y ago
    The other problem with this approach is that some proportion of perfectly legitimate funds likely will remain in pending for an inordinate amount of time, which dilutes the strength of the indicator in the first place.
    - kenjackson 6y ago
      Not necessarily. In most cases people won't check the status. As noted in the story the sister actually checked because there was some suspicion. In this case she would have paid more attention to the status and possibly could have said, "its still in pending... can't transfer yet". Of course the scammer would have a well-rehearsed reply, but it at least moves the level of suspicion up a notch.
      - NovemberWhiskey 6y ago
        So let's say banks do display 'funds available, but subject to recall if check cannot be collected'. A year later, the internet will have thousands of threads on various sites with people complaining that their (real, legitimate) paychecks still show the indication weeks after depositing. People who are so wishful-thinking that they think someone is paying them a 10% commission to deposit a check will still be wishful-thinking, and will continue to accept statements like "this is normal, you'll see it all over the internet" at face value.
        hakfoo 6y ago
        Perhaps that would be the sort of customer dissatisfaction that would move the needle to something less Rube Goldbergish. As I understand it, there is literally not a "transaction complete" message in the ACH protocol. After enough days without hearing an exception, you assume it went though. U suspect this comes to the implementation model-- since it's so much based on batch files and potentially offline processing at the destination bank, they probably don't want the overhead of composing and returning a success response for the 95% of transactions that behave normally.
- alistairSH 6y ago
  The real answer is to reform how checks are processed. With the interconnectivity that exists between banks today, there is zero reason (other than laziness on the part of banks) to have a delay of weeks or months to confirm funds availability.
WilTimSon 6y ago
> Chase customer support had one clarification to make. I'd originally said it might take, weeks for the check to clear, but the explained it could actually take more than six months. And you'll have no idea when that magic moment occurs. Good lord, I had no idea this is how bad things are. Haven't used checks in a long time and happy I haven't. The privacy trade-off for cards is concerning but the convenience is hard to give up.
- morpheuskafka 6y ago
  > privacy trade-off for cards A check literally has your full address and bank account number on it.. doesn't get much worse for privacy.
  - techsupporter 6y ago
    Back when checks were a lot more prevalent, some people would list a PO Box on their checks, either out of privacy or necessity (mail service didn’t go to their street). I was one of the people who did it for privacy, using the box my small business received mail at. Around the late 90s, a whole lot of places stopped accepting checks with a PO Box address printed on them, ostensibly due to “fraud concerns” (it was really that the government offices that do debt collection for “hot” checks wouldn’t accept non-physical addresses). There’s not really a point to this story, I suppose, except that privacy has always been hard to maintain.
  - notRobot 6y ago
    > check literally has your full address Really? I assume you're talking about the US? Because that's certainly not the case in many other countries that I have worked/lived in.
    - morpheuskafka 6y ago
      Yeah, I don't know if it is an absolute requirement (probably not) but all the checks I have been issued by the bank and almost all the ones I have received from others have it. For personal checks, I think the store usually checks that the address matches your photo ID--for corporate checks the address is usually just a P.O. Box. I think the address is also used to look up people in the check acceptance risk system (certegy, chexsystems, etc).
LurkersWillLurk 6y ago
I'm sorry to say but this isn't a Chase specific problem. Chase is required by law to make the funds available after a couple days, just like all other banks. The OP's sister fell for a common scam that's been going on since forever, and Zelle warns you fairly explicitly to never send money to a stranger or else things like this could happen. Of course Chase isn't going to eat a $3,000 loss because a customer fell for a common scam and ignored Zelle's warnings and didn't even do a cursory look through the bank agreement which clearly explains how checks clear. The difference between the other services "taking responsibility" and "not shaking down their customers" and Chase Bank is that unlike a checking account, credit card transactions can be easily reversed. Once you send the money through Zelle, it's gone. That your sister was victimized is clearly terrible, but it doesn't change the fact that her negligence caused her bank to lose 3 grand, and your father is liable as a cosigner as well. She is reasonably expected to recognize that Craigslist arrangement as too good to be true, and she ignored Zelle's admonitions not to send money to strangers.
- kenjackson 6y ago
  It depends on what the definition of stranger is. At the point she sent the money she had entered a relationship as an employee. Granted, it was a new relationship, I think it is easy for most people to now think of this entity as no longer a stranger -- even though they probably should. As noted in a below thread, the solution can still be to make the funds available, but to note clearly that the actual funds may not really be there. As you note, this scam has been going on forever, and some simple UI changes could make it harder to execute, while not hindering the common case (non-scam).
- Liron 6y ago
  Ok but part of the reason people lower their skepticism is because they see their bank’s UI heavily implying that the check has cleared. The main point of the post is that banks’ UI about whether a check has cleared is very misleading and really needs to be changed.
  - fakedang 6y ago
    Somebody who uses/deals with cheques in this day and age though kinda deserves it in my books. Cheques are themselves bad UX today.
kenjackson 6y ago
Coincidentally, my son was recently scammed on Roblox with a similar scam. And what's crazy is that Roblox seems unwilling to fix it, or to rectify the situation, even though the complete paper trail is in their system and all of the currency/items are within their system. They could easily reverse it, like credit card companies do. It's amazing how little effort these institutions put into trying minimize damage to good customers.
- srtjstjsj 6y ago
  How much do you spend on roblox pay their staff to work on this?
  - kenjackson 6y ago
    How much money does Roblox make from these scams? Probably a lot due to customers having to re-buy their inventory.
adrian_mrd 6y ago
Whilst the suggested UI fixes will help, this seems less of a UI problem, and more of a checks are inherently insecure problem. Most western countries have moved away from checks - with the exception of bank cheques or money orders for certain, specific cases.
- kochthesecond 6y ago
  I am 33 and have never even seen a cheque, nor would I have any idea what to do with it. I am in EU though.
  - xnyan 6y ago
    32 in the US and I still have to write fucking checks, most commonly for paying rent. No landlord wants to eat the ~3% fee for taking a credit card. The other day I had to pay for some trees to be cut down and pruned in my yard, cost a couple grand which I am never going to have in cash on hand - same deal, the landscaper does not want to pay the 3% fee so it’s cash or check only.
    - perl4ever 6y ago
      This. The other thing is property taxes, in my area they generally let you pay by modern methods but charge ridiculous fees, so a paper check is the only sensible method.
    - srtjstjsj 6y ago
      That's fine. Checks are risky for the receivers not the sender.
    - ginko 6y ago
      Why would you ever involve a credit card processor in this? Can't you just do a wire transfer?
      - xnyan 6y ago
        Yeah, and it happens but wire transfers can be a real pain depending on the bank. And you need to get the account number of landlord, and now you don't have a simple way (the canceled check) of proving you paid rent. While less than ideal, checks often have the most upside, which is why they still get used. Another way of looking at it, a check is more or less a form of wire transfer using the ACH system. I just wish there was a way to remove the paper check aspect of it, in a way that is commonly accepted by private individuals + small business in addtion to big outfits.
tomca32 6y ago
This is such a common scam that I really think it should be taught in schools. Whenever you hear someone propose to give you a check in return for you depositing your cash directly somewhere, it is always a scam, always. There is no legitimate reason anyone would ever do this, and I've seen it happen multiple times to multiple people, and even to small charity organizations that almost went bankrupt because of this. We need some sort of anti-scam class in like high school or something. Just the ability to recognize the most common scams in the world would protect a lot of people.
- xnyan 6y ago
  The other huge bright red, klaxons-blazing warning sign is the overpaying part. There is literally no reason at all to overpay for something when you are writing a check. It’s a psychological trick, like the door-to-door sales trick of giving someone a bottle of soap so that the mark feels like they owe something to the salesperson/scammer (or they are getting one over on the scammer), just a ploy to exploit human emotion.
  - perl4ever 6y ago
    I bought a computer with a certified check that was too large once, and eventually I did get the store to take it, and promise a refund from their central office. I think it was months later and I had to call them up to get my refund, but it did actually work out. That was in the 90s and of course I would never do it again. It clearly was a well known red flag even back then.
- srtjstjsj 6y ago
  Civilization is built on trust. "Just stop trusting people" isn't a solution.
Liron 6y ago
When I saw the title, my first thought was that banks’ janky non-standard and often-changing login flows make it easier for sloppy phishing attacks to work.
danielfoster 6y ago
I’m sure similar scams existed long before the advent of online banking. I wonder what warnings, if any, existed back in the days of paper and pen? Bad checks were much more common decades ago and I think people were more wary. Younger people don’t have the same knowledge about checks. Banks are outdated in their assumptions of consumer knowledge. But I also think a certain level of common sense also applies here.
cnst 6y ago
This is really a problem with the US banking system as a whole, the check-prevalent culture where people are still willing to deal with such ancient financial instruments, plus the US society where people live paycheck-to-paycheck. When you do an ACH pull or a check deposit, it generally takes several days or even weeks for the transaction to clear. (But when you do an ACH push or Zelle, the transaction may be irreversible.) Would you be OK if your bank waited a week or two until clearing the check? Or the banks getting rid of the whole idea of personal checks?
jivings 6y ago
The real scandal here is that anyone is still using checks at all. Maybe we should be talking about why the US banking system is so far behind the rest of the developed world. I live in the EU and I don't think I've seen a check for about 15 years.
jszymborski 6y ago
UI? I'm still waiting for _any_ Canadian bank to offer 2fa.
btown 6y ago
Frankly no bank will display this data voluntarily, because in being transparent, it would gain a reputation as a less reliable place to deposit checks than other banks - customers would shoot the messenger. This is exactly the type of thing a “Surgeon General’s Warning” regulation/law could enforce, and sidestep the prisoner’s dilemma here. But absent regulation I doubt this will ever become common knowledge.

96 points by ZainRiz 6y ago

Banks are required, by law, to make funds available for checks within a few days. Marking the funds as unavailable would cause great issue for people using checks. For example, a rent check would only be good on six months? Who would accept this? The law was initially written to protect consumers from having their money unavailable

thibautg 6y ago
They could show it in their UI: - Pending - Pending with funds available - Cleared
- kenjackson 6y ago
  Exactly. A check from my dad or my employer -- I'll spend that money as soon as its available. The check from the Nigerian prince -- I'll wait until Cleared before I send the money.
- LurkersWillLurk 6y ago
  The other problem with this approach is that some proportion of perfectly legitimate funds likely will remain in pending for an inordinate amount of time, which dilutes the strength of the indicator in the first place.
  - kenjackson 6y ago
    Not necessarily. In most cases people won't check the status. As noted in the story the sister actually checked because there was some suspicion. In this case she would have paid more attention to the status and possibly could have said, "its still in pending... can't transfer yet". Of course the scammer would have a well-rehearsed reply, but it at least moves the level of suspicion up a notch.
    - NovemberWhiskey 6y ago
      So let's say banks do display 'funds available, but subject to recall if check cannot be collected'. A year later, the internet will have thousands of threads on various sites with people complaining that their (real, legitimate) paychecks still show the indication weeks after depositing. People who are so wishful-thinking that they think someone is paying them a 10% commission to deposit a check will still be wishful-thinking, and will continue to accept statements like "this is normal, you'll see it all over the internet" at face value.
      - hakfoo 6y ago
        Perhaps that would be the sort of customer dissatisfaction that would move the needle to something less Rube Goldbergish. As I understand it, there is literally not a "transaction complete" message in the ACH protocol. After enough days without hearing an exception, you assume it went though. U suspect this comes to the implementation model-- since it's so much based on batch files and potentially offline processing at the destination bank, they probably don't want the overhead of composing and returning a success response for the 95% of transactions that behave normally.
alistairSH 6y ago
The real answer is to reform how checks are processed. With the interconnectivity that exists between banks today, there is zero reason (other than laziness on the part of banks) to have a delay of weeks or months to confirm funds availability.

WilTimSon 6y ago

> Chase customer support had one clarification to make. I'd originally said it might take, weeks for the check to clear, but the explained it could actually take more than six months. And you'll have no idea when that magic moment occurs. Good lord, I had no idea this is how bad things are. Haven't used checks in a long time and happy I haven't. The privacy trade-off for cards is concerning but the convenience is hard to give up.

morpheuskafka 6y ago
> privacy trade-off for cards A check literally has your full address and bank account number on it.. doesn't get much worse for privacy.
- techsupporter 6y ago
  Back when checks were a lot more prevalent, some people would list a PO Box on their checks, either out of privacy or necessity (mail service didn’t go to their street). I was one of the people who did it for privacy, using the box my small business received mail at. Around the late 90s, a whole lot of places stopped accepting checks with a PO Box address printed on them, ostensibly due to “fraud concerns” (it was really that the government offices that do debt collection for “hot” checks wouldn’t accept non-physical addresses). There’s not really a point to this story, I suppose, except that privacy has always been hard to maintain.
- notRobot 6y ago
  > check literally has your full address Really? I assume you're talking about the US? Because that's certainly not the case in many other countries that I have worked/lived in.
  - morpheuskafka 6y ago
    Yeah, I don't know if it is an absolute requirement (probably not) but all the checks I have been issued by the bank and almost all the ones I have received from others have it. For personal checks, I think the store usually checks that the address matches your photo ID--for corporate checks the address is usually just a P.O. Box. I think the address is also used to look up people in the check acceptance risk system (certegy, chexsystems, etc).

LurkersWillLurk 6y ago

I'm sorry to say but this isn't a Chase specific problem. Chase is required by law to make the funds available after a couple days, just like all other banks. The OP's sister fell for a common scam that's been going on since forever, and Zelle warns you fairly explicitly to never send money to a stranger or else things like this could happen. Of course Chase isn't going to eat a $3,000 loss because a customer fell for a common scam and ignored Zelle's warnings and didn't even do a cursory look through the bank agreement which clearly explains how checks clear. The difference between the other services "taking responsibility" and "not shaking down their customers" and Chase Bank is that unlike a checking account, credit card transactions can be easily reversed. Once you send the money through Zelle, it's gone. That your sister was victimized is clearly terrible, but it doesn't change the fact that her negligence caused her bank to lose 3 grand, and your father is liable as a cosigner as well. She is reasonably expected to recognize that Craigslist arrangement as too good to be true, and she ignored Zelle's admonitions not to send money to strangers.

kenjackson 6y ago
It depends on what the definition of stranger is. At the point she sent the money she had entered a relationship as an employee. Granted, it was a new relationship, I think it is easy for most people to now think of this entity as no longer a stranger -- even though they probably should. As noted in a below thread, the solution can still be to make the funds available, but to note clearly that the actual funds may not really be there. As you note, this scam has been going on forever, and some simple UI changes could make it harder to execute, while not hindering the common case (non-scam).
Liron 6y ago
Ok but part of the reason people lower their skepticism is because they see their bank’s UI heavily implying that the check has cleared. The main point of the post is that banks’ UI about whether a check has cleared is very misleading and really needs to be changed.
- fakedang 6y ago
  Somebody who uses/deals with cheques in this day and age though kinda deserves it in my books. Cheques are themselves bad UX today.

kenjackson 6y ago

Coincidentally, my son was recently scammed on Roblox with a similar scam. And what's crazy is that Roblox seems unwilling to fix it, or to rectify the situation, even though the complete paper trail is in their system and all of the currency/items are within their system. They could easily reverse it, like credit card companies do. It's amazing how little effort these institutions put into trying minimize damage to good customers.

srtjstjsj 6y ago
How much do you spend on roblox pay their staff to work on this?
- kenjackson 6y ago
  How much money does Roblox make from these scams? Probably a lot due to customers having to re-buy their inventory.

adrian_mrd 6y ago

Whilst the suggested UI fixes will help, this seems less of a UI problem, and more of a checks are inherently insecure problem. Most western countries have moved away from checks - with the exception of bank cheques or money orders for certain, specific cases.

kochthesecond 6y ago
I am 33 and have never even seen a cheque, nor would I have any idea what to do with it. I am in EU though.
- xnyan 6y ago
  32 in the US and I still have to write fucking checks, most commonly for paying rent. No landlord wants to eat the ~3% fee for taking a credit card. The other day I had to pay for some trees to be cut down and pruned in my yard, cost a couple grand which I am never going to have in cash on hand - same deal, the landscaper does not want to pay the 3% fee so it’s cash or check only.
  - perl4ever 6y ago
    This. The other thing is property taxes, in my area they generally let you pay by modern methods but charge ridiculous fees, so a paper check is the only sensible method.
  - srtjstjsj 6y ago
    That's fine. Checks are risky for the receivers not the sender.
  - ginko 6y ago
    Why would you ever involve a credit card processor in this? Can't you just do a wire transfer?
    - xnyan 6y ago
      Yeah, and it happens but wire transfers can be a real pain depending on the bank. And you need to get the account number of landlord, and now you don't have a simple way (the canceled check) of proving you paid rent. While less than ideal, checks often have the most upside, which is why they still get used. Another way of looking at it, a check is more or less a form of wire transfer using the ACH system. I just wish there was a way to remove the paper check aspect of it, in a way that is commonly accepted by private individuals + small business in addtion to big outfits.

tomca32 6y ago

This is such a common scam that I really think it should be taught in schools. Whenever you hear someone propose to give you a check in return for you depositing your cash directly somewhere, it is always a scam, always. There is no legitimate reason anyone would ever do this, and I've seen it happen multiple times to multiple people, and even to small charity organizations that almost went bankrupt because of this. We need some sort of anti-scam class in like high school or something. Just the ability to recognize the most common scams in the world would protect a lot of people.

xnyan 6y ago
The other huge bright red, klaxons-blazing warning sign is the overpaying part. There is literally no reason at all to overpay for something when you are writing a check. It’s a psychological trick, like the door-to-door sales trick of giving someone a bottle of soap so that the mark feels like they owe something to the salesperson/scammer (or they are getting one over on the scammer), just a ploy to exploit human emotion.
- perl4ever 6y ago
  I bought a computer with a certified check that was too large once, and eventually I did get the store to take it, and promise a refund from their central office. I think it was months later and I had to call them up to get my refund, but it did actually work out. That was in the 90s and of course I would never do it again. It clearly was a well known red flag even back then.
srtjstjsj 6y ago
Civilization is built on trust. "Just stop trusting people" isn't a solution.

Liron 6y ago

When I saw the title, my first thought was that banks’ janky non-standard and often-changing login flows make it easier for sloppy phishing attacks to work.

danielfoster 6y ago

I’m sure similar scams existed long before the advent of online banking. I wonder what warnings, if any, existed back in the days of paper and pen? Bad checks were much more common decades ago and I think people were more wary. Younger people don’t have the same knowledge about checks. Banks are outdated in their assumptions of consumer knowledge. But I also think a certain level of common sense also applies here.

cnst 6y ago

This is really a problem with the US banking system as a whole, the check-prevalent culture where people are still willing to deal with such ancient financial instruments, plus the US society where people live paycheck-to-paycheck. When you do an ACH pull or a check deposit, it generally takes several days or even weeks for the transaction to clear. (But when you do an ACH push or Zelle, the transaction may be irreversible.) Would you be OK if your bank waited a week or two until clearing the check? Or the banks getting rid of the whole idea of personal checks?

jivings 6y ago

The real scandal here is that anyone is still using checks at all. Maybe we should be talking about why the US banking system is so far behind the rest of the developed world. I live in the EU and I don't think I've seen a check for about 15 years.

jszymborski 6y ago

UI? I'm still waiting for _any_ Canadian bank to offer 2fa.

btown 6y ago

Frankly no bank will display this data voluntarily, because in being transparent, it would gain a reputation as a less reliable place to deposit checks than other banks - customers would shoot the messenger. This is exactly the type of thing a “Surgeon General’s Warning” regulation/law could enforce, and sidestep the prisoner’s dilemma here. But absent regulation I doubt this will ever become common knowledge.