5 ms·

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more m

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transaction for my account number in their nightly batch, the money just flies right out.

cortesoft 6y ago
> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.
- vosper 6y ago
  > The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.
  - deleted 6y ago
    [deleted]
  - cortesoft 6y ago
    Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
    - eigen 6y ago
      > I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money. Bank of New Zealand online banking doesnt seem that inconvenient, or different, from the American system. add payee, enter amount, click pay then confirm. https://www.bnz.co.nz/support/internet-banking/payments/adding-and-making-payments-to-payees https://www.bnz.co.nz/support/internet-banking/payments/addi...
      - cortesoft 6y ago
        Right, but my power bill, for example, is variable and I don’t want to have to manually pay it every month.
    - voltagex_ 6y ago
      In Australia, I can send money to just about any other Australian with a bank account using an email address or phone number - and it's mostly instant. The fallback is an account number and it'll take a couple of days to go through. There's no charge for this.
    - runarberg 6y ago
      In my experience it is really hard to deposit money into another persons account in America. In my home country in Europe, all I need is their account number and their personal id number and I can deposit straight from my online banking system. They don’t have to be in the same bank or nothing. In America this is so much more complicated. I have a hard time depositing money to my partner outside of my credit union’s calling hours, even though we literally share each other’s accounts.
      - kube-system 6y ago
        AFAIK, this is because criminals used to move money anonymously that way, and banks now have more of a legal responsibility to know where money is coming from. Get yourself formally added as an authorized user of the account and you won’t have this problem anymore.
    - 6y ago
  - indemnity 6y ago
    We still have junk like PoLi [1] which asks you for your internet banking credentials, and government departments use this. I'm looking at you, NZTA. Can't wait for the PaymentsNZ [2] effort to be fully implemented and widely adopted, so I can finally use real APIs to access this data, with low privilege throwaway tokens. [1] https://www.polipay.co.nz https://www.polipay.co.nz [2] https://www.apicentre.paymentsnz.co.nz https://www.apicentre.paymentsnz.co.nz
    - vosper 6y ago
      Oh yeah, PoLi is indeed junk, and I've also been surprised to see NZ Govt departments using it. I refuse to use PoLi, and I'll do a bank transfer or pay the debit card processing fee (if it's not exorbitant) instead.
- nicwolff 6y ago
  ACH fraud is not that simple to detect or revert. How soon would you know if $500 exited your checking account? If it's a small-business account, with most banks, you have 24 hours to report each debit that you want reversed. If it's a personal account, you may have up to a month. But the same merchant account can debit your account again, even while you are reversing their previous debits. You can't block them with a personal or basic small-business account, you have to upgrade to an account that you always keep $100K in. The banks' suggestion? Close the account, open a new one, and never give anyone the account and routing numbers. Never write a check from that account. Use the bank's web site to initiate bill payments – they'll get checks from the bank's account.
ncallaway 6y ago
It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plaid is a bad actor, or if they lose your password on accident, and your money is taken, the bank will disclaim all liability, and will not be obligated to make you whole. So, while it might be easier for money to flow out of your account due to ACH fraud, it'll be a lot harder to get that money to come back if it's due to your own password handling mistakes.
- thayne 6y ago
  It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.
  - Doxin 6y ago
    The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant. A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds. So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.
  - __float 6y ago
    Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.
bzbarsky 6y ago
Interesting note: you can probably call your bank up and request that the disallow ACH withdrawals from your account if triggered by some third party. You can still get ACH deposits. You can still use the bank's bill pay and they will send the payments over ACH (so you can push funds over ACH from the account). But someone else can't _pull_ funds over ACH from that account. Certainly the banks I use have this as an option, and it's useful sometimes. As long as you remember and don't try to pull yourself from one of your other accounts, of course.

cortesoft 6y ago

> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.

vosper 6y ago
> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.
- deleted 6y ago
  [deleted]
- cortesoft 6y ago
  Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
  - eigen 6y ago
    > I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money. Bank of New Zealand online banking doesnt seem that inconvenient, or different, from the American system. add payee, enter amount, click pay then confirm. https://www.bnz.co.nz/support/internet-banking/payments/adding-and-making-payments-to-payees https://www.bnz.co.nz/support/internet-banking/payments/addi...
    - cortesoft 6y ago
      Right, but my power bill, for example, is variable and I don’t want to have to manually pay it every month.
  - voltagex_ 6y ago
    In Australia, I can send money to just about any other Australian with a bank account using an email address or phone number - and it's mostly instant. The fallback is an account number and it'll take a couple of days to go through. There's no charge for this.
  - runarberg 6y ago
    In my experience it is really hard to deposit money into another persons account in America. In my home country in Europe, all I need is their account number and their personal id number and I can deposit straight from my online banking system. They don’t have to be in the same bank or nothing. In America this is so much more complicated. I have a hard time depositing money to my partner outside of my credit union’s calling hours, even though we literally share each other’s accounts.
    - kube-system 6y ago
      AFAIK, this is because criminals used to move money anonymously that way, and banks now have more of a legal responsibility to know where money is coming from. Get yourself formally added as an authorized user of the account and you won’t have this problem anymore.
  - 6y ago
- indemnity 6y ago
  We still have junk like PoLi [1] which asks you for your internet banking credentials, and government departments use this. I'm looking at you, NZTA. Can't wait for the PaymentsNZ [2] effort to be fully implemented and widely adopted, so I can finally use real APIs to access this data, with low privilege throwaway tokens. [1] https://www.polipay.co.nz https://www.polipay.co.nz [2] https://www.apicentre.paymentsnz.co.nz https://www.apicentre.paymentsnz.co.nz
  - vosper 6y ago
    Oh yeah, PoLi is indeed junk, and I've also been surprised to see NZ Govt departments using it. I refuse to use PoLi, and I'll do a bank transfer or pay the debit card processing fee (if it's not exorbitant) instead.
nicwolff 6y ago
ACH fraud is not that simple to detect or revert. How soon would you know if $500 exited your checking account? If it's a small-business account, with most banks, you have 24 hours to report each debit that you want reversed. If it's a personal account, you may have up to a month. But the same merchant account can debit your account again, even while you are reversing their previous debits. You can't block them with a personal or basic small-business account, you have to upgrade to an account that you always keep $100K in. The banks' suggestion? Close the account, open a new one, and never give anyone the account and routing numbers. Never write a check from that account. Use the bank's web site to initiate bill payments – they'll get checks from the bank's account.

ncallaway 6y ago

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plaid is a bad actor, or if they lose your password on accident, and your money is taken, the bank will disclaim all liability, and will not be obligated to make you whole. So, while it might be easier for money to flow out of your account due to ACH fraud, it'll be a lot harder to get that money to come back if it's due to your own password handling mistakes.

thayne 6y ago
It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.
- Doxin 6y ago
  The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant. A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds. So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.
- __float 6y ago
  Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.

bzbarsky 6y ago

Interesting note: you can probably call your bank up and request that the disallow ACH withdrawals from your account if triggered by some third party. You can still get ACH deposits. You can still use the bank's bill pay and they will send the payments over ACH (so you can push funds over ACH from the account). But someone else can't _pull_ funds over ACH from that account. Certainly the banks I use have this as an option, and it's useful sometimes. As long as you remember and don't try to pull yourself from one of your other accounts, of course.