4 ms·

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the cas

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plaid is a bad actor, or if they lose your password on accident, and your money is taken, the bank will disclaim all liability, and will not be obligated to make you whole. So, while it might be easier for money to flow out of your account due to ACH fraud, it'll be a lot harder to get that money to come back if it's due to your own password handling mistakes.

thayne 6y ago
It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.
- Doxin 6y ago
  The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant. A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds. So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.
- __float 6y ago
  Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.
  - Dma54rhs 6y ago
    And looks like author lives in Tokyo, not sure where is he from. The only time I pay with credit card and give power for others to pull automatically money from there is American companies. Otherwise I always do the wire or approve the é-bills manually.
  - mschuster91 6y ago
    > Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file. I have a business account at my bank, I can theoretically file a direct debit for as much money as I want against any SEPA-reachable bank account (in practice, most banks including mine limit that amount until you can prove, e.g. via presenting a bill, that this is a correct amount) - but if someone disputes it or, worse, files a legal complaint that causes police to investigate and I can't produce that mandate signed/authorized by the customer, I'm in extremely hot water.
    - closeparen 6y ago
      What if you produce the mandate signed by someone impersonating the customer? I imagine that is the typical case for ACH fraud. Not everyone has their own ACH connection; you would plug in a stolen account number at some merchant.
      - mschuster91 6y ago
        To be honest I don't know who is held liable if you can prove you have had a valid mandate, never had to dive that deep into the rabbit hole that is SEPA - and I guess the specific rules depend on the country you're in. I assume though that similar to CC fraud, one or both banks involved eat the loss.
- ncallaway 6y ago
  Oh, yea, no doubt that the payment side could also be a lot better. No arguments here. My only point is that on the payment side, the technology doesn't provide any security, but the legal framework does. But from the password management side, you're in a technology danger-zone for security, and the legal framework says "caveat emptor", so I think that one is the "worse" problem of the too. But, I agree, the payment side should be improved
- kalleboo 6y ago
  These things exist in other countries. E.g. with e-Invoicing in Sweden, your electricity company, credit card company etc send the bill to your bank, it shows up as a PDF in your online banking, and you confirm or deny it there. If you want it to be auto-confirmed (e.g. utility bills), that's a setting on the bank end of things, not the utility end of things.
  - chha 6y ago
    A similar thing exists in Norway. For auto-payments you have to register every agreement in the web portal of the bank*, and only after that can they withdraw money automatically. You can also set limits on how much they can withdraw per month, and if you suspect that something is fishy you can cancel the registration forcing them to send you an invoice electronically or on paper.
boring_twenties 6y ago
> You would report the fraud, and you would get your money back. There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?
- luckylion 6y ago
  Yes. At least in Germany (but I believe it's the same for all SEPA transactions), it's eight weeks for the simplified return where you just tell your bank "get that money back, please" and it's pretty much instantly credited to your account. That applies regardless of the legal status of the transaction. For non-authorized transactions, you have 13 months to recover the money. Since it will have cleared after eight weeks, the whole procedure takes considerably longer and most bank employees will not be too familiar with it. I had recently experienced that when somebody used my bank account to sign up for Netflix. I only caught it after three months (I mostly blame my bank for not providing a "new ACH transactions" report). Netflix wasn't helpful (and apparently has no interest in stopping this, their fraud detection allowed for creating an account with the legal name "f f", a German bank account and a none-German IP) and my bank immediately reversed the last two transactions (still within eight weeks window). The first one took about three months, but I don't know who or what was responsible for the delay.
- wiredfool 6y ago
  US ACH rules are 60 days for consumer accounts, and 3 for business accounts.

thayne 6y ago

It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.

Doxin 6y ago
The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant. A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds. So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.
__float 6y ago
Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.
- Dma54rhs 6y ago
  And looks like author lives in Tokyo, not sure where is he from. The only time I pay with credit card and give power for others to pull automatically money from there is American companies. Otherwise I always do the wire or approve the é-bills manually.
- mschuster91 6y ago
  > Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file. I have a business account at my bank, I can theoretically file a direct debit for as much money as I want against any SEPA-reachable bank account (in practice, most banks including mine limit that amount until you can prove, e.g. via presenting a bill, that this is a correct amount) - but if someone disputes it or, worse, files a legal complaint that causes police to investigate and I can't produce that mandate signed/authorized by the customer, I'm in extremely hot water.
  - closeparen 6y ago
    What if you produce the mandate signed by someone impersonating the customer? I imagine that is the typical case for ACH fraud. Not everyone has their own ACH connection; you would plug in a stolen account number at some merchant.
    - mschuster91 6y ago
      To be honest I don't know who is held liable if you can prove you have had a valid mandate, never had to dive that deep into the rabbit hole that is SEPA - and I guess the specific rules depend on the country you're in. I assume though that similar to CC fraud, one or both banks involved eat the loss.
ncallaway 6y ago
Oh, yea, no doubt that the payment side could also be a lot better. No arguments here. My only point is that on the payment side, the technology doesn't provide any security, but the legal framework does. But from the password management side, you're in a technology danger-zone for security, and the legal framework says "caveat emptor", so I think that one is the "worse" problem of the too. But, I agree, the payment side should be improved
kalleboo 6y ago
These things exist in other countries. E.g. with e-Invoicing in Sweden, your electricity company, credit card company etc send the bill to your bank, it shows up as a PDF in your online banking, and you confirm or deny it there. If you want it to be auto-confirmed (e.g. utility bills), that's a setting on the bank end of things, not the utility end of things.
- chha 6y ago
  A similar thing exists in Norway. For auto-payments you have to register every agreement in the web portal of the bank*, and only after that can they withdraw money automatically. You can also set limits on how much they can withdraw per month, and if you suspect that something is fishy you can cancel the registration forcing them to send you an invoice electronically or on paper.

boring_twenties 6y ago

> You would report the fraud, and you would get your money back. There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?

luckylion 6y ago
Yes. At least in Germany (but I believe it's the same for all SEPA transactions), it's eight weeks for the simplified return where you just tell your bank "get that money back, please" and it's pretty much instantly credited to your account. That applies regardless of the legal status of the transaction. For non-authorized transactions, you have 13 months to recover the money. Since it will have cleared after eight weeks, the whole procedure takes considerably longer and most bank employees will not be too familiar with it. I had recently experienced that when somebody used my bank account to sign up for Netflix. I only caught it after three months (I mostly blame my bank for not providing a "new ACH transactions" report). Netflix wasn't helpful (and apparently has no interest in stopping this, their fraud detection allowed for creating an account with the legal name "f f", a German bank account and a none-German IP) and my bank immediately reversed the last two transactions (still within eight weeks window). The first one took about three months, but I don't know who or what was responsible for the delay.
wiredfool 6y ago
US ACH rules are 60 days for consumer accounts, and 3 for business accounts.