4 ms·

Is there anything as pay-in-only bank account?

While watching some clips about bank frauds/phishing long time ago etc. it was interesting to me that sometimes knowing your sort code and bank account is enough to withdraw money or create standing order on your account without your explicit permission. I vaguely remember in a documentary to show it is possible, hacker created a charity donation for a reporter who exposed his account number (sort code + account). Anyhow, I wonder is there anything as pay-in-only bank account? (excluding paypal/stripe and similar) So regardless you exposing an account -> money can go only in on direction. If does not exist, why banks have never done anything similar?

dcminter 6y ago
Sounds like you're from the UK; I think you're probably thinking of when Jeremy Clarkson gave out these details and a Direct Debit was set up on his account using them: https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc... However the Direct Debit guarantee allays most concerns one might have about this particular attack: https://www.directdebit.co.uk/DirectDebitExplained/pages/directdebitguarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/pages/dir... If one presumes that there are exceptions to the "pay-in-only" constraint then it will be vulnerable to fraud one way or another.
- NiceWayToDoIT 6y ago
  Spot on, UK. I was thinking no exceptions, except (I hope this does not defeat the purpose of previous no-exceptions :) ) in the case when you transfer money to another account to withdraw money. Let imagine that customer can set the rule, any type of larger transfer eg.£500 will trigger message and fraud detection algorithm. I think it is the Jeremy Clarkson one, interesting enough 12 years later, same issue not much technological improvement in the major banks.
villgax 6y ago
or a location & personal yubikey based payout
- NiceWayToDoIT 6y ago
  Can you explain location? and yubikey/code-key are in UK used for access, and if you want to authorize payment to new account, but will not protect you from standing order?
  - villgax 6y ago
    As in the bank can only perform transactions by physically bringing some device to a location maybe authenticate with stars/GPS satellites, magnetosphere readings or whatever. That way you have a solid control over any transaction that is supposed to take place against your account since you would be in-charge of the location

dcminter 6y ago

Sounds like you're from the UK; I think you're probably thinking of when Jeremy Clarkson gave out these details and a Direct Debit was set up on his account using them: https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud https://www.theguardian.com/money/2008/jan/07/personalfinanc... However the Direct Debit guarantee allays most concerns one might have about this particular attack: https://www.directdebit.co.uk/DirectDebitExplained/pages/directdebitguarantee.aspx https://www.directdebit.co.uk/DirectDebitExplained/pages/dir... If one presumes that there are exceptions to the "pay-in-only" constraint then it will be vulnerable to fraud one way or another.

NiceWayToDoIT 6y ago
Spot on, UK. I was thinking no exceptions, except (I hope this does not defeat the purpose of previous no-exceptions :) ) in the case when you transfer money to another account to withdraw money. Let imagine that customer can set the rule, any type of larger transfer eg.£500 will trigger message and fraud detection algorithm. I think it is the Jeremy Clarkson one, interesting enough 12 years later, same issue not much technological improvement in the major banks.

villgax 6y ago

or a location & personal yubikey based payout

NiceWayToDoIT 6y ago
Can you explain location? and yubikey/code-key are in UK used for access, and if you want to authorize payment to new account, but will not protect you from standing order?
- villgax 6y ago
  As in the bank can only perform transactions by physically bringing some device to a location maybe authenticate with stars/GPS satellites, magnetosphere readings or whatever. That way you have a solid control over any transaction that is supposed to take place against your account since you would be in-charge of the location