6 ms·

To allow someone a direct deposit they should only need your name and bank account numbers. You shouldn't be giving them access with things like your password.

gruez 5y ago
Giving them your name/account number is all that's needed for someone to withdraw from your account. That's how gyms work. They just require your account number and/or a void check (which has your account number). They don't need you to sign into your bank account.
- chrisseaton 5y ago
  I don't think any responsible bank would let you withdraw using just an account number. What kind of security would that be? My bank certainly doesn't - allowing a debit requires me to authorise via 2FA - they obviously can't just take money.
  - gruez 5y ago
    >I don't think any responsible bank would let you withdraw using just an account number What do you think a check is? It's a piece of paper with your account number, who to pay, and how much. There's a signature field, but it's not checked too closely (I don't think my bank even asked for a signature sample when opening my account) and signatures are trivial to forge.
    - chrisseaton 5y ago
      > What do you think a check is? My bank doesn't give me a cheque book any more - haven't see a person use a cheque in about a decade. I can't believe they'd let someone cash a random cheque with no authorisation.
      - kylebyproxy 5y ago
        Just guessing by "cheque", are you outside the US? The checking system & ACH might be more of a US-centric phenomenon. It's been busted forever, but it's just how we do things around here.
        CRConrad 5y ago
        > It's been busted forever, but it's just how we do things around here. Which is why the rest of the developed world wonders: So why don't you stop that and catch up to, say, the 1990s?
      - easton 5y ago
        I do that when people send me money for birthdays once a year. Stick the check in the atm, i get money and the person wasn’t asked.
        greenyoda 5y ago
        My bank allows me to deposit a check just by photographing it with their smartphone app. No more visits to ATMs needed.
  - kylecordes 5y ago
    This is every bank in the United States. Our payment infrastructure ... has some legacy features.
  - TuringNYC 5y ago
    >> I don't think any responsible bank would let you withdraw using just an account number. That is literally how checking works in the united states. You can withdraw money from a bank account if you have a routing number and bank account number and "permission." The permission could be a signed check, it could be an auto-pay ACH you set up by handing a paper form to someone, it could be a web-form you signed without looking over the fine-print. Most extractive companies (e.g., gyms, verizon) have so many fine print and so many lawyers that they can literally take anything from you without recourse. You'd spend tens of thousands in lawyer fees without getting the money back. You could go to the attorney general's office for your state. Good luck with that, unless its a common issue, you just have to eat the cost as part of being American. Or it could be nothing. In this case, its still on you to figure it out and get the money back in time.
    - KennyBlanken 5y ago
      My state prohibits gyms from requiring ACH exactly to prevent this sort of abuse. It doesn't stop them from trying, or structuring their fees. The gym industry is very predatory and it needs far more regulation. It should be noted that in the US, some banks will allow you to request a default ACH block/lock on your account, and I highly encourage you to ask for such.
    - jokethrowaway 5y ago
      That's not only a States thing. Direct debit works similarly in Europe. That said I haven't heard of companies or fraudsters abusing it
      - Symbiote 5y ago
        Direct Debit in Europe has strong guarantees in favour of the customer, e.g. reversing charges. "A no-questions-asked, fast and simple Refund procedure available within eight weeks of the debit date." Within 8 weeks of the charge, you just phone (or otherwise) your bank and ask them to undo the charge.
      - CRConrad 5y ago
        > That's not only a States thing. Direct debit works similarly in Europe. Maybe it still works that way in some parts of Europe, but in others it has been changed to work differently, or doesn't exist anymore and has been replaced by other systems, depending on how you want to put it.
  - sumedh 5y ago
    > I don't think any responsible bank would let you withdraw using just an account number. It happens in Australia as, just fill up a direct debit form which has the client's name, account number and sign.
    - worthless-trash 5y ago
      Are you talking about the paper forms you find at banks, because they dont work that way.
      - sumedh 5y ago
        I got the form from the rental agency which directly debits from my bank account for the rent.
- Hamuko 5y ago
  - emteycz 5y ago
    There is a similar thing in EU but it's very regulated (though all processes are very lengthy and paper-heavy) and used for paying utilities etc, not gym.
  - lostlogin 5y ago
    No, you can do it in New Zealand too. I’m so weirded out by it that I just pay these things manually, so have never actually filled in the form that allows it.
  - jdkenney 5y ago
    It’s the same in Canada. I had to setup direct withdrawal for a strata (condo) fee by visiting my strata’s bank with a “blank cheque” (print out of a .png from my own bank’s website, trivially forged). The teller had already set up the monthly withdrawal before I reminded her she forgot to even check my ID! It gets worse too - once I moved and wanted the withdrawals to stop, my own bank claimed there was no way they could stop them, only the withdrawing bank could cancel it. Of course I wasn’t a signer on the strata account as I was no longer a resident, so was completely reliant on them to stop. Legacy features doesn’t even begin cover it. Those people that keep all their money under their mattress aren’t quite as insane as you might think.
  - ars 5y ago
    It's a carryover from before the internet. It still exists because it's still used. You might enjoy looking at how things were done before the internet existed, because all the stuff that you do with the internet also was done before just in a different way.
  - commandlinefan 5y ago
    > fucking crazy It’s true though. This was essentially the plot of “catch me if you can”.
  - KennyBlanken 5y ago
- worthless-trash 5y ago
  This is not the case in the rest of the world.
- jjk166 5y ago
  Honestly it's absurd that that we have two distinct numbers (account and routing) but you always use both, they don't change, and they are good for both deposits and withdrawals. It would be so easy to only require an account number for deposits and to have a unique routing number for each withdrawal. Maybe for convenience you have some fraction of your assigned routing numbers be good for repeat withdrawals but only for the amount and frequency specified for the first instance. Thus you can hand out your bank account number to anyone without concern, and they can give you money easily, but only those who you legitimately desire to pay can take money from you and their opportunity for abuse is limited, and all the infrastructure remains relatively unchanged.
midasuni 5y ago
I assume checks in the USA have the equivalent of sort code and account number printed on them (as well as name of the account holder) like they used to in the U.K.?
- kube-system 5y ago
  Checks in the US have two numbers; the number that identifies the bank, and the account number. That’s all you need to transfer money between bank accounts in the US.

gruez 5y ago

Giving them your name/account number is all that's needed for someone to withdraw from your account. That's how gyms work. They just require your account number and/or a void check (which has your account number). They don't need you to sign into your bank account.

chrisseaton 5y ago
I don't think any responsible bank would let you withdraw using just an account number. What kind of security would that be? My bank certainly doesn't - allowing a debit requires me to authorise via 2FA - they obviously can't just take money.
- gruez 5y ago
  >I don't think any responsible bank would let you withdraw using just an account number What do you think a check is? It's a piece of paper with your account number, who to pay, and how much. There's a signature field, but it's not checked too closely (I don't think my bank even asked for a signature sample when opening my account) and signatures are trivial to forge.
  - chrisseaton 5y ago
    > What do you think a check is? My bank doesn't give me a cheque book any more - haven't see a person use a cheque in about a decade. I can't believe they'd let someone cash a random cheque with no authorisation.
    - kylebyproxy 5y ago
      Just guessing by "cheque", are you outside the US? The checking system & ACH might be more of a US-centric phenomenon. It's been busted forever, but it's just how we do things around here.
      - CRConrad 5y ago
        > It's been busted forever, but it's just how we do things around here. Which is why the rest of the developed world wonders: So why don't you stop that and catch up to, say, the 1990s?
    - easton 5y ago
      I do that when people send me money for birthdays once a year. Stick the check in the atm, i get money and the person wasn’t asked.
      - greenyoda 5y ago
        My bank allows me to deposit a check just by photographing it with their smartphone app. No more visits to ATMs needed.
- kylecordes 5y ago
  This is every bank in the United States. Our payment infrastructure ... has some legacy features.
- TuringNYC 5y ago
  >> I don't think any responsible bank would let you withdraw using just an account number. That is literally how checking works in the united states. You can withdraw money from a bank account if you have a routing number and bank account number and "permission." The permission could be a signed check, it could be an auto-pay ACH you set up by handing a paper form to someone, it could be a web-form you signed without looking over the fine-print. Most extractive companies (e.g., gyms, verizon) have so many fine print and so many lawyers that they can literally take anything from you without recourse. You'd spend tens of thousands in lawyer fees without getting the money back. You could go to the attorney general's office for your state. Good luck with that, unless its a common issue, you just have to eat the cost as part of being American. Or it could be nothing. In this case, its still on you to figure it out and get the money back in time.
  - KennyBlanken 5y ago
    My state prohibits gyms from requiring ACH exactly to prevent this sort of abuse. It doesn't stop them from trying, or structuring their fees. The gym industry is very predatory and it needs far more regulation. It should be noted that in the US, some banks will allow you to request a default ACH block/lock on your account, and I highly encourage you to ask for such.
  - jokethrowaway 5y ago
    That's not only a States thing. Direct debit works similarly in Europe. That said I haven't heard of companies or fraudsters abusing it
    - Symbiote 5y ago
      Direct Debit in Europe has strong guarantees in favour of the customer, e.g. reversing charges. "A no-questions-asked, fast and simple Refund procedure available within eight weeks of the debit date." Within 8 weeks of the charge, you just phone (or otherwise) your bank and ask them to undo the charge.
    - CRConrad 5y ago
      > That's not only a States thing. Direct debit works similarly in Europe. Maybe it still works that way in some parts of Europe, but in others it has been changed to work differently, or doesn't exist anymore and has been replaced by other systems, depending on how you want to put it.
- sumedh 5y ago
  > I don't think any responsible bank would let you withdraw using just an account number. It happens in Australia as, just fill up a direct debit form which has the client's name, account number and sign.
  - worthless-trash 5y ago
    Are you talking about the paper forms you find at banks, because they dont work that way.
    - sumedh 5y ago
      I got the form from the rental agency which directly debits from my bank account for the rent.
Hamuko 5y ago
- emteycz 5y ago
  There is a similar thing in EU but it's very regulated (though all processes are very lengthy and paper-heavy) and used for paying utilities etc, not gym.
- lostlogin 5y ago
  No, you can do it in New Zealand too. I’m so weirded out by it that I just pay these things manually, so have never actually filled in the form that allows it.
- jdkenney 5y ago
  It’s the same in Canada. I had to setup direct withdrawal for a strata (condo) fee by visiting my strata’s bank with a “blank cheque” (print out of a .png from my own bank’s website, trivially forged). The teller had already set up the monthly withdrawal before I reminded her she forgot to even check my ID! It gets worse too - once I moved and wanted the withdrawals to stop, my own bank claimed there was no way they could stop them, only the withdrawing bank could cancel it. Of course I wasn’t a signer on the strata account as I was no longer a resident, so was completely reliant on them to stop. Legacy features doesn’t even begin cover it. Those people that keep all their money under their mattress aren’t quite as insane as you might think.
- ars 5y ago
  It's a carryover from before the internet. It still exists because it's still used. You might enjoy looking at how things were done before the internet existed, because all the stuff that you do with the internet also was done before just in a different way.
- commandlinefan 5y ago
  > fucking crazy It’s true though. This was essentially the plot of “catch me if you can”.
- KennyBlanken 5y ago
worthless-trash 5y ago
This is not the case in the rest of the world.
jjk166 5y ago
Honestly it's absurd that that we have two distinct numbers (account and routing) but you always use both, they don't change, and they are good for both deposits and withdrawals. It would be so easy to only require an account number for deposits and to have a unique routing number for each withdrawal. Maybe for convenience you have some fraction of your assigned routing numbers be good for repeat withdrawals but only for the amount and frequency specified for the first instance. Thus you can hand out your bank account number to anyone without concern, and they can give you money easily, but only those who you legitimately desire to pay can take money from you and their opportunity for abuse is limited, and all the infrastructure remains relatively unchanged.

midasuni 5y ago

I assume checks in the USA have the equivalent of sort code and account number printed on them (as well as name of the account holder) like they used to in the U.K.?

kube-system 5y ago
Checks in the US have two numbers; the number that identifies the bank, and the account number. That’s all you need to transfer money between bank accounts in the US.