4 ms·

Question: are US banking really this dysfunctional? Where I'm from, a bank consortium already provided unified login services (while banks still have their own

Question: are US banking really this dysfunctional? Where I'm from, a bank consortium already provided unified login services (while banks still have their own websites, as a merchant you only need to integrate the consortium-provided APIs rather than using Plaid) simplifying things.

rglover 5y ago
Yes. Some banks still run COBOL behind the scenes here.
- yohannparis 5y ago
  running COBOL behind the scenes have nothing to do with an easy API access and a consortium for interbanking.
  - rmbyrro 5y ago
    Maybe they pointed out as an indication that some financial institutions in the US are not modern technologically speaking, and that may be a cause for lacking better APIs?
    - ericmay 5y ago
      That was probably the intention but I think that isn't a core reason. It's more about business/tech incentives around these APIs. The industry is more risk-averse, and frankly there isn't necessarily a great business case for doing integrations if you're a big bank because you don't want to be commoditized into "pipes" and then have to compete on low-margin products all the while the middle companies have better margins and skim off the top of you. At least on the consumer side. There's this meme that banks are technologically backwards and all that, and I don't think that is true or a good frame of reference to have. The scale, complexity, regulatory environment, and risk-aversion when something bad happens are far and away more relevant factors than technology is.
      - rmbyrro 5y ago
        I agree, but don't think the original comment deserves down voting. It's an acceptable argument. Might not hold water, though.
- haswell 5y ago
  For some systems, this is arguably a feature. Banks are rightly cautious about touching core transaction processing systems, systems that cost millions per minute when down. But the use of COBOL generally doesn’t extend to the consumer facing product, or the APIs that support those consumer facing experiences. Banks may be backwards, but the use of older languages is not one of the primary reasons.
  - quadcore 5y ago
    It makes me trust them more when they use old software that I never got to complain about.
- zinekeller 5y ago
  ... and I'm pretty sure a majority of banks here still runs COBOL, but it didn't stop them creating a consortium and simplifying things!
  - deleted 5y ago
    [deleted]
- paxys 5y ago
  What they run on their backend doesn't really matter. If they can provide a website with username/password login, they can have an OAuth layer as well. It isn't a technical problem but a business/priorities one.
codegeek 5y ago
"are US banking really this dysfunctional?" Yes very much. A lot of banks don't even have 2FA and most that do only offer SMS based. APIs, forget about them. Walk before we can run.
chrisseaton 5y ago
In the US your public bank account number is effectively a password to debit your account! There’s literally no authorisation at all!
- vageli 5y ago
  > In the US your public bank account number is effectively a password to debit your account! There’s literally no authorisation at all! Don't you also need the routing number? How does this differ in other countries or anywhere that checks are used?
  - chrisseaton 5y ago
    Yes the public account number and routing number. Which are printed on my card, statements, might be read out loud, etc. My bank in the UK would not let you debit my account with just the numbers. I’d need to authorise it. How do you stop people debiting your account with whatever they want?
    - xur17 5y ago
      > How do you stop people debiting your account with whatever they want? Short answer: you don't. Long answer: robust "fraud" controls. It's a shit-show.
    - astrange 4y ago
      Part fraud controls (which don't necessarily work), part being able to undo transactions. Being able to undo mistakes means far more than anything else; it means it's permanently superior to all ""web3"" tech no matter how much fancier they may make that look.
  - the_svd_doctor 5y ago
    The routing number of each bank is public :-)
    - vageli 5y ago
animal_spirits 5y ago
I remember about 4 years ago I read online that most bank passwords did not even check for upper case or lowercase characters. I didn't believe it, but to my surprise I entered my password with RaNDoM cASe letters and it unbelievably logged me in. This was Chase bank, and I believe it has been fixed since then. But just goes to show how far behind banking systems have been.
danielmarkbruce 5y ago
Banking is less concentrated in the US than other countries. There are thousands of banks here. So it's harder for industry protocols to move forward.
pbreit 5y ago
The US has 10,000 financial institutions. Wherever you are from maybe has 20.

rglover 5y ago

Yes. Some banks still run COBOL behind the scenes here.

yohannparis 5y ago
running COBOL behind the scenes have nothing to do with an easy API access and a consortium for interbanking.
- rmbyrro 5y ago
  Maybe they pointed out as an indication that some financial institutions in the US are not modern technologically speaking, and that may be a cause for lacking better APIs?
  - ericmay 5y ago
    That was probably the intention but I think that isn't a core reason. It's more about business/tech incentives around these APIs. The industry is more risk-averse, and frankly there isn't necessarily a great business case for doing integrations if you're a big bank because you don't want to be commoditized into "pipes" and then have to compete on low-margin products all the while the middle companies have better margins and skim off the top of you. At least on the consumer side. There's this meme that banks are technologically backwards and all that, and I don't think that is true or a good frame of reference to have. The scale, complexity, regulatory environment, and risk-aversion when something bad happens are far and away more relevant factors than technology is.
    - rmbyrro 5y ago
      I agree, but don't think the original comment deserves down voting. It's an acceptable argument. Might not hold water, though.
haswell 5y ago
For some systems, this is arguably a feature. Banks are rightly cautious about touching core transaction processing systems, systems that cost millions per minute when down. But the use of COBOL generally doesn’t extend to the consumer facing product, or the APIs that support those consumer facing experiences. Banks may be backwards, but the use of older languages is not one of the primary reasons.
- quadcore 5y ago
  It makes me trust them more when they use old software that I never got to complain about.
zinekeller 5y ago
... and I'm pretty sure a majority of banks here still runs COBOL, but it didn't stop them creating a consortium and simplifying things!
- deleted 5y ago
  [deleted]
paxys 5y ago
What they run on their backend doesn't really matter. If they can provide a website with username/password login, they can have an OAuth layer as well. It isn't a technical problem but a business/priorities one.

codegeek 5y ago

"are US banking really this dysfunctional?" Yes very much. A lot of banks don't even have 2FA and most that do only offer SMS based. APIs, forget about them. Walk before we can run.

chrisseaton 5y ago

In the US your public bank account number is effectively a password to debit your account! There’s literally no authorisation at all!

vageli 5y ago
> In the US your public bank account number is effectively a password to debit your account! There’s literally no authorisation at all! Don't you also need the routing number? How does this differ in other countries or anywhere that checks are used?
- chrisseaton 5y ago
  Yes the public account number and routing number. Which are printed on my card, statements, might be read out loud, etc. My bank in the UK would not let you debit my account with just the numbers. I’d need to authorise it. How do you stop people debiting your account with whatever they want?
  - xur17 5y ago
    > How do you stop people debiting your account with whatever they want? Short answer: you don't. Long answer: robust "fraud" controls. It's a shit-show.
  - astrange 4y ago
    Part fraud controls (which don't necessarily work), part being able to undo transactions. Being able to undo mistakes means far more than anything else; it means it's permanently superior to all ""web3"" tech no matter how much fancier they may make that look.
- the_svd_doctor 5y ago
  The routing number of each bank is public :-)
  - vageli 5y ago

animal_spirits 5y ago

I remember about 4 years ago I read online that most bank passwords did not even check for upper case or lowercase characters. I didn't believe it, but to my surprise I entered my password with RaNDoM cASe letters and it unbelievably logged me in. This was Chase bank, and I believe it has been fixed since then. But just goes to show how far behind banking systems have been.

danielmarkbruce 5y ago

Banking is less concentrated in the US than other countries. There are thousands of banks here. So it's harder for industry protocols to move forward.

pbreit 5y ago

The US has 10,000 financial institutions. Wherever you are from maybe has 20.