6 ms·

Out of curiosity, how do European banks avoid this issue? If my debit card or ACH info is compromised and someone drains my checking account, is there a way to

• Jensson 4y ago
  The law says that the bank needs to give back your money immediately, at least in my country. If it turns out that it was your fault you don't get to keep the money, but you will have money to pay bills with during the investigation. Laws and security adapts to whatever medium people tend to use, so common problems tend to have solutions. The laws in Europe are made to make debit card transactions and security reasonable, because almost everyone uses debit cards.
  • Spooky23 4y ago
    US law does the same thing. But you need to deal with it. My credit card was compromised and AMEX has a problem. My debit card is compromised and I have several problems.
• bckygldstn 4y ago
  Giving someone your bank account number (~EU ACH info) only allows them to send you money, not take it from you. It's not a secret, some retail businesses list it on their websites.
• mcv 4y ago
  How would they drain your bank account? There's quite a bit of 2FA they'd have to defeat. Easiest is stealing the card after skimming their PIN, but if you know it's stolen, you're going to block it pretty quickly, and there are limits to how much you can withdraw from an ATM. The big problem with credit cards is that all the info needed to authorize a transaction is right there on the card. The second problem is that quite often you submit that data directly to the merchant or to whichever payment provider the merchant chose.
  • RHSeeger 4y ago
    In the US, automated payments tend to be "pull based", where a company tells your bank "give me this much from this account, I have permission". The company can lie but, by the time you find out, the money is already gone and it can take a long time to get it back. The bank has no real incentive to get your money back. With a credit card, on the other hand, you see what was taken _before_ you pay them. So you can tell the credit card company "this amount that was charged to me is not me, I'm not paying that". Then the credit card company has to look into it; they have incentive to figure out what happened (unlike banks) because they aren't getting payed back their "loan" to you until they do.
    • blackoil 4y ago
      In India, now you have to approve all such scheduled payments with a 2FA and upto a limit. So even if I have approved ShadyCorp they can't demand more than approved amount.
    • mcv 4y ago
      Dutch banks used to work like that too, by "incasso", and in fact still do to some extent. But any incasso that hasn't been directly authorised by you with the bank can be undone (and apparently at an additional fee to the company that originated it; they really don't like it when that happens). So that's actually very similar to how credit cards work, but without the additional fee. These days you can easily manage all upcoming incassos through your banking app and block them before they happen, though I generally prefer to pay such recurring payments through automated "push" transfer.
      • lxgr 4y ago
        The problem is that since direct debits are so easily reversible, in Germany they are not seen as a final form of payment (until the charge return time limit expires) as there is no form of dispute arbitration involved. Merchants will usually not ship goods or provide services for a direct debit alone.
        • 4y ago
• junofan 4y ago
  There’s a lot more approval-related stuff and general friction.
• vimy 4y ago
  When you know someone’s bank account number you can only send them money. This issue simply isn’t possible.
  • deleted 4y ago
    [deleted]
  • justinc8687 4y ago
    That's not true. As a business, at least, I can run an ACH Debit[0] with just a routing number, account number and name. NACHA rules prohibit this, but nothing programmatically prevents this from happening. [0] https://plaid.com/resources/ach/how-does-an-ach-transfer-work/#:~:text=.%20ACH%20Debits%20%E2%80%94%20Requests%20for%20the%20ACH%20network%20to%20%E2%80%9Cpull%E2%80%9D%20money%20from%20an%20account%20that%20the%20requestor%20(%E2%80%9Coriginator%E2%80%9D)%20doesn%E2%80%99t%20control%2C%20say%20for%20a%20pre%2Dauthorized%20bill%20payment https://plaid.com/resources/ach/how-does-an-ach-transfer-wor....
    • brewdad 4y ago
      u/vimy was talking about European banks. There is no "pull" there. People freely share their account info because one can only push money in with that info.
      • Silhouette 4y ago
        That's still not true. Pull-based schemes are widely used across the SEPA region and in national schemes such as the UK's Direct Debits. A notorious celebrity in the UK famously revealed his bank details as a stunt to show that a large-scale data loss incident wasn't a big deal and he ended up making an unexpected payment to a healthcare charity shortly afterwards.
        • vimy 4y ago
          I don’t know about the UK but in my SEPA country only companies can create pull-based schemes and they can’t do it without authorization of the bank account owner. Mostly used for things like utility bills. So there’s zero danger in sharing your bank account number with someone.
• ClumsyPilot 4y ago
  Its called Direct Debit guarantee, UK had it for decades: "Immediate refunds. You can get a full and immediate refund from your bank (also known as an “indemnity claim”) for any payment taken in error." https://gocardless.com/guides/posts/dd-guarantee-in-plain-english/#:~:text=The%20Direct%20Debit%20Guarantee%20in%20Plain%20English%201,payment%20taken%20in%20error.%203%20Instant%20cancellations.%20 https://gocardless.com/guides/posts/dd-guarantee-in-plain-en...
  • PaulDavisThe1st 4y ago
    Who defines whether a payment is or is not in error? Has the USA really made me that cynical?
    • martijnvds 4y ago
      You (the account holder) do. Direct debits are instantly reversible for a month (maybe 2?). You'll have to explain to the company that deducted the money why you reversed the charge though, and if it was legit after all you still need to pay them.
      • Symbiote 4y ago
        There's no time limit for reversing direct debit transactions. https://www.cleardebit.com/indemnity-claims/ https://www.cleardebit.com/indemnity-claims/
        • lxgr 4y ago
          There is. It‘s 8 weeks (for any reason including "I‘d like my money back and rather do something else with it") or 13 months (for unauthorized charges). https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direct-debit https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...
• Silhouette 4y ago
  Out of curiosity, how do European banks avoid this issue? In the UK we have a system of Direct Debits that is popular particularly for making recurring payments like household bills or subscriptions. You provide your bank account numbers to the merchant and they can collect the required money directly. It sounds like a huge opportunity for abuse by merchants but the easy setup is balanced by a universal Direct Debit guarantee for account holders that basically says if any erroneous charge is made then you get your money back from your bank first and questions are asked later. Merchants are required to provide all customers who pay this way with certain information about the guarantee scheme (and everyone actually does). That in turn sounds like an opportunity for abuse by customers but having personally run a business that accepts Direct Debits I can tell you that we have never seen a single abusive reversal of a Direct Debit payment. In contract we've had a few problems with legitimate charges to cards being reversed later and the whole system around chargebacks with credit cards seems to be unreliable for both merchants and cardholders.
• foepys 4y ago
  German banks require the account owner's permission to pull money from a bank account and the owner has a 6 week window to get all their money back, no questions asked. "SEPA Lastschriftverfahren" is what it's called.
• Doxin 4y ago
  > If my debit card or ACH info is compromised There's two ways this could happen, but neither is super easy: 1) You've handed over your physical debit card and it's PIN code to a baddie and not informed your bank. Unlike the security code on credit cards the PIN code is not on the card. Unlike credit cards you need the actual physical card to transfer money. 2) You've given a baddie your online login info and had him send you a QR code which you then scan and approve the amount. Notable what does not happen, which does with credit cards, is making a payment at a webshop and that webshop then leaking your card info to a baddie. No one other than the bank ever sees the "secret" part of the card info.
• benhurmarcel 4y ago
  It happened to me at a French bank. I got refunded everything within a few days, I just declared it to the bank.
• lxgr 4y ago
  At least in Germany, the dispute process for bank account debits is literally clicking a single button in online banking. No proof or even reason for this is required in the first 8 or so weeks since the charge (or more than a year if the debiting merchant does not have a "direct debit mandate", which essentially means some sort of evidence of the account holder agreeing to be debited).