7 ms·

For all those who tune in to the "checks are so 19th century" tune: please note this is a good story about check fraud, as the OP eventually got his money back.

• krisoft 4y ago
  > With Paypal/Venmo/app-du-jour, in the event of an account takeover, the result might be different. You are saying it as if checks vs apps are the only two option. > On the other hand, good luck explaining the police such obscure technical details as "they installed a proxy on my IP" or "they sim-swapped me to intercept the one-time password". Why would I explain any such thing? It is not my job to know how the bank got hacked.
  • PopAlongKid 4y ago
    >It is not my job to know how the bank got hacked. But it may be in your best interest to show that you are not the hacker.
  • maratc 4y ago
    > It is not my job to know how the bank got hacked. And without any explanations, it's not your bank's job to return your money.
    • krisoft 4y ago
      The explanation is that you see a transaction you are not recognising. You point at it and say “i didn’t authorise that one” and let them investigate. They have the logs, you don’t. This is probably the worst day of your life or close to it, while it is just a normal regular occurence for your bank. They have policies to handle it from their side. They will ask a lot of question, perhaps ask you to make a police report. I ask you this, if you have chest pain and shortness of breath, would you: a; jurry-rig an oscilloscope to check your ECG, start reading wikipedia all about cardiology, and then find a nurse to tell them about how concerned you are about your QT interval Or b; go to a hospital and tell them that you have chest pain and shortness of breath?
      • maratc 4y ago
        You have a lot of good faith in what your bank would or would not do, and they have a conflict of interest: if they side with you, they would need to make you whole — out of their own pocket. The hospital has the opposite conflict of interest: they are actually interested in helping you — and charging you (or your insurance, or NHS, or somebody). If you get your case against the bank in front of a judge, you need to prove your claim of an account takeover. The bank does not need to prove anything. If you haven't convinced the judge, no money for you.
        • adriancr 4y ago
          > they would need to make you whole — out of their own pocket. Banks have the means to ask for a freeze/for the money back from the other party's bank. Same as credit card companies can do charge backs.
          • maratc 4y ago
            If the transfer is instantaneous, the fraudster could have cashed out already from the other bank account. There is nothing in the other party’s bank by then. The chargebacks in credit cards come mostly from the credit card issuer pockets, and are funded by credit card fees. Not the case with banks that don’t take any fees on transfers.
• fsh 4y ago
  This is a very American perspective. The rest of the world has used bank transfers for decades, and the risk is very well understood. Online banking usually requires 2FA via a phone app, or using the bank card with a separate reader. 2FA via SMS has been mostly phased out due to the risk of SIM-swapping. Bank transfers are also usually commission free, and are instant in many countries.
  • maratc 4y ago
    For a perspective, I'm not American, and I don't feel comfortable giving my bank details to random people. I can also get checks with dates in the future, and know that I will collect the money (this way or another). If someone promises you a future money transfer, you can't be sure that they will actually deliver the way you can when you have their check in hand.
    • kevincox 4y ago
      Checks have your bank details on them. It's the funny numbers at the bottom. If they didn't how would the receiving bank be able to get the money from your account?
      • maratc 4y ago
        When I want someone (who needs to pay me) to give me the check, my bank account details are not supplied to them. I just deposit their check. The check has their bank details printed on it, not mine. When I want someone (who needs to pay me) to transfer money into my account, I need to provide them with my account number. In the first case, my bank details are kept private, but in the second case, not so much.
        • shortcake27 4y ago
          In Australia you can make instant bank transfers using phone numbers, email addresses, ABNs etc. Although I’ve never been too bothered about giving out my bank account details - they’re designed to be public.
• trollied 4y ago
  >On another note, checks charge 0% commission: to pay someone $5, you need $5. I can make a direct bank transfer "faster payment", which usually takes a few seconds to arrive in the destination account, for a fee of £0.
  • maratc 4y ago
    > usually takes a few seconds to arrive in the destination account This also means that whoever takes over your account, can send the money out and cash it in very fast. This of course would never happen to me or you, but happened to a relative of mine who got a call from "their bank security" and then were directed to install a "security check app" (remote control tool), and change their password in the banking app. The thieves then got off with money that they transferred out in a matter of seconds, with no recourse.
    • adql 4y ago
      They need to take over the account, vs fake a bit of paper
      • deleted 4y ago
        [deleted]
    • Nextgrid 4y ago
      > a relative of mine who got a call from "their bank security" and then were directed to install a "security check app" (remote control tool), and change their password in the banking app Presumably you want their money to be returned, but would you want the same if it was physical thieves pretending to be the alarm/security company that went in to "repair" the physical safe and made off with all its valuables? Would you still want the money to be returned (ultimately subsidised by all other customers of the bank or the taxpayer) if someone physically withdraws all their money in cash and hands it over to someone who pretends to be a bank employee and has a convincing name tag? Looking at it from the bank's perspective, the user willingly delegated their identity to the scammer by voluntarily handing over control of their authentication instrument. There is not much the bank can do in this case that wouldn't also hinder legitimate usage - this may have very well been a legitimate transaction for buying a car/house deposit/etc. FYI, there is recourse against authorised push payment fraud, but it's a goodwill scheme that most banks participate in as opposed to a legally mandated feature. Nevertheless, it's worth trying out.
• ghaff 4y ago
  >On another note, checks charge 0% commission: to pay someone $5, you need $5. I sometimes lead weekend trips for an outdoor organization and for quite a while even after various direct electronic payment arrangements became available, most leaders stuck with checks because there tended to be fees associated with other types of transactions. I assume dealing with check fraud has become pretty bulletproof. I bought a car for "cash" last summer and I surprised I could just write a check for the post-deposit balance when I picked up the car. I've always had to go to my bank for a cashier's check in the past.
  • mindslight 4y ago
    For the dealer, there are two failure modes. The first is you are who you say you are, but your personal check bounces. Good standing in the financial surveillance databases alleviates this concern, as it shows that if your personal check does end up bouncing you will rectify the problem rather than trying to play coy. I'd guess someone with a low credit score would still have been told to bring a bank check to eliminate the credit risk. The second is that the buyer has supplied a fraudulent identity, and forged check. But checking the buyer's ID will get the dealer most of the way there, and bank checks can still be forged. Furthermore, a car is a titled asset where ownership is transferred to the identity supplied. To commit a successful fraud, you'd have to pass a bad check, take possession of the car, and then part it out like it's a stolen car (because it is).
• adriancr 4y ago
  > "they installed a proxy on my IP" This doesn't make sense. > "they sim-swapped me to intercept the one-time password". You would notice by losing phone connectivity... so you would know you're compromised before you try to make a transaction. Being 2FA, the attacker still needs to know the account user/password... Then there's hardware 2fa for a lot of banks that don't do sms... good luck with that. Or they use bank app in phone as 2fa. Which should run securely in enclaves. Even if they have all of the above, you just file a police report for fraud and bank will claw back funds and reinstate you, same as for checks.
  • maratc 4y ago
    > you just file a police report for fraud and bank will claw back funds and reinstate you If the fraudster has your password and OTP, and if the money's gone, bank will do nothing — as opposed to the check fraud. That's why TLA is a good check fraud story.
    • adriancr 4y ago
      How do you prove check fraud for washed check?, it has your signature, check is valid... funds get transferred same as for hacked account.
      • maratc 4y ago
        > How do you prove check fraud for washed check? By the law, the bank needs to do the proof, or return your money. Not so with account takeovers. Which is my whole point.
• yakak 4y ago
  I think people who tell you it is 19th century live in countries that use IBAN/SWIFT to push money instead of checks to tell people an account is available to drain.
  • porbelm 4y ago
    These countries also usually have bank-supplied or sponsored mobile payment apps (like Vipps in Norway) where the usual fraud protection applies. That the US is 30 years behind the times in banking is not a shock but still stupid.
• rippercushions 4y ago
  Account takeovers are a different beast that are closer to someone breaking and entering your house, then raiding your fridge and stealing your TV. The literal man in the middle attack described in the article here, where a legitimate transaction is hacked into an illegitimate one, is orders of magnitude more difficult to execute for type of any electronic payment.
  • chrisco255 4y ago
    I would argue it's a lot harder to physically intercept a check and chemically wash it than, for example, a credit card number punched online. There are numerous trivial phishing methods to get someone to punch in or reveal their CC details online. And then again if companies don't store the data properly, they are subject to trivial insider attacks and hacks.
    • adriancr 4y ago
      They would then need to bypass 3d secure aproval process OR use a website without in which case you get your money back just by calling. (note: instant notification for transactions on phone means you catch it fast) You could use a bank with disposable one-time credit card numbers. You could disable online payments and only enable then when you do transactions. You could set up limits, say 100$ a month, after which transactions get denied unless you alter it. So you wont be incovenienced too much if you do need a card for netflix and other recurring payments. There are so many ways electronic payments are more secure in new banks that care about this.
      • maratc 4y ago
        A famous case of Amazon ATO (account take-over) was trivially executed where a fraudster would use one of the Amazon checkout paths with a credit card that they own (e.g. a disposable Visa gift card) but later add a victim's email so that the credit card would get added to the victim's account. The fraudster would then call Amazon support, impersonate the victim, proving their identity by using that credit card number, expiration date, and CVV, and claim that their phone is stolen. Amazon support would then "update" the victim's account with the phone number under fraudster's control. The fraudster would then use the "forgot password" flow to reset the victim's password using the phone. Game over, the fraudster now controls the account (and the real CCs added to it) through no fault of the victim (nor their knowledge). They would go on by purchasing electronic gift cards (iTunes/X-box/etc.) and selling the numbers on eBay for real money. This specific flow has since been fixed, but ATOs still happen much more than you can imagine.