47 ms·

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a s

Eh banks run securely because it’s very difficult to steal money. Hard currency theft requires a physical attack and “digital currency” is just essentially a spreadsheet that requires a settlement mechanism such as correspondent banking to work. Banks transfers are nothing more than messages going between different branches and banks there is nothing being transferred other than orders. The attack surface on modern banks especially large ones is actually ridiculously small since you don’t only need to defraud or compromise a single bank but also the entire system and all other banks which are using it since once the offended bank notices some inconsistency it can issue a notice to reverse any offending transactions. Also since bank transfers are often liabilities for most banks e.g. when an account in First Capital transfers $1M to someone in First Direct it means that First Capital now owes First Direct $1M which makes First Direct a creditor which is why it will likely quarantine the funds until the transaction is fully verified and settled and even then there still likely going to be a cooldown period to reduce the risk even further. Most of the security within banks is designed to deal with internal threats since the entire banking system is essentially based on mutual trust which gives individuals even fairly low ranking branch employees the ability to authorize fairly substantial transactions.

chii 4y ago
> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money difficult? Why isn't the same happening with stolen credentials, or data?
- j16sdiz 4y ago
  I think you got them wrong. Bank customer data breach is not that rare. Money in bank is "secure" because they are cross checked with counterparties. Their data leaks like everybody else.
  - jackcviers3 4y ago
    This. At the end of the day, if it is a significant transfer there are people in locked rooms that have to call each other and independently verify a transaction brokered by a third party. And if you don't pass a background check, and don't need to be there, you don't get in that room.
- ta1243 4y ago
  It's telling that in areas banks don't have responsibility (criminals breaking into individual accounts and draining them for example) they are insecure. SMS 2FA, short pin numbers, etc. https://www.bbc.com/news/business-64240140.amp https://www.bbc.com/news/business-64240140.amp > He said Barclays told him it would do an internal fraud investigation which later resulted in Mr de Simone being held liable for all the losses. > "They could not identify a point of compromise from the back end - to them it looked like the pin had been entered. > "The only thing they could suggest was that someone knew the code therefore it's gross negligence on my part apparently. In the olden days banks used to have decent security. Once you gain access to the account, to pay a new payee you'd need your bank card and pin number to do the 2FA. Now it's all the same phone.
  - switch007 4y ago
    The case isnt settled yet. > After eight months of evidence gathering and dealing with the police, an investigator at the Financial Ombudsman Service (FOS) upheld Mr de Simone's complaint against Barclays which now, if it disagrees with this, has the opportunity to ask the ombudsman to examine the case. They are just trying to wear him down.
avianlyric 4y ago
All this might be true in the US where realtime transfers don’t really exist. But here in true UK where we‘be had realtime, high volume transfers for at least a decade, it’s very possible to steal digital money and move it on before the bank notices. Faster Payments in the UK are expected to be credited and spendable within 20min, normally it’s spendable within milliseconds. The actual settlements happen every few hours, and all of it is pretty much automated. Additionally because the money can be credited so fast, there is no recourse for a bank to recover a payment they’ve authorised, they have to settle it. The sending to the transfer message is as good as sending the money, once it’s sent, they have to pay, if they refuse, the money is taken from their collateral at the payment network to pay their debt, and they’re disconnected from the payment network.
- dogma1138 4y ago
  I’m from the UK that’s for relatively very small amounts and it’s insured, this is the cost of doing business and there are still a lot of fraud checks especially for new payees. If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined. HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my work since we bought a gift for someone that was leaving and settled the payment. Authorized push payment fraud still does happen but it’s fairly negligible in the big scheme of things.
  - avianlyric 4y ago
    > If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined. > HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my work since we bought a gift for someone that was leaving and settled the payment. I would be careful assuming that HSBC is representative of how banks in the UK work. They’re well know to be the most trigger happy bank when it comes to account and transfer freezes. HSBC was probably the number one cause of complaints related to transfers while I was working in the fincrime team of a different bank.
ethbr0 4y ago
> Eh banks run securely because it’s very difficult to steal money. Banks run securely because they have serious and mandated change control processes, applied against a formal classification of the importance of systems. Something you generally won't see outside the T100 of non-bank companies. This means their IT evolves glacially slow, but it does keep things stable.

chii 4y ago

> Eh banks run securely because it’s very difficult to steal money. i think you got the cause and effect wrong - banks are run securely because it's made to be very difficult to steal money. And stolen money gets tracked (if you did steal a large amount) by anti-money laundering laws, which makes it hard to spend it. Why is banks' attack surface small? Why is all these other "systems" in place to make stealing money difficult? Why isn't the same happening with stolen credentials, or data?

j16sdiz 4y ago
I think you got them wrong. Bank customer data breach is not that rare. Money in bank is "secure" because they are cross checked with counterparties. Their data leaks like everybody else.
- jackcviers3 4y ago
  This. At the end of the day, if it is a significant transfer there are people in locked rooms that have to call each other and independently verify a transaction brokered by a third party. And if you don't pass a background check, and don't need to be there, you don't get in that room.
ta1243 4y ago
It's telling that in areas banks don't have responsibility (criminals breaking into individual accounts and draining them for example) they are insecure. SMS 2FA, short pin numbers, etc. https://www.bbc.com/news/business-64240140.amp https://www.bbc.com/news/business-64240140.amp > He said Barclays told him it would do an internal fraud investigation which later resulted in Mr de Simone being held liable for all the losses. > "They could not identify a point of compromise from the back end - to them it looked like the pin had been entered. > "The only thing they could suggest was that someone knew the code therefore it's gross negligence on my part apparently. In the olden days banks used to have decent security. Once you gain access to the account, to pay a new payee you'd need your bank card and pin number to do the 2FA. Now it's all the same phone.
- switch007 4y ago
  The case isnt settled yet. > After eight months of evidence gathering and dealing with the police, an investigator at the Financial Ombudsman Service (FOS) upheld Mr de Simone's complaint against Barclays which now, if it disagrees with this, has the opportunity to ask the ombudsman to examine the case. They are just trying to wear him down.

avianlyric 4y ago

All this might be true in the US where realtime transfers don’t really exist. But here in true UK where we‘be had realtime, high volume transfers for at least a decade, it’s very possible to steal digital money and move it on before the bank notices. Faster Payments in the UK are expected to be credited and spendable within 20min, normally it’s spendable within milliseconds. The actual settlements happen every few hours, and all of it is pretty much automated. Additionally because the money can be credited so fast, there is no recourse for a bank to recover a payment they’ve authorised, they have to settle it. The sending to the transfer message is as good as sending the money, once it’s sent, they have to pay, if they refuse, the money is taken from their collateral at the payment network to pay their debt, and they’re disconnected from the payment network.

dogma1138 4y ago
I’m from the UK that’s for relatively very small amounts and it’s insured, this is the cost of doing business and there are still a lot of fraud checks especially for new payees. If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined. HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my work since we bought a gift for someone that was leaving and settled the payment. Authorized push payment fraud still does happen but it’s fairly negligible in the big scheme of things.
- avianlyric 4y ago
  > If your account all of a sudden has 10’s yet alone of 100’s 1000’s or of transfers in it will be quarantined. > HSBC locked my account just last week for 7 or 8 transfers of circa £10 all being made all in the same day from colleagues from my work since we bought a gift for someone that was leaving and settled the payment. I would be careful assuming that HSBC is representative of how banks in the UK work. They’re well know to be the most trigger happy bank when it comes to account and transfer freezes. HSBC was probably the number one cause of complaints related to transfers while I was working in the fincrime team of a different bank.

ethbr0 4y ago

> Eh banks run securely because it’s very difficult to steal money. Banks run securely because they have serious and mandated change control processes, applied against a formal classification of the importance of systems. Something you generally won't see outside the T100 of non-bank companies. This means their IT evolves glacially slow, but it does keep things stable.