4 ms·

> we don't like to provide those (both payers and receivers prefer not to give the other participant their ach numbers This is because in the US, anyone can pu

> we don't like to provide those (both payers and receivers prefer not to give the other participant their ach numbers This is because in the US, anyone can pull money out of your account with only the ACH numbers; which is an insane design[1]. In most other countries, the worst you can do is deposit money. The equivalent of ACH pulls requires significantly more paperwork and proof of consent by account owner. 1. Much like SSNs, which can be debilitating if not kept secret. US payments run in "true names" magic, and simultaneously expect you to register with your one true name at random places with questionable security practices, and it's your fault if there's a breach.

j_w 1y ago
The "anyone can pull money out of your account" piece is true but it also isn't. Yes, if a financial institution allows you to originate a debit from another account without verification, you could take money from anyone's account. The max liability you should have given prompt reporting of fraud (less than 60 days) is $50, and if your institution doesn't give it all back then find a new one. ACH is also technically reversible, whereas wires/other instant transfers are not. FIs also do fraud checks on ACH, I believe it may be a regulatory requirement now (sometime in the past few years?) to have some form of fraud check before sending originations to the FED. Typically this is verification of the other party being a known entity/account, which would ideally burn fraudsters very quickly. Most transaction facilitators don't play around with any of this though, and have some "account linking" step before they are willing to originate transactions. Micro-deposits that you would need to verify on the other account.
flopsamjetsam 1y ago
> This is because in the US, anyone can pull money out of your account with only the ACH numbers Whoa, I don't blame people for not wanting to provide ACH numbers in that case. Is there any groundswell to provide a system where this doesn't happen?
- ianburrell 1y ago
  FedNow is that system. It only sends money. Can request money but it needs to be approved. However, I'm not sure if it uses different account numbers from ACH. It could be that sharing account numbers could be secure with FedNow and dangerous for ACH.
- soared 1y ago
  No, since software if built around existing limitations. IE stripe invoices will generate a single use account number per invoice, so you can give that to someone who needs to pay. Aligns payment with invoice since they’re 1:1 and you can pull out funds since it’s always empty
47282847 1y ago
> This is because in the US, anyone can pull money out of your account with only the ACH numbers; which is an insane design That’s the default for at least Germany and SWIFT, too. You can ask your bank to disable this, but that means losing the pull functionality completely; I think some banks have an interface to whitelist individually, but the majority doesn’t. It can become a problem especially when you list your account number publicly somewhere for payments or donations: somebody will eventually use that account number to pay for random stuff. You’re contractually obliged to check your bank statements and ask for a (free) chargeback within a certain period of time (some weeks?). At our projects, we solve this by having a separate “public“ bank account for incoming donations that blocks pulls, and a much less public one for pulls. Apart from this use case, abuse seems to be rare enough that banks typically don’t expose the functionality to disable but only do it manually when asked specifically. I doubt most people even know they could.
- 47282847 1y ago
  > and ask for a (free) chargeback within a certain period of time (some weeks?) 13 months!
  - luckylion 1y ago
    Within six (?) weeks, you can simply charge back and the money will be back in your account very quickly. After that, it's a much more formal process where your bank has to get in contact with the other bank and it can take weeks.
amaccuish 1y ago
> In most other countries, the worst you can do is deposit money. So in the EU, anyone can indeed pull money with your account number (and with RTP that may change someday). But we can also revoke any such direct debit within a certain period of time. I had to do it once, over my banking app, money was back the moment after I clicked.
- baobabKoodaa 1y ago
  I live in the EU and this is the first I'm hearing of this. I don't think this applies to "the EU" as a whole. Not sure where you're from.
  - amaccuish 1y ago
    It's a SEPA thing.
    - baobabKoodaa 1y ago
      Finland is part of SEPA and we definitely don't have the ability to pull money out of someone elses' bank account without permission, using only the account number.
      - amaccuish 1y ago
        You're not a business. Businesses can.
        baobabKoodaa 1y ago
        No, businesses can not pull money out of a Finnish bank account, using only the IBAN number.

j_w 1y ago

The "anyone can pull money out of your account" piece is true but it also isn't. Yes, if a financial institution allows you to originate a debit from another account without verification, you could take money from anyone's account. The max liability you should have given prompt reporting of fraud (less than 60 days) is $50, and if your institution doesn't give it all back then find a new one. ACH is also technically reversible, whereas wires/other instant transfers are not. FIs also do fraud checks on ACH, I believe it may be a regulatory requirement now (sometime in the past few years?) to have some form of fraud check before sending originations to the FED. Typically this is verification of the other party being a known entity/account, which would ideally burn fraudsters very quickly. Most transaction facilitators don't play around with any of this though, and have some "account linking" step before they are willing to originate transactions. Micro-deposits that you would need to verify on the other account.

flopsamjetsam 1y ago

> This is because in the US, anyone can pull money out of your account with only the ACH numbers Whoa, I don't blame people for not wanting to provide ACH numbers in that case. Is there any groundswell to provide a system where this doesn't happen?

ianburrell 1y ago
FedNow is that system. It only sends money. Can request money but it needs to be approved. However, I'm not sure if it uses different account numbers from ACH. It could be that sharing account numbers could be secure with FedNow and dangerous for ACH.
soared 1y ago
No, since software if built around existing limitations. IE stripe invoices will generate a single use account number per invoice, so you can give that to someone who needs to pay. Aligns payment with invoice since they’re 1:1 and you can pull out funds since it’s always empty

47282847 1y ago

> This is because in the US, anyone can pull money out of your account with only the ACH numbers; which is an insane design That’s the default for at least Germany and SWIFT, too. You can ask your bank to disable this, but that means losing the pull functionality completely; I think some banks have an interface to whitelist individually, but the majority doesn’t. It can become a problem especially when you list your account number publicly somewhere for payments or donations: somebody will eventually use that account number to pay for random stuff. You’re contractually obliged to check your bank statements and ask for a (free) chargeback within a certain period of time (some weeks?). At our projects, we solve this by having a separate “public“ bank account for incoming donations that blocks pulls, and a much less public one for pulls. Apart from this use case, abuse seems to be rare enough that banks typically don’t expose the functionality to disable but only do it manually when asked specifically. I doubt most people even know they could.

47282847 1y ago
> and ask for a (free) chargeback within a certain period of time (some weeks?) 13 months!
- luckylion 1y ago
  Within six (?) weeks, you can simply charge back and the money will be back in your account very quickly. After that, it's a much more formal process where your bank has to get in contact with the other bank and it can take weeks.

amaccuish 1y ago

> In most other countries, the worst you can do is deposit money. So in the EU, anyone can indeed pull money with your account number (and with RTP that may change someday). But we can also revoke any such direct debit within a certain period of time. I had to do it once, over my banking app, money was back the moment after I clicked.

baobabKoodaa 1y ago
I live in the EU and this is the first I'm hearing of this. I don't think this applies to "the EU" as a whole. Not sure where you're from.
- amaccuish 1y ago
  It's a SEPA thing.
  - baobabKoodaa 1y ago
    Finland is part of SEPA and we definitely don't have the ability to pull money out of someone elses' bank account without permission, using only the account number.
    - amaccuish 1y ago
      You're not a business. Businesses can.
      - baobabKoodaa 1y ago
        No, businesses can not pull money out of a Finnish bank account, using only the IBAN number.