Hacker News Reader

Anyone doing so would also require the name and address of the account holder.

The linked BBC article says the victim hinted at how the public could find his address, so someone who knew how the system works called Clarkson's bluff with a £500 monthly debit to a UK charity.

Apparently, the UK system was designed to support push and pull transfer modes.

At least with a direct debit, my bank has a list of companies authorized to pull money from my account (they are all supposed to have a signed direct debit agreement on file) and I can revoke from my bank's website. Is there something similar in the US?

Not even close :(

With my bank (known for its great service) you can call to place an ACH freeze but you have to know the vendor's identification or rough amount but you may end up with collateral damage (stopping a payment you do want to go through).

Or a dodgy enough place willing to look the other way when setting up the direct debit, because at least as of 9 years ago it was possible to do so when I was selling mobile contracts. Some would do so, and one of those is in jail now; so I guess it's not worth it, but the "validation" definitely wasn't foolproof then

Reply on news.ycombinator.com