Hacker News Reader

Comment by jeremyt | Hacker News Reader

Don't you guys routinely use ACH transfers to buy things, give out your bank info, and just hope everything goes well?

SEPA Direct Debit, yes, is used like that.

But abuse is very low, as it requires that whoever does it identifies themselves first at another bank, and opens a merchant account (which has other verifications). And then reversing it is easy, too.

And you can't even shop with stolen IBANs at Amazon, because every major retailer will first send you a 1ct transaction with transaction info set to a OTP you use to verify that you own the account.

Wouldn't the equivalent of ACH transfer be SEPA Credit Transfer (SCT)?

I'd add that SEPA being mandatory for all participating countries has simplified transfers a great deal. Now most banks remember creditors, just like a phone book but for money, so sending money from your phone is pretty neat.

Additionally, the SEPA effort created ISO 20022, which is gaining ground worldwide as a one-stop-shop format for financial transfers. See this article from the US Federal Reserve a couple of weeks ago: https://fedpaymentsimprovement.org/news/press-releases/feder...

Well, depends on if you consider push or pull.

SCT is entirely push, and requires signing the transaction with your card, or using at least 2FA for verification. This doesn’t happen by accident.

SDD is entirely pull, and is the only one that could theoretically be abused, but that’s as mentioned also not that easy.

And the merchant needs to have a valid direct debit mandate that he has submit to his bank which in turn transmit it to your bank for it to check. After your bank has confirmed the mandate the transfer can be initiated.

SDD can be reversed without giving any reason for a whooping 8 weeks by the customer sometimes simply by clicking "reverse" and entering a TAN.

B2B is a different beast though.

In the US, everything needed to initiate an ACH is printed on a Check... and people feel very safe writing checks to one another and to companies. You never really know who sees your checks, where they are stored long-term, etc. Also, it's trivial to find a website that will sell you a box of checks, they do no verification to your identity/ownership of the accounts, they basically just print what you tell them to. Nothing is secure about banking, it really does need a modern reboot where we just sever ties to the legacy features

legally you can write a check on anything: post-it note, napkin, etc.

Isn't it literally a money transfer contract?

As a technicality, yes, but your bank almost certainly has a rule about what it will accept. And there's nothing illegal about that rule.

I’m pretty sure that ACH is only a USA thing.

Yes it is. I actually didn't know what it was before looking it up.

The grandparent comment is using ACH but he means the EU equivalent (whatever it's called, I'm not sure). Paying for things in EU with a direct bank transfer is very common. Almost every online shop takes it, every bill you might need to pay, even when just sending money to a friend - direct bank transfer is common.

For me with my German bank account, sending money this way always requires a one time use code. The code is not digital, the bank sends you a list of 100+ codes printed on a piece of paper. So, I'm not really worried at all because there is no possible way for a scammer to get my codes.

UK: Bank account numbers are public-ish and it's normal to give them to your friends so they can send you money (it's not normal to buy from an actual shop that way). Jeremy Clarkson made a point of giving his out on national TV. The one way to get money out of someone from those numbers is a direct debit, but as sibling comments have said the other end of those can only be a merchant account and the individual is easily able to reverse them.

Hummmm no?

Germany might have such a system thought.

Reply on news.ycombinator.com