Your Mother’s Maiden Name Is Not a Secret
nytimes.com
nytimes.com
In europe:
-for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over.
-I have never seen a bank have security questions like "mothers maiden name" as backup. No backup questions at all. I guess you go to the bank's office if you forget it?
-"wiring" money between european bank accounts is free (and not called wiring, not sure what in english though), for as long as I remember. It's not some special type of transaction, it's the main way to pay bills, get salary, pay each other, ...
-paper cheques don't exist since over a decade
When I hear how US banking is, it somehow evokes images of an old stuffy 70's office to my mind... lots of paper, maybe a slow cobol mainframe somewhere, which can only support 8 character passwords in all caps or something like that...
ACH(EFTS in EU) in the US is generally free, but has a delay for clearing and has some mechanisms for reversal. This is primarily a digital check, and can be initiated by the receiver in that way.
A wire transfer is nearly immediate by comparison and offers almost no option for reversal. This option does usually have a fee and is generally reserved for large purchase transfers and emergency situations were verification of receipt is required. Such as buying a house. These transfers are processed via Fedwire inside the US and SWIFT out.
The guideline in the EU is that interstate can not cost more than intrastate, so most went to 0.
Well not exactly. I have set up ACH transfer between my dad and my account, but a couple of banks didn't let me. They are like both account holder should be the same. Bank told me that the only option I have is to wire the money.
On the other hand, I pay my employees through ACH (ADP take cares of it).
In the US if you want a fee-free transfer, you need to use your bank's app and take a photo of someone's check. And no, Paypal/Vinmo are not good alternatives. They're private transfer systems that are not federally mandated and regulated bank-to-bank transfers. I wrote a full post about this:
http://penguindreams.org/blog/the-american-banking-system-is...
It'd be more like the Federal Reserve enforcing free customer-to-customer ACH for everyone. There are some banks that do offer free person-to-person ACH (I believe 5/3 is one of them).
Zelle is basically the banks getting together and going around that critical lack of infrastructure. It does look like they have a lot of major and minor banks. Mine is still missing from the list though, and I suspect it will be years until everyone is supported or banks will feel they need to support it to enter the market. So no, the US is still way behind.
not only is there an ODFI-clearing house - RDFI delay caused by the actual "clearing" process - the whole flow starting from the merchant->payment processor step is a sequence of nightly batches with cutoff times factored in to boot.
from the merchant perspective, however, ACH payment is cheaper to process than a credit card payment and is way less likely to end up in a chargeback.
which is why you can use debit cards in most situations where you would use a credit card where instant check of funds availability and hold is required - e.g. hotel incidentals etc.
Often banks and credit unions will limit ACH origination to debits (pulls) in digital banking applications for risk and business reasons.
You are right that ACH (and most payment schemes in the US) have substantial deficiencies in terms of security, but that is counteracted with a strong justice system and consumer laws. You shouldn't really fear about someone emptying your bank account (unless you are a business) because Regulation E mandates that banks and credit unions make you whole for any fraudulent transaction reported within 60 days of the statement that includes the relevant transaction(s).
Inter-bank money transfers in US are handled by a system that needs multiple "business days" for a transaction to be finalised so you're on the money here: https://engineering.gusto.com/how-ach-works-a-developer-pers...
I wired some money from my US bank account to my Swedish bank account. The US bank obviously operates on a batch process basis, because around 6AM EST I got an email from my US bank saying that they've sent the money, and I should expect it within three days in my destination account.
It was already available in my Swedish bank account at that moment, because they have no delays whatsoever because what the hell is there to delay? The difference is like night and day, and I do not understand why American consumers put up with their extremely shitty banks that all seem to be stuck in the 70's. It drives me crazy.
I've never had an issue with my American credit union. I draft loans directly out of my account and I can send money to anyone for free (instantly to people with the same bank.) For everything else, I use my credit card for the fraud protection and rewards points.
This is another one of those US quirks. The only time I had to deal with banking fraud was when my wife's credit card was stolen. CCs are pretty low on the trust scale here in Germany, they mostly exist to simplify transactions with US-oriented companies.
A couple of years ago, a vendor charged me $500 instead of the $50 they had claimed a service would cost. When I complained to them, they called me a liar and refused to do anything.
I disputed the transaction with my credit card company. The money never even had to be refunded to me because it never came out of my account.
This is a rare occurrence, but having an intermediary preventing $450 that I don't owe being directly debited out of my account is vastly superior to the alternative of complaining to my bank after the actual money is gone.
Atleast in germany you have a multitude of options you can pull even without a lawyer getting involved. You can also file legal complaints easily and most fraudsters will drop the money at that point and apologize.
Added to that is that most online payment in germany works with a push system, which means you'll see the amount you'll transfer on your banks online form or whichever webservice you use (GIROdirect or SOFORT). If they charge more, don't pay.
SEPA Debit, which is a pull system has more fraud protection and vendors are very unlikely to ever do anything like fraud over Debit as the bank will go after them like some 80s slasher movie killer if they do. Plus you get the money back.
In this case, all I had to do was log into my credit card website, click "dispute transaction", explain what happened, and forget about it.
Moreover, I don't know what would have happened legally, as it is a reputable, well-established vendor in the local area, and it came down to my word versus theirs - I didn't have a receipt or anything.
> Plus you get the money back.
The money never even leaving my account is much preferable to getting it back.
The US debit system works in a similar way as you describe, but the credit system is still better for that reason.
IIRC from my current law course, if you didn't get a receipt (or other proof of transaction/contract) the vendor has no right to your money. You'll get receipts everywhere.
Fraud is rare enough here that it's not much of a hassle, the legal system being in favor of the customer helps too.
Germany has also a rather non-credit oriented mindset, people don't like taking up debts or credit, a debit card is usually prefered by everyone, seller and buyer.
Except they suck in other ways than the regular US banks.
The main constraint has been more related to operations. There are thousands of people whose sole job is to process ACH files. They mostly work at bankers' banks and corporate credit unions (credit unions' banks). But also at financial institutions that range from under $1mm in assets to over $100bn. Most of these jobs could be fully automated away, but they haven't been yet for a variety of reasons.
[0] https://www.europeanpaymentscouncil.eu/sites/default/files/K...
> a few months back
:-)
And as the sibling post mentions, it's a new type of transaction. Regular money transfers have to clear on the next day.
I don't do transactions after 6pm or so, therefore no experience that late. All of this only applies to banking days, no transactions get processed on the weekend.
[0] https://medium.com/@etiennebr/swish-the-secret-swedish-finte...
[1] https://www.bankid.com/en/
Edit: Clarification of who can receive your money transfer.
It has become a huge hit the last year. As for why I guess it's almost as fast as cash and you can add a little note so you can prove (rarely necessary but sometimes useful) that you paid.
Now a number of companies are also embracing it and I've started to receive invoices on Vipps. If it could be the thing that kills "Avtalegiro") I'd say that would be great.
What’s interesting is that next year most of the banks seem to be launching an instant bank transfer system - big interbank implementation. Right now it takes generally 1 business day if you’ve transacted with that account before and 3 business days if you haven’t. I assume that’s some kind of anti fraud but not 100% sure.
There's the most kickass Bill Pay system ever and DEFT, which allows paying by several methods including the credit card, potentially gaining reward points for paying rent. (Reward credit cards may be pricey though.)
Overseas wire cost a measly flat AU$20 a few years ago in WestPac, local transfer was free and quick to a low-risk recipient (and most recipients are reasonable enough to go on with a transaction if you send them a PDF proving you sent the money). If you run a business, your company account can be accessed via the same customer ID.
Suspicious transactions are spotted and the bank calls you if they suspect foul play; the false alarms are rare. Fraudulent transactions (at least minor) are reversed - happened to me once and to my wife several times. No US-like secrecy for bank account numbers, you normally publish your bank account for the people to make transfer to. Tokens are used for business accounts, while the consumers don't have to bother with these.
There's generally no banking fee unless the account is dormant, and then it's about $5 or something (not $20 - $40 like in the US or Singapore).
Nobody uses cheques, obviously (although they do exist).
In terms of foreign currency transfer, there is also OFX, a nifty service where you can keep your incoming funds until the exchange is more favourable (nope, Transferwise doesn't have it), and that charges you the fraction of what the banks take.
Cheques are now mainly used for business to consumer payments, and for large value transactions, where it's done as a bank-drawn cheque usually.
The bank I use doesn't have a branch anywhere near where I live, so when I got sent a cheque a while ago I had to ask how to go about depositing it. Turns out the bank I use for my credit card will happily accept them via their ATMs which print out a receipt with a scan of the cheque.
The last cheque I wrote was two years ago for a house deposit. I think the second last was 9 years before that for the deposit for our previous house.
I vaguely remember a couple of times years ago (late 2000s, I think) I had a cheque sent to me, but it was done electronically in most cases. Point taken though.
> and for large value transactions, where it's done as a bank-drawn cheque usually.
True, but a bank cheque is a different thing altogether.
fwiw Transferwise has had this for around 3 months now: https://transferwise.com/borderless
The borderless accounts are:
1. Limited to a handful of currencies. OFX isn't.
2. In the US at least, can't receive international transfers. OFX can. I'm sure there are other limitations, too.
3. It's unclear how much is to be paid to transfer the money from the borderless account to yours. OFX charges nothing to keep the incoming funds "in custody" for up to a month.
CommBank dropped an absolute mint on it, with a goal of sub-second transactions, with decent fraud protection.
After a bunch of talks between the big banks, and VISA and MasterCard, and a little bit to do with the ombudsmen from various government branches, it was decided to share out that architecture, including fraud protection.
The fraud protection is actually really good, and thanks to actual cooperation between the banks, reimbursement is a fairly likely scenario.
Other than that it's mainly consumer protection and the EU attempts to standarize everyhting vs. US less restrictive and more, leave it to the market to establish standards.
For historical context the Europe had a head start when it came to mobile with their implementation of the GSM standard where as the US was mostly left to find a winner between competing standards.
The EU have not specific advantage to the US today on the contrary one might say.
So basically what you have is a EU who are forcing standards down on countries vs. a US which let the markets mostly figure things out by themselves.
As a private individual or person doing business in the EU I don't have to care about the different gateways in various EU countries or the difference between ACH and wire. I just make a transfer via online banking or authorize a SEPA Direct Debit withdrawal by ticking a checkbox in an online shop. There's zero friction.
Whether the transaction is completed instantly or within a business day usually doesn't matter much. There's no faffing about with paper cheques (because seriously what century is this) and I don't have to talk to any humans to do it. Rent and utilities are deducted from my bank account every month until I revoke the authorisation.
Watching American sitcoms with mom or dad poring over a stack of bills and writing cheques seems like a flashback to the 1950s.
EU is trying to solve a bunch of things through legislation which the market should be solving on it it's own.
Maybe because they know that the market doesn't solve such problems, it only makes them worse. Market players profit from creating barriers for customers and keeping the system balkanized; it takes a strong actor outside of that market to force a common standard.
See also: why sending files directly between a computer running Apple's OS and one running Microsoft's OS is so ridiculously complicated.
Between European bank accounts in the same country. Also, not every European country, unfortunately.
> paper cheques don't exist since over a decade
They still do. They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.
Currently there are 34 countries in the SEPA (Single Euro Payments Area): https://en.wikipedia.org/wiki/Single_Euro_Payments_Area
SEPA rules specify that you cannot charge more for transfers between different countries than you would for a local transfer.
https://europa.eu/youreurope/citizens/consumers/financial-pr...
"If the payment is in euros or Swedish krona, they should not charge you more than they would for a national transaction of the same value in euros.
Unless I'm mistaken, transfers in Europe are by law required to cost the same inside and out of the country. My Greek bank charges 1 euro for a transfer, no matter if the bank is in Greece or anywhere else in the EU. My German bank doesn't charge anything, and I pay my rent from my German account.
> They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.
None of the banks I have accounts with ever gave me a chequebook. If I want to buy a car, I will transfer the money through SEPA, as normal, for free.
I think this is because getting ownership of a car (the keys and papers) has legal implications and so you need an atomic transaction.
https://www.german-way.com/germanys-cash-culture-geld-stinkt...
However, the privacy aspect makes cash usage understandable. But it is somewhat inconvenient sometimes - for example, you generally have to be prepared to pay taxis by cash, not bank/credit card as in Nordics.
Germany is very cash. You pay taxi in cash, you pay the restaurant in cash and you pay the train in cash. Credit Cards exist but largely the EC system is prefered since it's not credit based and pulls from your bank account instead. And I only really fall back to EC when I run out of cash and I know I'm going to be at a place that has a card reader.
We have to request them and pay a small fee for them. They aren’t typically issued when you open the account. You just receive a debit card.
Exceptions may exist. This is only my experience.
As far as I know, it's free between all Eurozone countries. At least I regularly do transactions between countries, and I've never heard it costing a cent.
Also, I've received wrong payments on a German account from French people many times, and they claim it's because their bank charges the transaction and I receive the sent amount minus fees, with no possibilities for them to specify otherwise (that's happened with dozens of different clients, so I'm very inclined to believe them).
Sounds like horrible UX -- how would people be able to pay their bills correctly if the sent value doesn't equal the received value?
Some banks allow you to specify it it's the receiver, the sender or if the fee should be split
Rietumu in Latvia ten plus years ago already was using not just those hopping code authentication devices but also client side SSL certificates (at least for small business accounts, I never had a personal with them). Extremely secure but I wonder how well the generic public would deal with that.
The US required that all exported crypto would be limited, so South Korea instead built their own crypto.
And browsers couldn't implement that themselves (also due to export regulations), so South Korea had to implement it as plugin for the then most-used browsers, which was mostly IE.
But obviously, by 2000, many sites were already using the South Korean crypto, and deprecating it would be just as complicated as deprecating TLS 1.0 or SHA1 TLS Certificates in the US. The browser vendors consider that impossible — the South Korean situation is just as problematic.
Yup. An account reset requires a visit to the bank and you'll get the new password mailed to you via postal service and you'll be required (usually) to immediately pick a new password upon first login.
>and not called wiring, not sure what in english though
SEPA Credit Transfer. Beginning next year banks will also test and deploy an instant transfer variant of this.
>Today mobile auth apps are taking over.
Mobile apps are indeed a lot more popular these days but a second factor is still employed.
SMS 2FA is being phased out (atleast in germany) and current alternatively are either having a list of TAN codes, optical TAN generator or a proper Card reader on your PC.
I think this is in large part due to, atleast in germany, banks being liable for all damages if they can't prove their system is reasonably secure. This makes some parts of account management a PITA since you need to show up at their local branch office but tbh, it's much better than the US.
Bank transfers have always been free. Previously these were called BACS, and took three days. Now they're "faster payments" and are effectively instant. Bills are paid by Direct Debit, which is a pull system, which sounds scary but generally works well.
The United States has around 40x more financial institutions than the United Kingdom (8x when adjusting for population differences). The US has such a long tail of financial institutions because of regulatory and market forces. The US regulators/lawmakers have traditionally provided incentives for smaller financial institutions because of the belief that they fill a very important role in powering our diverse economic engine (a belief I hold as well). This has made change harder to impose and coordinate.
Most United States payment schemes are inherently insecure. Both checks and ACHs simply require the routing number, account number, and name on the account. There is no concept of a one-time use token. So why is the US not plagued with fraud? Our enforcement and justice systems are perhaps the strongest in the world. The secret service and FBI devote an incredible amount of resources to investigating financial fraud, and punishments are typically harsh.
Finally, the lack of new bank charters granted by the regulators (especially post 2008) has reduced competition and innovation in the space. Banks are able to levy high fees as a result. The amount lost to fraud each year is generally more than covered by these fees (with the exception of small financial institutions) so there is not a strong incentive for change.
Giro is I think the standard English term for this although it is rarely used because it is a push system while (particularly in North America) banking systems in the Anglophone world typically use cheques which are pull based.
Even coming from Canada, I was rather surprised at how ancient the US banking system is. Like it was stuck in the 80s for 2-3 decades. They are only now rolling out chip cards and frequently it is chip and sign rather than chip and PIN.
Hah, no, US banking is absolutely in the dark ages. When I first came here they didn't have debit cards FFS. I had to carry a check book and write on it with a pen. They've only just got chip and pin!
At least at that time, at that bank branch, a typical teller's desk included: 1 Dell desktop and accompanying monitor, 1 automatic bill counter, 1 desk calculator, 1 check reader, probably a few pens and some with cute designs on them, a few stationery holders for various slips, forms, notices and marketing materials.
All in all, pretty boring affair, but near as I can tell banks are basically stuffy offices from the 80s. Just swap out the Dell for I dunno, an IBM PC or an Apple //.
I think it's a grass-is-greener thing, and you see the bad stuff for one side and the good for the other. There are banks in Europe too, that suck. I had an account in Bank Austria. The username was a number they gave you, and the password had to be exactly 5 numbers. There was a place in the FAQ somewhere that said you can put any password you want, as long as it starts with 5 numbers, and the reason for that is that only these first numbers are taken into account, because of legacy mobile banking (as in, banking from your mobile via sms).
>>...No backup questions at all. I guess you go to the bank's office if you forget it?
True, then use personalId (or passport in case the account is in a different country), change the wee-calculator thing/reset of the phoneId app also requires visit to a bank office. Some banks support national identity system (Estonia, Latvia for instance).
>>"wiring" money between european bank accounts is free
this is not necessary true, and it's not 'european' but eurozone (which is different). The fee is domestic within the EU zone and depends on the bank agreement, e.g. it can 0.5e or even free
Transferring? That's how it's referred to in my family and social groups.
Many business accounts in Europe do charge per transaction however
You were not required to change the password before using online banking.
The maximum length of the password was 4 characters (thankfully you could use letters, numbers and special characters).
I know an eccentric person that also uses them. When I cashed such a check the eyes of the employee lit up and it was shown around among the tellers after asking if that's ok (which is a bit out of the ordinary as they usually act very discreet and professional) so I'd say that's a rare thing.
Also private banks did not like being regulated by a central bank
They still have weird, mostly paper-based processes and decades-old mainframes (though that's not necessarily a bad thing). Not long ago the 2nd factor consisted of a paper slip with enumerated transaction numbers.
You'd have a hard time finding a bank that allows you to easily export data to accounting software. APIs accessible to customers are something unheard of.
All that nagging aside, a reason for US banks being even more stuck in the 70s might be the success of credit cards. Until the mid-90s hardly anyone used those in Europe and they're still not all that common, which in turn means that most cashless payments happen via some sort of card issued by banks directly.
* Your bank account is attached to a specific bank branch. Even after we moved across town, we always had to return there, like spawning salmon. Moving it seemed like we were asking them to give their children up for adoption. * The hours they were open were bad even by Italian standards. * Lots of little fees and things. Credit cards cost actual money to possess; compared to the US where you get money back if you use one sensibly.
And they've been doing this as a general-case, as systems tend to be global with local characteristics and lots of glue rather than a decade back when they were disparate and lacking glue.
So when, Singapore for example, decides it wants PSD2 too (good example test case r.e. stringent data protection from regulator and competitive market) they can roll-out quickly.
- SMS-TAN, which is vulnerable to SS7 hijacking and name spoofing.
- Index-TAN, aka the enumerated paper slip, which is only "pseudo two-factor": If you computer is pwned, it can ask you for the index matching the attacker's desired transaction.
Indian banking system is actually a joy to use compared to the first world systems that I have seen.
While for instance in France, Orange launched their own bank recently, they're 100% mobile, yet you can request a checkbook (for free, afaik they cannot legally charge you).
The problem isn't that the infrastructure isn't there - it is. Older people and a few stodgy institutions rely on checks, but that's not because they have to.
In Germany, what do people without bank accounts do? In the US, there's a lot of these people, but you (or their employer) can still give them a check and they can cash it at a check-cashing business (ugh) or the bank it was issued from.
If you have an employer, I don't see how you could not have a bank account. Even retired/unemployed, you will need one to receive any kind of pension, benefits or social welfare.
I know that old habits die hard, and France is a good example (cheques could be easily phased out). But governments are able to kill them off when needed. For instance many European countries are lowering legal limits regarding cash transactions, in an effort to curb all kinds of tax avoidance.
[1] https://europa.eu/youreurope/citizens/consumers/financial-pr...
https://www.ssa.gov/pubs/EN-05-10073.pdf
Most of these people do have access to a bank account - most of them are free - if they wanted one, but they choose not to get one for various reasons.
I think in terms of American politics, there would be some resistance in requiring people to have a bank account.
I think it's fair from the government (and employers) to stick to the most effective way to deliver payments, and not enable third party check-cashing business (which doesn't exist here anyway) and/or companies issuing high-fees prepaid cards.
Since we are specifically talking about checks, I'm not sure you were ever able to cash one out without having your own bank account anyway. And even assuming the scenario where you want to walk in the issuing bank, what if they have zero or limited physical presence?
These cards are essentially issued by the government. There are no fees associated with purchases, only fees associated with multiple cash withdrawals in a month (which some banks also have) and with bank transfers.
There's really not much downside to that alternative - it's basically the government creating a limited-use bank account for you and tying it to a card.
> I'm not sure you were ever able to cash one out without having your own bank account anyway.
Why would that be? The only reason other banks want you to have an account is because they can't know whether it's a good check, i.e., whether or not the payer actually has the funds to pay the check, so they need a way of clawing back the money (by drafting your account) if it's bad.
> And even assuming the scenario where you want to walk in the issuing bank, what if they have zero or limited physical presence?
Well, until recently, they would be a pretty uncommon scenario.
I do generally believe that being "unbanked" is a poor decision, but at the same time, I'm a little uneasy at the idea that we should all be effectively forced into participating in the banking system, which, while it is beneficial in many ways, also serves as a key way to redistribute wealth to the wealthy. I'm not a huge fan of check cashing businesses - which does include large companies like WalMart - but if people are really making the free and conscious choice to not have a bank account and they prefer to pay $5 to get a check cashed, well, I would have a problem with someone telling them they have to get a bank account to participate in society, if what they're doing works for them.
BTW - if you have some links on the cash transaction limits, I'd be interested in reading them. It seems kind of crazy that a country could tell its citizens they can't pay in cash above certain amounts.
I'd say more people have a bank account than an Internet connection. OTOH credit cards are relatively rare.
unless your phone is compromised
- ACH in the USA is free and fast (one business day)... and that's the main way of receiving salary, paying bills, etc. Is Europe really any better in this regard?
- No one uses paper checks here either...
Edit: Forgot about this one: good luck being a foreigner paying the USA government for your immigration proceedings... right, all paper...
- Rent payments to independent land lords are generally via a mailed check. - Some monthly bill payments aren't doable online. - Transferring money to people. - Large purchases.
Source on that one? I've found that people outside of the tech bubble use a paper check at the very least once a year and most likely once a month. I have seen plenty of apartments, renters, even a mortgage company just a few years ago that required payment still in paper checks in the USA.
I'm going to assume your suggestion is anecdotal. It is certainly in decline but it's still widely used.
Check out this article https://www.bloomberg.com/news/articles/2017-07-26/why-can-t...
One business day is slow. Not as ridiculously slow as the three business day arbitrary bullshit, but still slow. Why aren't the transfers instant? There's no reason for them not to be.
> Is Europe really any better in this regard?
Oh god yes. Europe has had Giro for a long time. https://en.wikipedia.org/wiki/Giro
Every bill comes with a receiving account number, and where I'm from all bills have been using a standardized OCR-friendly format since the 80's, which means that the payment slip of every bill is identical, which means that when we got internet banking in the mid 90's, you would just type in the numbers from the standardized fields at the bottom row of the bill to set it up. Of course, you've been able to sign up for automatic bill payment since the 90's as well, and on the off chance that you get a bill from someone you normally aren't billed by, all mobile banking apps have the option of using your phone camera to OCR the bill and pay it.
Whereas in the US, sure, most large companies can do automatic ACH withdrawal, but most small companies can't. And if you get an actual bill, no two bills look the same, so you have to figure out what the amount is and where it goes, and you only get the physical address of the receiving company, so if they aren't able to receive ACH tranfers for whatever ridiculous reason, your bank has to mail them a check, which takes five days, for some other ridiculous reason, so you have to make sure the money leaves your account five business days before the due date. (Giro payments are, of course, instant)
> No one uses paper checks here either...
It is possible to never write a check in the US, but it's actually pretty hard. There's a ton of systems and companies and organizations that require you to use checks.
I had to pay my apartment building org $50 for reserving the moving elevator for a whole day. Payment by check only.
I had to pay the final amount for my moving company when they showed up with my furniture. Cashier's checks only. Oh, and cash tips for the movers.
Do you know what I had to do to get a cashier's check? I went to my bank, and I had to WRITE THEM A CHECK for the amount on the cashier's check + their fee, for them to be able to take money out of my account and give me a cashier's check. It's absolutely fucking ridiculous, and noone there saw anything weird about it.
When you move to the US, you cannot file your taxes electronically the first year, and you cannot pay electronically either. So you have to write a check to the IRS. I had to google that shit the first time, I had never written a check in my entire life before that.
I'm renting my apartment from an individual, and she expects a check in the mail every month. Now, I've set it up to pay automatically through my bank, but my bank actually prints and mails her a check. Ridiculous.
The complete and utter shittiness of banks in the US is, for most Americans, an unknown unknown. You don't know it's shit, and you don't know how shitty it is, because you've never experienced non-shitty banks. Since you have nothing good to compare them with, you don't do the comparison, and you don't expect them to not be shitty.
I mean, look at you, you have complete goddamn Stockholm syndrome above where you think a one business day transfer is fast!
(Sorry for the rant, I'm not angry at you, I'm just so frustrated with how shitty shit shit American banks are, and that they never seem to improve.)
I'm not sure if you're aware, but Europe has proper 2FA in the form of a dongle type device, and not this SMS BS many companies in the US use out of laziness. They also need to use this device for not just online banking, but basic everyday transactions.
If theft through online banking even exists, it's at such a low volume as to be irrelevant. Most online banking interfaces are a read-only view of recent transactions. Some provide the ability to transfer funds between your own linked accounts at the same bank. Fewer still provide bill pay for a specific set of partner institutions, and a tiny proportion of the most technologically sophisticated banks provide the ability to transfer money to any arbitrary person. When they do, adding a new payee is loud (sends a bunch of notifications) and requires SMS verification and/or digits off your debit card. The transfer is loud and takes several days to actually happen (so you can cancel it), and is limited to a couple thousand dollars at most. This is a fringe thing that a handful of people use occasionally. Most peer-to-peer transfers are going to happen through Venmo, which piggy-backs off a debit card, or through paper checks. Most online bill pay is going to happen by giving the biller your account and routing number.
The largest vector by far for stealing from a bank account is capturing a debit card number in some legitimate transaction, and reusing it to make fraudulent transactions. The strength of the communication channel between payer's bank and payer is irrelevant, because you don't get to weigh in on debit card transactions (or checks) against your account. They just happen, and then you can dispute them later.
Phishing and other things were a large attack vector until 2FA mostly did away with it.
In the US, it isn't. On the off chance that the capability is there, it's seldom used. You make transactions by telling the other party your account number.
In the country where I live all internet banks supports this. And all of course use 2FA. Most if not all banks here let's me do any kind or transactions. Not just viewing my data but transferring money, buying stock, setting up new bank accounts, pension management and everything else.
Maybe it's the lack of security at your place which prevents useful functionality.
If someone would hack my online banking account they could do quite a few nasty things...
What year is this, 1997? Is this normal in the US? I'm beyond amazed. Using online banking for transferring money is such a normal activity here (has been for at least 10 years).
In general I think the US is comfortable to limp along putting band-aids on broken systems, because the failings are seen as being intrinsic to the "natural state" of things (see also: common law and court precedent reigning), and the losses are ultimately sustainable. The possibility of a fraudulent transaction can never be eliminated, so therefore it's whatever party facilitates/blesses the transaction that fully bears the responsibility. Meanwhile the EU doesn't seem afraid to create new foundational semantics - eg get rid of the concept of "pulling" money, and then dictate that banks cannot charge customers for the equivalent of initiating an ACH push [0].
[0] Bank of America actually charges for this. They also charge for walk-in cashing of checks drawn on themselves - meaning they are inducing their own customers to write fraudulent checks!
Also, something you said in a related comment:
> tiny proportion of the most technologically sophisticated banks provide the ability to transfer money to any arbitrary person
My experience is that every US bank has an "external account" transfer feature (for use with your other accounts) that can initiate ACH credits or debits, as well as a "Bill Pay" that will do ACH credits to any routing/account number. But (as I alluded to) banks limit the dollar amount of transactions initiated through them, as they are responsible for cleaning up any mess due to "fraud".
But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.
KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium).
There's also a popular Python script called xkcdpass [3] which does the same from the command-line.
[1] https://keepassxc.org/images/screenshots/windows/screen_006....
In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.
"That's correct, my childhood pet's name was 1xs3^&szx!@!24"
If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?"
I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."
I have to use HUNDREDS of passwords every few weeks. HUNDREDS! Some for work, some for personal. Occasionally a service gets broken into so I can't have all of them be the same password and I can't have a system where I add, say "FB" to the end of the password to denote a service as that makes it pretty vulnerable.
So I am forced to use a password manager. I hate it and I'm terrified it'll get broken into one day. But what alternative do I have? I enable 2 auth on everything that I can but those are a very, very small handful compared to all of the usernames and passwords I have to use.
How do you not use a password manager is my question.
The passwords weren't horrible, brute-forcing them would have taken a while, but if you have the same user name and password in many services, then it just takes for one of those services to get compromised to have many of your accounts be compromisable.
And generally speaking, unless you're a high-ranking target, it's far more likely for a service to get compromised than for someone to even bother attacking your device.
And yeah, sure, I could have just remembered more different passwords and user names, but I'm a human and that requires effort.
Now when using a password manager, I can easily choose different user names, e-mail addresses, passwords and far more complicated passwords as well. And all of that with basically no effort.
This also improves privacy, as with different user names it's much harder to link up my different accounts' postings. And I can now easily maintain multiple accounts for the same service, too, allowing me to spread out postings across those, so that you can't follow back my post history for all eternity to link up all kinds of information that I've posted over time.
Yes, that makes the physical devices a vulnerability, but the attacker would still need to guess or brute-force the master password to decrypt the vault. It's also a much less juicy target than a million customers of a cloud service.
And as someone else pointed out, using the same password everywhere is a non-starter. Nor is memorizing the passwords for more than a tiny fraction of the roughly 1000 entries in my password manager.
I only have internet banking enabled for my secondary account (which has 2fa) which never has more than £100 in it and I only did that so I could xfer money to my p2p account.
Birth city: Octopus Mainframe Z7X
"No thanks, that information is private and I'd rather not share it over the phone. I know, you're probably going to say that you can't help me without this information and you're doing this to help prevent identity theft but I stand by my choice to not partake in answering your question. Can I speak with a manager?"
That should make for a fun conversation.
Was helping my (Indian) grandfather and came across a similar issue–very little applied to him. We finally got him to settle on some questions, but then when he forgot the password and went back to reset it, it kept dinging him because one of the questions was like “what was your third grade teacher’s name” and he had forgotten how he had Anglicized it.
Yup, I don't mean minimum or maximum, but exactly 8 characters.
That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this.
I bet huge numbers are "12345678" and "password".
Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.
Mainframes are weird, and not all that dynamic.
From what I remember you're spot on, every "file" or "record name"/whatever (mainframes are not unix) was restricted to 8 characters and upper case, also EBCIDIC just because IBM. So many silly legacy things around those mainframes.
That said, they literally never had an outage on it the entire time I was there so +1 for reliability and availability. They even replaced the whole mainframe piece by piece.
Then there’s the State Bank of India’s vertiginous “What is the website that you rarely visit?” which reads like a Zen koan whose purpose is to make you reflect on the unknowability of the answer.
(Although, I think it could actually be a decent one for some people; you could probably mentally associate it with a specific site and have a decent chance of remembering in the future. Not as good as random answers stored in a password manager, but better than most security questions.)
I've been presenting on these flawed questions for years. In one of my demos, we take a volunteer from the audience and we see how many of the top 10 banking questions we can answer from their public Facebook & LinkedIn profiles. I've never gotten less than 4 or more than 8.. and - as an attacker - I'd take those odds.
Interesting to note that overseas support really struggle with a lot of these security questions. So many are central to the Western world and they can't seem to spell it at all because they aren't familiar with our culture.
I never once felt like those security questions are secure at all. Some are just horrible, especially the maiden name one and birth city. Granted, the password manager works well for technical people, but it doesn't work for non techs or anyone who's had a bank account for more than ten years or so.
I always give a fake name/addr/, etc. Very hard to remember all those answers, before I know how to use a password manager.
The assumption is also that your mother's maiden name is different from your own name. Which is a very questionable assumption.
We certainly show our cultural biases when coming up with these questions.
That intrigues me. I can imagine not having a living mother, or even a mother who died before/during/after childbirth.
But I can't imagine how it is possible for a child to have no mother at all. Is there a situation that you demonstrate ?
An adoptee (of a father or fathers) who never knew who their mother was?
An orphan who never knew who their mother was and lived in an institution their entire childhood?
Sure, everyone has at least one biological mother. But there are plenty of people who don't and never will know their biological mother's name.
I'm sure it's secure to use her maiden name as part of my account confirmation, though (/s).
If your bank (or any company who has your gender and birthday) asks you what your favorite color is, they could now come up with stats such as "83% of women in between the ages of 23 and 38 prefer purple". That type of data could be sold to and be used by clothing vendors and other businesses.
It's also 1 more data point collected on your private life.
Anyway, it's worth a shot: https://krebsonsecurity.com/2017/11/simple-banking-security-...
The bank can advertise instructions on how to generate a certificate signing request, have you bring it in when you open an account, have the bank issue you a client certificate and have them give you instructions on how to import it into your web browser. The bank can also tell you to do this for each device you plan to use to access your online account(s).
Banks could provide an incentive by stating that using this is much more secure than just using a password, and that it's also largely automatic (unlike 2FA).
I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out. You are dealing with people who still don't understand why you don't have to double click links since they have to double click apps and don't know the difference between Google, the Internet, and Internet Explorer.
People are often stuck with modes of thought and operation from when they were younger, and for many, that was pre-computer. At work, we got a hand written letter asking for support setting up their account because they were having trouble with their email that their daughter set up (despite ample support options on the site).
I think you're giving most people less credit than they deserve in terms of figuring things out. Yes, there are people who are technically illiterate, but they probably still conduct most of their business in a manner similar to the pre-commercial internet days. That is, they either use the bank teller drive-through lanes, ATM, or go inside the bank to do banking business. They may not even try logging into their online account.
But that doesn't mean that the bank shouldn't provide options for the more technically literate users who either already understand the concepts or can pick it up with some step-by-step instructions.
I certainly don't like banks providing half-baked security solutions like easily guessable "security" questions or passwords that can only be up to some relatively short length and highly restricted character-set which can be brute-forced or easily obtained from a plain-text dump of their compromised database.
I don't think most users would have a terrible time. I think most users would not bother with setting up anything fancy, but could if they had ok instructions. But I think there are many who would absolutely flounder. As a technical person, I would like more security for sure.
"Security" questions should be gone. Everything important should be 2FA or have a key fob. I think just about everyone who has a phone and does online banking can understand "input the code we just texted you."
I still think having certificate/private key imported into my browser as a one-time (or periodic) task more convenient compared to having to use a key fob or soft token from a phone app everytime I have to log in.
[1] https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s...
[2] It's a general problem of people using the same password for one's email account or cell phone service account and their online bank account
We were in the Maxwell Dworkin building, named after the surnames of Bill Gates' and Paul Allens' mothers. Their mothers' maiden names were literally carved in a huge stone sign outside the building.
In India we have SMS based 2FA for transactions in spite of these questions, Some Chinese banks seems to provide HW based 2FA for general accounts.
[1] https://krebsonsecurity.com/2017/12/the-market-for-stolen-ac...
I think best to use a real, but different last name on all your sites.
"Surely financial institutions are more secure" is only a pleasant thought.
no more than 10 characters, no special characters.
utterly ridiculous.
Now its P&NBank.
But they've just relaunched their whole digital banking solutions... its a lot better now.