Comment by btbuilder | Hacker News Reader

Comment by btbuilder | Hacker News Reader

Parent Full thread

I think this has to do with a fundamental difference in how sensitive account number and routing numbers are in the US compared with other international financial systems I have used.

In the US, if someone has your account number and routing number you can attempt all sorts of fraud via the eCheck system. People and companies are wary about giving out their account numbers. Providing an account number here is more often used to withdraw money than deposit. These payment services offer an extra level of authentication and authorization that does not appear to be easily accessible in the traditional banking sector.

Meanwhile, in my experience, in the UK sharing your account number is primarily used for other people doing a personal transfer to you. The institutions that can withdraw money directly from your bank account are limited to those in the Direct Debit system that has some vetting procedures and guarantees similar to what you would get in a credit card agreement[1]. This significantly reduces the chance of fraud, even with incidents like when Jeremy Clarkson printed his acct # in a newspaper on purpose [2].

[1] https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...

[2] https://www.theguardian.com/money/2008/jan/07/personalfinanc...

What's the deal with you Americans and your magic numbers?

So you have your Social Security Number that you can't give for fear of someone impersonating you, your Credit Card Number you cannot give for someone might steal from you and now you tell me you can't even give your bank account number.

So you have all theses numbers you have to keep secret because they are the gateway to someone ruining your life, yet you still have to communicate them routinely to a number of institutions in order to function in society. Isn't that a bit crazy?

Yep. So many people are afraid of having a universal system for identifying (and tracking) us that they would much prefer many smaller broken systems used for impersonating us.

Looks like IBAN has a hard time catching on in the US.

I never considered it a problem supplying my banking information to just about anybody who asks for it.

<shrug>

The account number is literally on the bottom of your checks. It's not a secret and shouldn't be treated as one.

Also in Australia/NZ, transfers are two directional as well. But just like the US, transfers happen in batches and through authorized banks (well until very recently when AU implemented instant transfer). As long as it's within the same country, you can track down fraud and close down those accounts.

ACH is the US is restricted in a very similar way. It's very difficult for a non-bank to submit ACH files unless via a bank. The US could easily have a system just like AU/NZ/much of Europe (and in many EU country, they just add a TAN number, a one time non-reusable token to transfer funds).

I wrote a post about this a while back:

https://penguindreams.org/blog/the-american-banking-system-i...

> The account number is literally on the bottom of your checks. It's not a secret and shouldn't be treated as one.

Both parts of your second sentence are true, but, I think, irrelevant in practice: much like the SSN, which isn't meant for and shouldn't be used for identification but nonetheless is, the account number shouldn't be treated as a secret but is, in the sense that banks permit withdrawal activity on the basis of just the account number. They shouldn't! But they do.

The two are highly related, but one is not directly responsible for the other.

The root of of what keeps the "pull" system entrenched is the regime where whomever originates a fraudulent transaction into the network is responsible for dealing with the mess.

This explains why banks have explicit daily transfer limits for their bank to bank transfer feature (and online bill pay) outgoing and incoming, but will let arbitrarily high debit transactions post to your account from elsewhere. You click dispute, your bank sends back an ACH reject, and then the originating bank needs to figure out wtf happened.

This also explains why local banks ACH initiation limits are obscenely low - same risk profile as online-only banks, but they'd rather not have to clean up messes (whereas the online banks are basically forced to be in that business).

This creates a stable system of course, whereby it's in no individual bank's interest to start encouraging push transfers - they'd just have to potentially deal with even more fallout for no gain.

Reply on news.ycombinator.com