Chase did a bad thing, so we did a good thing

Bravo. In my view, this connection and upside was made appropriately-clear in the "Who are you and why did you build this?" section, and the context from the logo attached to the site.

Very clever marketing, good on you for managing this, and I hope you see a great return for your efforts.

Good points and I appreciate what you write here.

And an interesting business concept - to help consumers pursue individual arbitrations. That could be really cool especially against large corporations when they are abusive. What do you charge as people go through their individual arbitration process/ how does the profit model work?

I really have mixed feelings about the legal system - on

Also, Radvocate, wondering if you can address the PII concerns other's have raised, as that is a very big deal.

Hope your site is secure. And I don't mean TLS. Collecting that data paints a giant bullseye on it for hackers.

Good transparency here, an appreciated and professional online reaction to criticism.

I hold PoA for my father- what's the best way, using this form, to say they're his accounts, but I'm the one filing the letter on his behalf?

Great Comment.

It's a standard HN (and wider society) complaint that makes very little sense: the best case for corporate behavior is having incentives that are aligned with the consumer or whatever your definition of societal good is.

win/win

>we give users a way to download a form letter instead

But you don't just let them download it. You make them give you their email address first.

Edit: Haha! No wait, you have to click through two levels of "Don't want to give us your info? Click here to get the letter". The first one asks for you email, only after the second do you actually get the letter. Why? They already said "dont want to...". Just give it to them!

Edit2: Also the form letter, prepopulated with the Chase customer service P.O. box address, is another scam pitfall. Anyone using this kind of form letter should always check the address with the financial institution before sending any forms, especially that include PII/financial information.

You're teaching users it's OK to give out their account information "sometimes". Which is much less secure than "never".

Chase didn’t set up a website asking for account numbers. So how did Chase create this problem? What exactly have they done wrong? If someone disagrees with the policy, they can opt-out, so what’s the problem that causes someone to need to give a bank account number to a random website? Why not just disclose in big letters what the site is all about: lead generation for a law firm? This isn’t some kind of “we like to help people,” project any more than ambulance chasers seek “justice.” There is a place for lawsuits certainly, but let’s not pretend this is about “helping,” it’s about lead generation.

Is the form letter generated on the client-side?

Collecting/storing credit card numbers, names, and addresses is creating a whole new problem for users.

I don't see how that's relevant to what I said. The problem I was citing was the encouragement to put this info into a Web form on an arbitrary site. You should always be discouraging that.

Do you have a link? This is exactly what I want.

If you expect customers to print out a template, obtain postage, and mail it, your expectations are too high.

They offer a template as well

Oh dang. So this whole thing is just a big data grab. Even if they aren't going to make fraudulent charges, that's a clear ulterior motive.

How does this shit get thought up? Their security team was cool with this? Mind boggling

Just a layman here but that seems like a misinterpretation of the statute? The idea of the statute seems to be that the government will not void, nullify, or refuse to enforce the terms of an electronic contract. It does not state that in any given contract, private parties must accept the terms signed in any form whatsoever -- that's still left as something for those people to agree on, and Chase very clearly spelled out that that's not valid for the contract. So the "reason" for the invalidity of a contract wouldn't be that it has an electronic signature, but that one of the parties simply didn't follow the terms it set for validity (whatever they were -- in this case, that they be personally signed, and mailed by the actual account holder). So I'm very curious how legal opinions interpret the statute otherwise, since I don't see any hint that it was intended to be interpreted as allowing one of the parties to change the signing terms to include electronic signatures.

Edit: dumb question from me. I didn't follow the flow because I don't have a chase account, so I wasn't aware it was a multi-part form.

Original comment below:

---

I'm likewise not an attorney, but how hard would it be to do a simple "Type your name here to represent your signature" type of deal? This is the most common lay practice I've seen, with the more common CYA practice for electronic records being e.g. what Docusign or Adobe offer, or the use of cryptographic signatures.

It's called the "golden rule", they who have the gold make the rules.

OK, seriously, they don't technically get to decide what makes a binding agreement, a judge does that. But US law and US judges are very business-friendly. I mean there's the whole invented crime of "identity theft", whereby a bank who is defrauded by an individual gets to pass off their victimhood to a completely uninvolved third party.

I'm a US attorney but not in contracts. Contracts is a fairly complicated area of law, and the fundamental common law of Ks that you study in law school tends to be very different from how Ks work "on the ground." Most notably, statutes currently exist that change the way this common law operates in sometimes non-obvious ways. Standard disclaimer here that this is in no way to be construed as legal advice, this is not my area of expertise; take this as high-level background.

Essentially, under the common law here, all that a contract needs in order to be valid is three things: a valid offer, a valid acceptance, and valid "consideration," where consideration is a legal term of art referring to 'something of value' gained through the agreement.

The idea is that, there is no servitude. Companies can offer whatever terms they want (subject to a very few number of restrictions, dependent on the industry/regulatory domain). You are under no pressure to accept. You can easily reject the terms by simply not using the product. Courts have generally been reluctant to prevent parties from agreeing to whatever lawful thing they want to agree to. The main exception is that you cannot have contracts which serve 'an illegal end.'

In the US, there's no need for a contract to be written or overheard at all. There need be no written document, no witnesses, no record whatsoever. So long as there is a valid offer (obvious jokes are not held to be valid offers, for instance), valid acceptance (you generally need to affirmatively signal acceptance, but this need not be oral or even explicit), and valid consideration (really nothing more than a formality nowadays, this is why many deeds say "exchanged for consideration of $1"), the contract is valid, even if it only exists in the minds of the two parties.

Obviously, proving such a contract can be difficult, but it can be done, particularly if the parties were acting in accordance with the terms of the claimed contract. If we orally agree that you will start working on building a shed for me, you buy supplies and deliver them to the site, but then stop work, you can't claim the contract never existed, because you've acted in accordance with that oral contract.

In this area specifically, there's been some progress made in getting the courts to understand the enormous power differential at play here. You nearly can't survive in this country without at least one credit card, and if all the major companies' cards have terms like this, then you don't really actually have a choice in the matter. It's been a slow process however.

Disagreeing with the terms could close your account, but this section is severable (can be disagreed with separately).

Generally, opt-out is added to reduce the risk that courts will throw out the arbitration clause as unconscionable (unfair). Companies know that most people won't opt out, and any class action brought by somebody who opts out will only apply to other customers who opted out- cutting damages by 99%+.

https://en.wikipedia.org/wiki/Consumer_arbitration#Unconscio...

With a better understanding of how VGS works I really just fall back to my weakest link in the chain questions:

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content (it appears they do)? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?

What stops you from scraping this data from Lob's API?

---

Original comment below.

I'm confused on how this data lands at Lob with an account number if you never get it.

Correct me if I'm wrong but the letter you send includes the account number and not the VGS token?

All of my following questions assumes an affirmative answer.

How is the account number landed in Lob? It appears something must be calling the Lob API with an unencrypted account number? What is making that call?

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?

So how do you send the mail if you never get the data?

FYI - there is some duplicated content under the "How does this site work?" heading.

You shouldn't even be collecting this info.

I wrote to Chase on their 'secure message portal', which feels like it is straight out of 1995. I told them I'm out of the country and cannot send mail.

I told them that I am rejecting the agreement to arbitrate. I also said that since their message portal feels official, this would be what I would use as proof of my opt out in court, if the need arises. I saved some screenshots as well.

They have updated me once already to say that they are still working on a response.

Awesome, seems like a great service. I myself don't think it'll be a good idea to give someone my credit card number.

In another comment you talked about starting another kind of bank? details?

> there's not much we can do

Open-source a script I can run locally to generate PDFs with the information your form uses.

Sending certified mail only can prove that something was sent. Doesn't necessarily mean that the mail you sent contained an opt-out notice.

That was easy. Thank you for creating this!

True. But they've never posted very frequently. So maybe this is just an important issue for them.

Also, are baseless allegations OK here?

This sort of activity and behavior is common on sites like reddit. It's used by media companies and brands, especially as the reach is much bigger than HN comments.

Astroturfing is big business and can be very profitable. An account itself isn't worth much, it's the overall execution that matters.

Can you make the link for the download more obvious and less dark-pattern-y? I found it only after scouring the page (somehow the text under the form didn't catch my eye easily), and then it popped up a modal that unnecessarily asks for my email address. I closed it, annoyed, just barely noticing the small-font link to download without entering my email address.

If you actually care about privacy and claim to not be using or selling our information for anything, why don't you make it easier to avoid giving information entirely?

Having said that, thank you for creating this. I had left Chase's email about the terms change in my inbox, starred, so I'd remember to take care of this, but not having to formulate my own letter makes things so much easier.

Maybe an option would be a client-side only version of this form that onsubmit simply renders a PDF...then users could choose to mail or upload said PDF? (Double-sided for the address bit in a clear envelope window)

Good on you guys for making the thing and showing some effort, wasn't aware of their opt-out policy.

I mean, I believe this is well-intended but Chase is not forcing anyone to to enter their banking info into some random site on the internet. That's something you're asking and, at first glance, it seems completely bonkers.

Chase is not forcing their customers to give you their info.

As for whether you should opt out, I honestly don't know and that is your decision to make.