Hacker News Reader

Comment by TeaDrunk | Hacker News Reader

I’m surprised banks literally don’t have the ability check for suspicious behavior like blatantly having the same account receive multiple unemployment benefit dollars from a state that the person doesn’t reside in...

View on HN

That’s not the bank’s responsibility. This is no different than the issues IRS faced with fraudulent refund activity. Unemployment systems should’ve invested in KYC-like systems, knowledge authentication, etc.

Simply look at the talent running unemployment departments though. No engineering mindset, no accountability, hence financial fraud with no repercussions for government or perpetrators.

For the love of Vint Cerf, please get involved in local government if you’re a technologist. It is the only way this gets better.

Most technologists likely have an aversion to anything as backwater bureaucratic as government “tech” programs. Couple that with pay that wildly trails the market and the outcome is fairly easy to predict I think.

What if the resulting code was open source and someone paid for the effort out of their own pocket. Non profit 18F style. Might even be able to distill requirements from existing code if that code can be retrieved with a FOIA request.

I can empathize with not wanting to work directly for the bureaucracy. There are alternate paths to success.

https://18f.gsa.gov/

Interesting idea! I don’t know how to think about the threat model of “pay for it yourself, and then the government will run your code for essential services”. I suspect there’s a juicy target there, but it’s something I hadn’t considered so thanks for giving me something to mull about.

An independent application security assessment would need to be performed prior to handoff of the code base (with follow ups each time you cut a new release), but if you can meet the requirements of all 50 states (not trivial, but also likely not overly onerous), that’s a huge reduction in duplicated effort.

Glad I could provide something to ponder!

I don't know about the US, but I had the same misconception in Brazil until I ended up training government employees. What I encountered was an extremely motivated and intelligent crowd that, even though they were underpaid, were motivated by a desire to make things work. It stuck with me that, while some companies had the best talent money could buy, these agencies had the best people no money would ever buy.

Besides, even a small government deals with amounts of data that rival larger enterprises.

Why is it so hard to enforce banks to report such transactions? Doesn't the US force foreign banks to report balances of US citizens residing overseas? Oh the double standards.

FATCA is an injustice of epic proportions. You can thank the US government of 2010 for that hypocrisy. It was used by the left as a way to “get” “fat cats” — it’s literally in the name: FATCA(ts.) Chuck Schumer was a highly vocal proponent. Instead it harms everyone overseas while for actual fat cats, it has been business mostly as usual.

I suspect you're being downvoted by US citizens who have never lived abroad and are blind to the difficulties FATCA causes for non-"Fat Cat" American expats.

Your comment is entirely on-point.

Could you expand on that: how does it is cause harm, why aren't overseas "fat cats" affected?

It causes harm to American expats because FATCA's terms are horrible for banks. Basically, they have a whole host of new reporting obligations for their US citizen customers, wherever they are in the world. If their compliance fails, their US operations will be subject to a 30% withholding tax on all transactions. American citizens are the rare exception for banks outside the US and the compliance costs and huge operational risks make it very unattractive to accept US citizen clients. It is very difficult to find a bank willing to take them on as a customer, and those that do often put restrictions on their accounts.

Fat cat expats are relatively unaffected because they can afford to set up all kinds of complicated legal structures, companies, trusts, etc. to skirt the law and anyway have enough money that even with increased compliance costs they are still worth keeping as customers.

Finally, in general, US tax law regarding foreign earned income is completely absurd and nearly unique in the world, and direct compliance costs on expat Americans--for example, FBAR requirements--are equally absurd. I believe this is a result of the structural disenfranchisement of expats in the American political system. Expats vote where they last resided, so lots of places might have 0.5% expat voters, but no one place has 100% expat voters. So no politician has any incentive to represent expat interests.

One reason is that it causes the cost to be borne by those overseas bank, just to address the incompetencies of the US government and the bizarre law to tax its citizens living overseas, which I think only one or two countries do.

Well, no. I wish that was the case but no. You would be surprised how invasive BSA law is. The main reason banks basically gave in on SARs was the legal protection they have for it. This coupled with little average teller is trained results with suspicious activity report stemming from customer saying 'none of your business' to a teller.

And I assure you that when auditors ask an officer question why SAR was not filed ( most recent Moneygram case ), BSA officer is sweating bullet.

So based on current setup in US, it is banks' responsibilty. And just to add to this, this scheme is being actively copied across the world.

FinCEN case link: https://www.fincen.gov/news/news-releases/fincen-assesses-1-...

I think we might be taking past each other. A bank and money transmitters are required to meet AML and KYC requirements (in this case, making sure the illicitly obtained funds aren’t laundered with mules or other means), but I propose that it’s the state unemployment insurance department’s responsibility to put benefits into the right deposit accounts in the first place.

My bad. I completely misread your post. I never thought of that to be honest.

My first reaction is hesitation, but it is mostly, because I am not sure how that would work in practice.

My Citibank credit card pulls in my Chase deposit account details using my Chase login and password (I assume using Plaid under the hood). Perhaps something similar between unemployment systems and your bank, as the bank has already done all of the hard KYC work. They’ve got your PII (including SSN), and your account numbers. Use SSN as the key (I know, I know, we need to get away from the SSN as a citizen ID, baby steps) between the two. You also get to piggyback on 2FA/MFA systems banks have in place.

Doesn't it kind of become the bank's responsibility once they become aware they're holding onto criminal proceeds? Or is that why banks prefer not to pay attention, so they don't become aware of such things?

Banks already have responsibility to prevent money laundering by submitting a form when you deposit over $10k in cash, it’s called a currency transaction report and sent to the IRS.

I'd put it as much on the state. From the bank's perspective it's just an ACH transfer. The state knows what it's for and is arguably in a better position to detect anomalies. And the state should be doing better due diligence to verify identities and eligibility.

States are processing claims in cobol on mainframes from the 1970s. I think you overestimate their data science ops.

They were wiring large amounts of money to people in Oklahoma rather than their own state. That there is no effort put into preventing fraud, which was guaranteed to happen, is down to negligence of the state government. Part of that is on the voters who allocate tax dollars in an idiotic fashion whenever given the chance.

There are plenty of cases where someone would be paid unemployment insurance out of state. The most common one is moving back to be closer to a family support network after losing a job since many people don't have much in the way of savings, at least not enough for a few months rent while they look for work. In most states, unemployment insurance is paid for by employers per worker and after paying in for a certain time, the UI program essentially owes the unemployment benefits to the worker once they lose their job. Where that worker chooses to go with their checks is up to them.

Banks already have fraud protection on credit cards and are responsible for reporting suspicious amounts of depositing (above a certain amount). Thus is the basis of my shock that something similarly obvious isn’t covered.

Why aren't all public transaction public?

Money paid from central government should all be publicly viewable, shouldn't it? Then anyone who wishes could look to see if an account had more than $X or more than $Y transactions, or more than one stimulus cheque, etc?

This is a good question that I’d like answered.

Banks absolutely do have this ability and I would guess SARs from banks are what led to the Secret Service eventually uncovering this elaborate scheme. Though I imagine more SARs would have come from the outgoing transfers (from the mules’ accounts to the criminals) than from the suspicious unemployment deposits. Generally government money is considered “clean” but if a mule suddenly started receiving more money than usual it would be investigated regardless of the source.

I agree, but I hope such analysis requires a warrant or just cause - instead of having banks check their customers activity, it should come from the other side, institutions that send the money out perform a cross-reference for the same person (whether defined by name, account, etc). Then the issue is some people are working, but under the table, and collecting benefits. That’s a bit harder to detect

Reply on news.ycombinator.com