Hacker News Reader

Comment by djsumdog | Hacker News Reader

Side-note for people switching work, move your money from your direct deposit account before starting a new job.

I was talking to a security researcher about a friend who had a full interview with a company, sent papers for hiring, filled everything out, and then discovered the company she was interviewing for was named similar to a real company, with the only difference being a hyphen in the website name. The company was fake and once they had direct deposit information, drained her bank account. She was lucky there was only ~$1k in it. still.

Do your due diligence. Be careful out there.

View on HN

Anyone can do this with a canceled check. If she didn’t authorize the withdrawal she calls the bank and they put the money back. And they start their own investigation. Our banking system is trash but it’s not lawless.

The company committed bank and wire fraud. They’ll get dealt with by the secret service and FBI.

No? I was defrauded by wire and reported it immediately to the bank and law enforcement but “they couldn’t do anything”.

"Direct deposit" is ACH and it is reversible up to 180 days. The parent comment is referring to ACH.

"Wire transfer" could be either Fedwire or SWIFT and it is not reversible.

Correct. Came to write exactly this.

Also, since this is HN: no, Bitcoin or other crypto "transfers" are not reversible.

Parent also said that law enforcement will investigate all wire fraud. My experience shows that is false, and that is independent of the ACH point.

See my downvoted follow-up reiterating this obvious point: https://news.ycombinator.com/item?id=24009403

That would be a non-standard account with a non-standard way of withdrawing money. EFT and ACH withdrawals are fully protected.

Money wires are different, all the action is sender side. Even for me, Fidelity accountholder, a SWIFT money wire takes days to set up and I have to confirm it multiple times. I get the impression the bank hates doing them and will throw as many roadblocks as possible unless you are absolutely committed to it.

You specifically said:

>The company committed bank and wire fraud. They’ll get dealt with by the secret service and FBI.

And:

>Our banking system is trash but it’s not lawless.

My experience is directly counter to that, given that it was a non-investigated wire fraud despite being blatant and the money going to a known local address/account. Saying that ACHs are better doesn't correct those overstatements of yours.

A very different story from my friend still living in Russia.

In Russia, a lot of companies are issuing debit cards for their own employees, and those are often their sole bank accounts, especially for people low on social ladder.

Once the employer got a whiff of the person switching jobs, he fired him, and tipped the bank to block his account on "fraud" suspicion. Banks are known to tacitly play along in such scenarios.

Of course, an avenue to sue is still open for the man, but how do you sue if you have no money to pay the court fee, and your usual income will still be drained if you go to court even for such a trivial case.

The man lost 80k roubles, which also close to around $1k

Advice: anybody in such relationship should never hold any money in "hostage" bank accounts. Always cash out your income from salary accounts, and, for businesses, their merchant accounts with acquirers (paypal, we are looking at you.)

Either that's not a full story, or Russia has some _interesting_ banking system.

Here a card is tied to your bank account but is in no way your account and absolutely not the only way to access your money. Companies only know your account mumber to transfer funds to and sure as hell they have no other access to accounts. It is also hard to imagine why would any bank to want to "play along".

> It is also hard to imagine why would any bank to want to "play along".

More business from companies issuing debit cards for employees. Often such banks are like 3rd tier ones, or complete hole-in-the-wall establishments. Such accounts almost always have near zero interest, or/are laden with high fees for every thing imaginable.

> Either that's not a full story, or Russia has some _interesting_ banking system.

Russia has a very interesting banking system indeed. If organised crime effectively makes a double digit of country's GDP, what else did you expect?

>Either that's not a full story, or Russia has some _interesting_ banking system.

No, we have it in the states as well, see: https://www.nytimes.com/2013/07/01/business/as-pay-cards-rep.... Basically what happens is that you don't get a paycheck or deposit to your account. Instead, you get your pay deposited to a debit card, which you can then use to withdraw money or transfer to your own account. Since the account is technically controlled by the company and not you, it's easier for them to seize your money. It probably doesn't help that russia has high corruption and low consumer protection.

There are a number of banks out there that - once you have an account - you can create additional accounts in minutes. That's useful so you can have one connected to direct deposit for each job, one for Paypal, etc, etc with the bulk of your savings in any account not connected to anything else.

If my mortgage company is compromised, there's only ~3 days/month there's any money in that account.. and then it's the exact amount of the mortgage payment.

Bank account firewalls ftw.

If a company knows your bank account number they can steal the money in the account? Isn’t that the responsibility of the bank then?

How do you drain somebody's bank account with deposit information?

It will not stick and is easily reversible, but I am guessing that if I have the info to direct deposit to your account then in the US I also have enough info to generate fake ACH transactions. It really makes no sense to me though because banks are all over check kiting schemes like this and never let you move the money out of the destination account before someone at the originating bank has reversed the transaction.

Deposit information in the US is account number + routing number, which is all that is required to pull funds from an account. Amusingly, this is also the information printed at the bottom of every check you use.

Wow. I don't intend to be inflammatory, but I am continually shocked by how far behind Europe the US appears to be in terms of personal banking and payments.

It is literally the same in Europe, via Stripe:

https://qry5s.sse.codesandbox.io/

Any name Any email address Test account number: DE89370400440532013000

You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.

It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system.

I would imagine the situation in the US to be quite similar.

If someone does this it is pretty serious. The bank would refund a consumer pretty quickly and the FBI would be calling you.

It would be harder to get back if they did it to your business account and you didn’t notice.

I wrote a post on this years ago:

https://battlepenguin.com/tech/the-american-banking-system-i...

To be fair, in Australia all I needed to transfer money was your name and account number and it'd appear within 24 hours. Since I've left, I've heard the system is more real time, with funds showing up in seconds.

You can pull money from accounts the same way in Australia, but I suspect it's limited by business and there are audits in place to stop and reverse fraud.

deposit information == withdrawal information, and consent to withdraw is often contained in the fine print of direct deposit agreements

The information you need to deposit money into an account (Name, bank account number, sort code) is almost all you need to withdraw money from an account by setting up direct debits or similar.

See for example, Clarkson: https://www.theguardian.com/money/2008/jan/07/personalfinanc...

They probably found a way to impersonate them or through some clause buried in the small print...

Reply on news.ycombinator.com