Hacker News Reader

Comment by _AzMoo | Hacker News Reader

How do you drain somebody's bank account with deposit information?

Deposit information in the US is account number + routing number, which is all that is required to pull funds from an account. Amusingly, this is also the information printed at the bottom of every check you use.

Wow. I don't intend to be inflammatory, but I am continually shocked by how far behind Europe the US appears to be in terms of personal banking and payments.

I wrote a post on this years ago:

https://battlepenguin.com/tech/the-american-banking-system-i...

To be fair, in Australia all I needed to transfer money was your name and account number and it'd appear within 24 hours. Since I've left, I've heard the system is more real time, with funds showing up in seconds.

You can pull money from accounts the same way in Australia, but I suspect it's limited by business and there are audits in place to stop and reverse fraud.

It is literally the same in Europe, via Stripe:

https://qry5s.sse.codesandbox.io/

Any name Any email address Test account number: DE89370400440532013000

You can only PUT money in a bank account knowing the IBAN in Europe. Automatic payments have to be formally authorized first. Europeans give it their ibans without second thoughts, never heard of any such problems as in US.

It is called SEPA Direct Debit. You give people your IBAN, and they can take money from it. You formally have to give your permission of course (the "mandate"), but that is really a pinky promise by businesses that they have it. That there is not wide-spread abuse of this system seems to be because of accountability on who is granted access to this system.

I would imagine the situation in the US to be quite similar.

If someone does this it is pretty serious. The bank would refund a consumer pretty quickly and the FBI would be calling you.

It would be harder to get back if they did it to your business account and you didn’t notice.

It will not stick and is easily reversible, but I am guessing that if I have the info to direct deposit to your account then in the US I also have enough info to generate fake ACH transactions. It really makes no sense to me though because banks are all over check kiting schemes like this and never let you move the money out of the destination account before someone at the originating bank has reversed the transaction.

The information you need to deposit money into an account (Name, bank account number, sort code) is almost all you need to withdraw money from an account by setting up direct debits or similar.

See for example, Clarkson: https://www.theguardian.com/money/2008/jan/07/personalfinanc...

deposit information == withdrawal information, and consent to withdraw is often contained in the fine print of direct deposit agreements

They probably found a way to impersonate them or through some clause buried in the small print...

Reply on news.ycombinator.com