Hacker News Reader

Comment by closeparen | Hacker News Reader

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transaction for my account number in their nightly batch, the money just flies right out.

View on HN

It's not, though. The legal system, and your bank will protect you in this scenario.

You would report the fraud, and you would get your money back.

In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you.

Which means if Plaid is a bad actor, or if they lose your password on accident, and your money is taken, the bank will disclaim all liability, and will not be obligated to make you whole.

So, while it might be easier for money to flow out of your account due to ACH fraud, it'll be a lot harder to get that money to come back if it's due to your own password handling mistakes.

It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.

Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.

And looks like author lives in Tokyo, not sure where is he from. The only time I pay with credit card and give power for others to pull automatically money from there is American companies. Otherwise I always do the wire or approve the é-bills manually.

> Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe)

Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file.

I have a business account at my bank, I can theoretically file a direct debit for as much money as I want against any SEPA-reachable bank account (in practice, most banks including mine limit that amount until you can prove, e.g. via presenting a bill, that this is a correct amount) - but if someone disputes it or, worse, files a legal complaint that causes police to investigate and I can't produce that mandate signed/authorized by the customer, I'm in extremely hot water.

What if you produce the mandate signed by someone impersonating the customer? I imagine that is the typical case for ACH fraud. Not everyone has their own ACH connection; you would plug in a stolen account number at some merchant.

To be honest I don't know who is held liable if you can prove you have had a valid mandate, never had to dive that deep into the rabbit hole that is SEPA - and I guess the specific rules depend on the country you're in. I assume though that similar to CC fraud, one or both banks involved eat the loss.

Oh, yea, no doubt that the payment side could also be a lot better. No arguments here.

My only point is that on the payment side, the technology doesn't provide any security, but the legal framework does. But from the password management side, you're in a technology danger-zone for security, and the legal framework says "caveat emptor", so I think that one is the "worse" problem of the too.

But, I agree, the payment side should be improved

These things exist in other countries.

E.g. with e-Invoicing in Sweden, your electricity company, credit card company etc send the bill to your bank, it shows up as a PDF in your online banking, and you confirm or deny it there. If you want it to be auto-confirmed (e.g. utility bills), that's a setting on the bank end of things, not the utility end of things.

A similar thing exists in Norway. For auto-payments you have to register every agreement in the web portal of the bank*, and only after that can they withdraw money automatically. You can also set limits on how much they can withdraw per month, and if you suspect that something is fishy you can cancel the registration forcing them to send you an invoice electronically or on paper.

The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant.

A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds.

So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.

> You would report the fraud, and you would get your money back.

There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?

Yes. At least in Germany (but I believe it's the same for all SEPA transactions), it's eight weeks for the simplified return where you just tell your bank "get that money back, please" and it's pretty much instantly credited to your account. That applies regardless of the legal status of the transaction.

For non-authorized transactions, you have 13 months to recover the money. Since it will have cleared after eight weeks, the whole procedure takes considerably longer and most bank employees will not be too familiar with it.

I had recently experienced that when somebody used my bank account to sign up for Netflix. I only caught it after three months (I mostly blame my bank for not providing a "new ACH transactions" report). Netflix wasn't helpful (and apparently has no interest in stopping this, their fraud detection allowed for creating an account with the legal name "f f", a German bank account and a none-German IP) and my bank immediately reversed the last two transactions (still within eight weeks window). The first one took about three months, but I don't know who or what was responsible for the delay.

US ACH rules are 60 days for consumer accounts, and 3 for business accounts.

> the money just flies right out.

And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back.

This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.

> The system works not by making it hard to steal money, but by making it easy to get back.

In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.

Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed.

I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.

> I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.

Bank of New Zealand online banking doesnt seem that inconvenient, or different, from the American system. add payee, enter amount, click pay then confirm.

https://www.bnz.co.nz/support/internet-banking/payments/addi...

Right, but my power bill, for example, is variable and I don’t want to have to manually pay it every month.

In Australia, I can send money to just about any other Australian with a bank account using an email address or phone number - and it's mostly instant. The fallback is an account number and it'll take a couple of days to go through. There's no charge for this.

In my experience it is really hard to deposit money into another persons account in America. In my home country in Europe, all I need is their account number and their personal id number and I can deposit straight from my online banking system. They don’t have to be in the same bank or nothing.

In America this is so much more complicated. I have a hard time depositing money to my partner outside of my credit union’s calling hours, even though we literally share each other’s accounts.

AFAIK, this is because criminals used to move money anonymously that way, and banks now have more of a legal responsibility to know where money is coming from.

Get yourself formally added as an authorized user of the account and you won’t have this problem anymore.

Or you setup something outside bank account numbers that accomplishes that? Here in Canada we have interact e-transfers via email or text. Have yet to meet someone who doesn’t have it setup and works great and doesn’t require a bank account - only time that comes up is for direct deposit from employers Goverment ect

We still have junk like PoLi [1] which asks you for your internet banking credentials, and government departments use this.

I'm looking at you, NZTA.

Can't wait for the PaymentsNZ [2] effort to be fully implemented and widely adopted, so I can finally use real APIs to access this data, with low privilege throwaway tokens.

[1] https://www.polipay.co.nz

[2] https://www.apicentre.paymentsnz.co.nz

Oh yeah, PoLi is indeed junk, and I've also been surprised to see NZ Govt departments using it. I refuse to use PoLi, and I'll do a bank transfer or pay the debit card processing fee (if it's not exorbitant) instead.

ACH fraud is not that simple to detect or revert. How soon would you know if $500 exited your checking account? If it's a small-business account, with most banks, you have 24 hours to report each debit that you want reversed. If it's a personal account, you may have up to a month. But the same merchant account can debit your account again, even while you are reversing their previous debits. You can't block them with a personal or basic small-business account, you have to upgrade to an account that you always keep $100K in.

The banks' suggestion? Close the account, open a new one, and never give anyone the account and routing numbers. Never write a check from that account. Use the bank's web site to initiate bill payments – they'll get checks from the bank's account.

Interesting note: you can probably call your bank up and request that the disallow ACH withdrawals from your account if triggered by some third party.

You can still get ACH deposits. You can still use the bank's bill pay and they will send the payments over ACH (so you can push funds over ACH from the account). But someone else can't _pull_ funds over ACH from that account.

Certainly the banks I use have this as an option, and it's useful sometimes. As long as you remember and don't try to pull yourself from one of your other accounts, of course.

Reply on news.ycombinator.com