Is there anything as pay-in-only bank account? | Hacker News Reader

Is there anything as pay-in-only bank account?

While watching some clips about bank frauds/phishing long time ago etc. it was interesting to me that sometimes knowing your sort code and bank account is enough to withdraw money or create standing order on your account without your explicit permission. I vaguely remember in a documentary to show it is possible, hacker created a charity donation for a reporter who exposed his account number (sort code + account).

Anyhow, I wonder is there anything as pay-in-only bank account? (excluding paypal/stripe and similar)

So regardless you exposing an account -> money can go only in on direction.

If does not exist, why banks have never done anything similar?

View on HN

Sounds like you're from the UK; I think you're probably thinking of when Jeremy Clarkson gave out these details and a Direct Debit was set up on his account using them: https://www.theguardian.com/money/2008/jan/07/personalfinanc...

However the Direct Debit guarantee allays most concerns one might have about this particular attack: https://www.directdebit.co.uk/DirectDebitExplained/pages/dir...

If one presumes that there are exceptions to the "pay-in-only" constraint then it will be vulnerable to fraud one way or another.

Spot on, UK. I was thinking no exceptions, except (I hope this does not defeat the purpose of previous no-exceptions :) ) in the case when you transfer money to another account to withdraw money. Let imagine that customer can set the rule, any type of larger transfer eg.£500 will trigger message and fraud detection algorithm.

I think it is the Jeremy Clarkson one, interesting enough 12 years later, same issue not much technological improvement in the major banks.

or a location & personal yubikey based payout

Can you explain location? and yubikey/code-key are in UK used for access, and if you want to authorize payment to new account, but will not protect you from standing order?

As in the bank can only perform transactions by physically bringing some device to a location maybe authenticate with stars/GPS satellites, magnetosphere readings or whatever. That way you have a solid control over any transaction that is supposed to take place against your account since you would be in-charge of the location

Reply on news.ycombinator.com