We Infiltrated a Counterfeit Check Ring Now What? | Hacker News Reader

We Infiltrated a Counterfeit Check Ring Now What?

krebsonsecurity.com

46 pointsjnord61 comments

Cheques? In 2021? Next you’ll have me believing you can scrawl a signature to verify a card payment.

Sadly still a thing.

Wire transfers in Canada (even domestic ones) are not available in online personal banking. You have to show up in a branch or call. Either way you will have to pay stupid amount of money for one. Someone receiving one will also have to pay "administrative fee" for the privilege - iirc it was $10-20 per wire transfer.

All you have are "email transfers" using Interac, which are usually capped at $3000 per transfer & per day.

So cheques. For everything that you can't/won't pay with CC. Rent? Write your landlord some cheques, preferably in advance for the duration of the lease, etc.

After moving to Canada almost a decade ago it felt like I was experiencing late 90's EU banking all over again, except European banking was rapidly evolving then and the only improvement I've seen in Canadian banking in close to 10 years were:

- I could set online banking password longer than 8 characters and use characters other than letters (I'm serious)

- I can cash a cheque by taking photos of it with a mobile app

The only 2FA available for personal banking is still SMS and you have those dumb "security" questions everywhere.

> those dumb "security" questions

Facebook post: "The name of your mother and your favourite colour is your rapper name. What is it?"

Online bank Tangerine password is 4 digits. It’s ridiculous.

I am in France and I always paid house works (roof, floor etc..) in cheques,because it doesn't require me to add a new recipient to my online bank account, which always takes couple of days, and then hangs there until i remove it.

There is also a special type of cheques (inconveniently amd generically named "cheque de banque") , which blocks the amount entirely on the issuer side, which guarantees that receiver will actually get the money. Quite useful when you don't want to walk around with huge pile of cash, because bank wire takes days and you don't want to make one before seeing the goods

> require me to add a new recipient to my online bank account, which always takes couple of days

> because bank wire takes days

Wow that's some stone-age trash. I haven't encountered such garbage in one other EU country in 20 years.

> because bank wire takes days

Wait what? I thought there was a European regulation that bank wires must be completed in less than 24 hours? Or was that Germany only? Most wiring from a German to another German account happens instantly nowadays.

Regular SEPA wires between different banks take about one working day in France. But they can take up to three, legally. And four in the EU. Transfers in the same bank are usually instant. In practice expect a 24h turnaround on a SEPA transfer during the week.

SEPA Instant Credit Transfer is probably what you're thinking about, but it's not universally supported by every bank yet.

Something similar happens in Ireland. The regulations make the Outgoing bank process the Wire rapidly, within 24 hours or much less. However the receiving bank can let it sit to clear for multiple days.

Here it's the older more establishment banks dragging their heels.

Same in the US. We used a check to pay for some work recently but for smaller household services they might accept Venmo.

In the US we have cashiers checks which are pretty much the same as you described. I’ve used them to buy cars.

> "cheque de banque"

This is usually called a "bank draft" or a "cashier's cheque" in other places. But yes, there are still probably some use cases for it.

Banks here in NZ have stopped accepting them in the past few months, they are very much a thing who's time is passing

Checks are still big in the US, no?

Some of our clients still send us cheques (even though we explicitly note on our invoices that we don't take them) while the banks in the Netherlands won't even process them anymore... It's rough.

I find it easier to write/recieve a check and use it with my banks mobile deposit than any of the reinvented wheels.

I don't understand why we can mobile deposit checks, but using a bank app generated and signed jpg check isn't an option.

Email, txt, or even print-mail-deposit.

Recipients could do the same. Mobile deposit app opens the file instead of taking a picture, automatically stamp your endorsement, submit, done. Or print and deposit.

It could have been so simple.

Quite. They're dwindling, but at a slower pace than other countries.

In the UK they haven’t been completely phased out, but I haven’t seen a cheque or a cheque book in the last 22 years. In 2019 only 51k paper cheques where used.

That is to say, other countries have already done it.

1. https://newseventsinsights.wearepay.uk/media/e1mdcljg/pay-uk...

You have, quite understandably, misunderstood that document.

What's actually going on there are still about 250k paper cheques but that document was generated during the period when they were consolidating from an older system which actually cared about physical pieces of paper to ICS, an "Image Clearing System" ie banks scan the cheque and work with just image data. The American victims in the HN linked story already have image clearing, that doesn't fix anything except it saves the banks a small amount of money.

The document shows volumes dwindling at two legacy paper cheque handling organisations C&CCC and BBCCL because those firms literally no longer exist today, the document was produced by Pay UK, their successor in practice, which replaced their paper processes with images. But end users still write and receive physical cheques, it's just that banks don't want to spend money on physically moving cheques. The actual volume of cheques stayed at around 250 000 per year, average value of a cheque about £1500 (so "Buy a used car" money, but not "Buy groceries" money or "Buy a house" money) and total value about £400M (or £400 billion if the obvious typographical error in the column headings is true...). I expect data for 2020 will be very different, due to the pandemic, but that document is for 2018 and 2019.

Cheques are still gradually going away in the UK, I didn't write a cheque in the past five years and most of my accounts have no way to draw cheques against them. But that document isn't the evidence you thought it was.

The only times I've seen cheques in recent years are birthday presents from grandparents. I think they're still quite widely used by older people.

I used to live in a small(ish) town, roughly 6,000 population, and checks were still used regularly. Basically if you had check from a local bank you could use it the same way you'd use a card.

> Next you’ll have me believing you can scrawl a signature to verify a card payment.

I have heard a horror story from a friend who was on holiday in NYC who can't pay at a certain store (I forgot what store, sorry) because the terminals are signature-only (and the card is PIN-only because that makes a lot more sense).

Edit: If I remember correctly, it was resolved by getting a cash advance on an ATM, which a) works precisely because there's a PIN, and b) is frustrating to him because it adds up unnecessary (if the terminal worked) fees.

They didn't have the ability to do a manual card entry? Where I used to work we'd just do manual entry when issues like this occurred.

Check is still the cheapest way to move the money between bank accounts. It's basically free, besides the costs of the check itself.

This baffles me. I have never seen anyone use a cheque in my entire life. Here you can just issue a SEPA payment, free for private individuals and for business accounts.

My parents still did stuff with cheques in the 90s, iirc. Actually paying bills and being paid with them, running a company.

I think the last one I saw was some government agency refunding me 2 odd EUR in the early 00s and I forgot to cash it in for like a decade. (This is all in Germany.)

My wife and I still write a few checks every month (USA). Of course, we may well be the age of your parents.

My previous apartment only accepted check and money order. My last job used to do the same for customers, but I was part of an effort to provide a system for card payments so that’s no longer true.

Circa 2003 I learned first hand that payments from bank accounts (i.e. bank transfers, standing orders, and debit card transactions) were backed by a paper cheque from your bank to the recipients bank - at least within the UK.

The big(ger) banks owned fleets of enormous OCR machines that could read and sort cheques at hundreds per second, and hundreds of employees to read the cheques that the machines couldn't. I was on a team that were supporting the rollout and testing a new set of these machines.

I don't know if this is still the case today, but I was surprised then to learn they were still paper backed.

That sounds insane. What's the average processing time on a payment in that case?

Back in the 1990s, they literally flew these on private planes. It was worth it to get a billion dollars in checks to the other end a day sooner, thereby saving one day's interest on a billion dollars. I talked to a pilot who flew those flights. He said that it would be gone in a year or two, replaced by electronic transfer.

Multiple business days for clearance. This was before BACS and SWIFT, so now I am assuming we don't have the same paper trail.

A transaction would show up on the system as pending pretty promptly, so you could do your accounting etc - but they wouldn't clear until the cheque was received.

In UK you can write a handwritten latter: please transfer £100K to a spesific bank account" and fax it to the bank, they will do it

That’s definitely not true. Every bank interaction is verified with 2FA. They had these cool personal small PIN devices that you inserted your card into, which generates a OTP that you read over the phone.

It’s mostly just app-based now, but they still exist.

https://images.app.goo.gl/BJ6CGR4foeQhRmhw8

I've literally done it a few weeks ago.

You can authorise a BACS transfer on a business bank acccount with a fax if you use Natwest

Ahh, it’s a business account and not a personal one.

Even so, it doesn’t add up. You’re saying anyone can just fax transfer orders to your bank if they know your account number without including any authentication information of any type? And you’re OK with this?

Signature has to match and they do call you to confirm, but your are right that there is no cryptograpgic security, its all judgement call by meat

Well the call back to confirm is an appropriate layer of security (2fa?) I guess. So a more accurate version of the original comment might be “some business accounts can fax requests to their bank, which they then confirm via telephone before doing it”

fwiw, it probably depends on the bank and the customer. I used to work for a large insurance company in London. There I could (and did) authorise 6 digit transfers to new accounts with just a fax with the (perpetually busy) directors signature. One time the bank made a mistake, and one simple phonecall from me was all it took to resolve (with no verification of who I was - unless they did some callerid check?). The level of customer service was astonishing to me, but that account was probably worth it to the bank to eat any fraud until it got too serious.

I think the GP was invoking the fact that a cheque can be written on anything in the UK (though not true anymore for all banks I think) - see https://www.theregister.com/2010/04/09/plywood_cheque/ .

Not sure if you can fax those cheques though.

In Germany too, but your signature needs to match the one on file for verification.

In US and Canada you should be able to do a similar thing by printing your own cheque. Which doesn’t have a standard. It just requires you to have all of the information that you see on the cheque itself.

In France too, officially. The law dictates what a cheque is and it can be a piece of paper with some specific info.

In reality nobody will accept these.

TIL: Americans spell "cheque" as "check".

Yeah, also, most of the world used to pay a bill using a cheque. The Americans have to do everything backwards, and they pay a check using a bill.

Idk, I pay my water bill using a check. I think it’s just restaurants that use “check” to mean bill.

And get a load of this one : the English spell chèque as "cheque" ! ;)

If you doesn't use 'em, you doesn't get to name 'em.

But they do use them? I'm not sure what your comment is supposed to mean.

Americans do. By report, Brits don't, anymore, IIUC.

Does anyone know if any way to transfer money is anything as good as Faster Payments Service in the UK? No limit, free for customer, transfers usually happen in <100ms (unless you have a shit bank that holds onto the money). Works 24/7.

Actually cheaper to send people a penny with a comment attached than send an SMS :D

It's a dream, other than the UX issue of not being very easy to set up new recipients as you need to know account details and generally there's a lot of friction to prevent fraud/mistakes (ie, it wouldn't be very good at a shop).

In the Netherlands we often use Tikkie (and there are a few other apps that work the same.) With this, we use an app that generates a link that we send to the person using whatever method suits, that link takes them through their bank auth flow to make the payment, and you have it in a second or so. This is intended for person-to-person generally and you don't need their account number. All free.

If it's something to be invoiced, the invoice will have their IBAN and a reference code to add, which works more like you describe.

Instant wire transferts. They work in all europe I assume, limited to 1000€ a day, accross banks, no additional service required. The time is mostly taken by typing the IBAN in the first time.

It’s called SEPA instant credit transfer. There can be some bank specific limits, but there’s no general upper limit. Payment is handled in seconds.

> "Nigeria ... is among the world’s most corrupt"

In practice, it means Nigeria has more retail corruption than most places.

The most corrupt countries, by take, are the US and China, but it is concentrated at the top. In China, top-level violations of the law are tolerated as a carrot-and-stick to maintain support for the regime, whereas in the US, top-level corruption is instead made wholly legal.

Russia and North Korea would like to be the most corrupt, but simply don't handle enough money.

Any thoughts as to why USPS et al. are apparently not pursuing this?

FedEx is a private company, only the USPS has actual law enforcement (fun fact: they're the oldest federal law enforcement!).

There are three reasons I can guess why at least the USPIS hasn't picked it up... they're overworked (and understaffed), the reports haven't made it past the gatekeepers (=been binned because it was too confusing), or there is an ongoing investigation that likely has been compromised now.

There will be a "cut-out" I'm naming them Steve, between the scam victims and the actual bad guys. So postal investigators can put hours of work in and tie back a bunch of cheques to Steve from Florida, and they go to Steve's house and Steve quickly admits that yeah, he sent the cheques. But Steve is getting paid $100 per week to send dozens of cheques, and Steve is so dumb his only contact "up the chain" is to somebody named "Bx$cash$$" on Telegram who told Steve it's a legitimate business venture. Steve is completely sure Bx$cash$$ is a 20-something woman from Utah, but the investigators aren't morons unlike Steve so they guess immediately that's a stock photo, and Bx$cash$$ has almost certainly never set foot on any soil with extradition to the US. Dead end.

Could they charge Steve with crimes? Yeah, and I guess if they're frustrated or Steve was obnoxious and unco-operative they will. But he's a dead end, there is no route to Bx$cash$$ whoever that might be, through Steve, and so long as America is a land of morons who dream of being billionaires there will be more Steves so why even bother?

Why would the USPS not simply block the letters, or go to Steve and tell him "stop sending illegal checks". Or add a letter to the outgoing letters saying "This letter almost certainly contains a counterfeit check. Don't cash it and then send on part of the money."

Even if you never arrest the people behind it, you can frustrate their efforts to the point where it is no longer effective for them.

The scammers just move on to a new Steve. It's whack a mole.

there are tons of government agencies who whack moles all day long. We don't give up inspecting food outlets for hygiene because another dodgy van will pop up tomorrow.

Checks are pretty much outfased here the only way to actually cash one is in the bank, and even then you might have a hard time if its foreign.

Reply on news.ycombinator.com