Hacker News Reader

Comment by TekMol | Hacker News Reader

In times of banking apps, why does this not happen to old fashioned bank accounts?

What keeps hackers from taking over someones phone and sending their dollar/euro holdings somewhere?

This does happen. Then they're tracked down and prosecuted and the money returned - sometimes. But the regular banks also put a bit more effort into authentication. And amounts over certain figures attract more scrutiny.

Two specific design decisions of crypto - irreversibility and pseudonymity - make this much harder for crypto.

Banks usually have transfer limits to prevent you from losing 10 million dollars at once.

Because banking transactions are far more traceable and can often be reversed if found to be fraudulent.

"Often" indicates that there are ways to send funds in a way that is not reversible. Wouldn't a thief make use of such a way?

"Often" word is used because it also covers the case of small transactions. As transactions get bigger, systems get slower. I have had personal phone calls from bank to ensure I wanted to send big sum of money.

I guess this is my disconnect or naïveté, but I thought the whole point of crypto is that it’s fairly traceable - obviously, there’s no decentralized way to address fraud, but couldn’t we have a decentralized report system that can warn people before sending tokens to known malicious actors?

A vast system of fraud detection and limits on what can be done to accounts, especially on a mobile app.

If you try and move large amounts of money via your mobile banking app you won’t get very far before you have to show up in person at a branch.

Is that true? What would be maximum amount someone can transfer from their bank account in a given day via the banking app / website?

My bank says the faster payment limit is £25k. They do require phone code confirmation, but that can be hacked.

As an example, someone once had to write me a check for $10,000. The bank transferred the amount incrementally to give the originator time to object. The first day it transferred $100, then $200, $500, $1000, $3000 and so on until the full amount had been paid.

Depends on the bank, account type, and the destination for the funds.

My bank requires in-person to send a wire transfer, meaning in person identification at a bank branch with photo ID and PIN.

You can only transfer money on the app within your own accounts or to payees that are in the system (e.g your utility company, insurance company, etc.) or by using interac e-transfers with a limit of ~$1500.

Even if you’re trying to pay your taxes to the Canada Revenue Agency the bill payment system has a limit that I have hit. You can bet that a review process is triggered when that happens as well.

Any deposit of >$10000 from a wire transfer usually triggers a phone call as well where someone will politely ask you if you were expecting the transfer.

This page has further examples that appear to vary for ACH transactions (one of the more common means for app/website transfers), indicating that for would-be thieves it would be a guessing game, and the limits are generally pretty low: https://www.mybanktracker.com/news/ach-transfer-limits

Just a few from the top if my head:

- Banks limit the amount per single transaction

- Limit on total daily amount one can transfer

- If a limit has to be exceeded for a large purchase they have a 24/7 hotline to authenticate and authorise such a one off transaction

- Additional checks on source of funds when someone pays in a lot of money

- Need for multiple extra factors of authentication when making a transfer to a new payee

- Extra checks including money laundering checks when making transfers abroad

- … and much more

Bank transactions are reversible.

I don't know why people keep saying this. They're often not. There was a case in my country of someone receiving a pile of money by mistake and he withdrew or transferred it quickly and fled the country. I also know someone overseas whose dad lost his life savings through a phishing scam that asked for his password and 2FA token via text message. The bank could only tell them where the money went (multiple accounts in other banks) but not get it back. Elder abuse often happens by the abuser using the victim's bank card and PIN to buy groceries/etc. then also taking money for themselves. The banks blame the victim who broke the rules by giving away their PIN and the abuser says it was a genuine payment for services or rent or whatever.

If your bank's app has a vulnerability that you lose money through, they bank will probably compensate you out of their own pocket even if they can't reverse the transaction.

Reply on news.ycombinator.com