Hacker News Reader

Comment by manmal | Hacker News Reader

Just yesterday, I deposited money from my bank account to Coinbase via SEPA. Refreshed the Coinbase page, and it was there, ready to buy digital currency with - so, the transaction was instant, or almost so. The transfer didn’t cost me anything, and neither did it Coinbase (it seems). Coinbase seems to be positive the transaction will settle, or else it wouldn’t let me use the money immediately, right? Reversibility seems to be limited for consumers, I tried that once with a fraudulent seller, and the bank basically said I can’t do that.

What’s exactly the catch with SEPA?

View on HN

Leading Payment Engineer of one the most aggressive challenger banks in EU here:

- first, SEPA has several message types

- SEPA SCT: A standard transfer, usually settled the next day - SEPA SCT Inst: a realtime transfer, to be settled within 10 seconds max (check rulebook on ECB website) - SEPA SDD Core: Direct debit, this can be used to pay your utility bills e.g.; though you can revert this one up to a couple of month - SEPA SDD B2B: Direct debit for businesses, this one can't be reverted as you gave an explicitly signed permission to execute those (this one is used between businesses)

So, my idea here would be that COINBASE is supporting/using a partnerbank/PSP which allows SEPA SCT Instant.

Regarding fraud: - if one gets aware of your IBAN, the other party can try to pull an SDD, thats right. But: you can claim this one at your bank and you will be refunded immediately. (with SEPA SDD B2B, this wouldn't be possible as you would have a signed a permission) Though, unless a fraudster is counterfeiting your signature, no one will pull a SEPA SDD B2B. But, sure: Check your accounts regulary.

- regarding SEPA SCT Instant: To execute such transaction, you need to verify it by 2FA. If you give permission on your 2FA device, the money is send out.

- what if you do a typo with SEPA SCT Instant or if someone get somehow around your 2FA? In this case, you could reach out to the other bank with a so called R-Transaction, though if a fraudster is aware of all this, i'm pretty sure the person is capable of managing the rest of the track to pull the money out by doing additional subsequent transfers to other banks

P.S.: As far as i can see, Coinbase is not running through us, you may check your bank statement to see which way the money went ;-)

Thanks for this comprehensive answer!

SEPA SCT Inst is really great but banks seem to be dragging their feet on implementing it or charge a premium for using it. Probably the prospect of losing their juicy payments card issuer transaction fees isn't super appealing.

For the customer? Basically this:

> the bank basically said I can’t do that.

For the shop? I think it's mostly that software solutions are incredibly US centric (or more accurately, not EU centric enough) meaning SEPA always stays an afterthought.

I also want to mention SEPA direct debits. They're great from a the customer's perspective, especially for subscriptions and the like.

SEPA goes both ways, as opposed to what the article says

It goes in the "direct debt" way as described, so your electricity or broadband supplier can charge you every month automatically

But you can also "push" a payment to someone else (or yourself, of course)

Not sure about fraud, from what I know, everyone that does a direct debt has an identifier that can be revoked in case of fraud. So it can happen, but there are ways to block fraudulent chargers.

According to article there is a huge amount of SEPA fraud going around because seller receives you banking details. Unauthorized direct debit maybe?

I don't doubt there is some SEPA fraud but 'huge amount' is something that requires some proof. Personally I haven't seen a single instance and that's with all of my banking details public and many thousands of transactions per year across 10 different bank accounts (three companies, and a bunch of private accounts).

Yeah that confused me about the article. I've never heard of SEPA direct debit fraud, as my understanding is that SDD requires a notification to be sent before any debit is initiated to give time to the user to block it.

It surely can be an issue but I'm not familiar with people refusing to share their IBAN number because they're afraid of random charges, which is a thing for ACH numbers.

The article misrepresents how direct debit works. Just having your bank details is absolutely not enough to initiate a transfer: the user must confirm it by issuing so called direct debit mandate. This mandate usually has a limit on the amount, and can be revoked at any time. Also, the business faces penalties for repeated failed transfers.

The point is that SEPA direct debits are revokable. And by revokable, I mean they are revokable up to 13 months after a transaction. How easily it is depends on your bank : on some banks you need to send a paper letter, on one of my banks, you need to contact the customer service, on the other, reversing a SEPA debit can be done with a simple button on my web interface.

SEPA push, whose are, by definition, manual actions from yourself via the web interface of your bank are not reversible. But that’s probably not the most frictionless method so it’s rarely used other than people to people transactions, between your own bank accounts, or for really big purchases like buying a car.

I pay all my bills with push method. Thankfully most of them appear as digital bills in my bank so I just get list and accept them if they look about right. I would never set up direct debit. I don't trust anyone enough for that.

Reply on news.ycombinator.com