Hacker News Reader

Comment by radicaldreamer | Hacker News Reader

The chance of $650 million being drained from a game studio’s bank account is significantly less than it being drained from their ETH wallets, at least as of now.

View on HN

And if it was drained from a bank account, you have recourses to get it back.

Not true in the EU, we got scammed into making a bank transfer from Germany to Belgium for a bicycle that never arrived. We contacted the police and bank with all the details, and had to pay our bank about 40 euros to ask the scammer if they would refund the money, they said no and that was it. EU banking laws protected them. On the plus side the website appears to be gone now.

Voluntarily transferring money is very different from having it stolen. The bank should protect your money while holding it from theft. They can't protect you from your own decisions on how to use your money.

They voluntarily accepted a contract wherein they would transfer money in exchange for receiving a bicycle. No bicycle was received, so this voluntary decision does not mean that the money transfer was voluntary. They did not accept a contract wherein they would transfer money in exchange for nothing. Since they did not accept this contract, this does not make the money transfer be voluntary.

Being a victim of fraud is not "voluntary" in any meaningful way.

That's got absolutely nothing to do with the bank. It's between you and the 'merchant'.

> this voluntary decision does not mean that the money transfer was voluntary

Voluntary or not is a red herring. The word this discussion is looking for is authorized.

The transfer was authorized by the account holder. They were defrauded. But when they made the transfer, then intended to do so. (The situation is murkier with credit card transactions, at least in America, because they chose to accept a role in dispute resolution.)

The $625mm drained out of Axie's account wasn't authorized by Sky Mavis. That's a different type of fraud than being ripped off.

In the old American paper check system there was an important but subtle distinction between "fraud in the making" and "fraud in the inducement". If a criminal stole your checkbook and forged a check then an intermediary (like a bank or a grocery store) which cashed a stolen check could be on the hook for the money--if you protested to your bank the transaction could be reversed. However if the criminal simply induced you to write them a valid check (e.g. as payment for a non-existent bicycle) then any intermediary that cashed the check is not on the hook, and the only recourse is to get the money back from the criminal.

Banks won't reverse transfers depiberately initiated by the account holder. You would have had to go through the legal system to get your money back.

But that's a different case than money being "drained" from an account by someone else.

They sometimes do reverse these transactions, but the amount of money involved here (1 bicycle worth) is probably easy for the scammer to put out-of-reach of the bank very quickly -- withdrawing cash, buying gift cards etc.

Yeah, just like they won't reverse cash transaction. Pay someone on street for something, they take the money and don't give you what you wanted. Go to police, and they won't get your original cash back...

That's because you didn't use an escrow service between your account and the seller. If you did, the escrow service would provide some measure of legally-supported reversibility.

€40 is not the same thing. If you got scammed out of €650 million, you would have gotten better attention. That's the point being made here.

You aren't insured for $650M in a bank account

You have a legal system available, and banks that have to rigorously comply with that system.

This is true about cryptocurrency as well.

Where will Federal Marshals deliver the summons to the owner of wallet address 0x8723aa67f823dbe785dc923 ?

What percent of BTC has been stolen? What percent of USD has been stolen?

And that shows the difference in how each is protected.

Interesting thought. Bitcoin circulates, and you have to wonder how much of it has passed through a fraudulent transaction -- at any time in the past. Someday when it becomes straightforward to walk the entire life of bitcoin backwards, there may be people who want their bitcoin back...because it's stolen property.

If A has a TV, B steals the TV and sells it to C, who sells it to D...then the TV is still returned to A, and D is out of luck.

But bitcoin can be mixed, how do you decide which of the next transactions contain your part of stolen bitcoins?

This isn't a single user, FDIC insurance is for $250k per user per bank. The point is that for regulated banks that number is clear and if you exceed it you will be aware of it, and if you haven't exceeded it you have a federal guarantee to recover your money. What assurance does anyone have in this case?

People do not understand what FDIC insurance is.

It protects again bank failure. If the one's assets are drained from the bank, as long as the bank has not failed, it will have to make the account holder whole.

That's why a company would be stupid to hold $200M at Podunk Bank of Littletown, KS but is perfectly fine to hold it in a DDA account at Bank of America, Citi or Chase

The FDIC insurance of $250,000 is by the government in case the bank becomes insolvent. The FDIC can easily cover $650 MM in a single bank that has 3,000+ customers. Or really even fewer than that with multiple account types.

But even then, if you store $650 MM in a Bank of America account, that money is protected against being stolen by BOA's anti-fraud software, laws, the trillions of dollars of assets BOA has.

Depends on if the studio's bank account has security questions like "mother's maiden name", "first concert", etc type stuff and an employee with those answers that like to take quizzes on facebook. Otherwise, it could be quite simple to drain the account

It could, yet it doesn't.

For one thing, most business accounts do not hold 9 figures in cash.

Inflows and outflows are likely to be predictable, so you can set flags for certain thresholds.

A 9 figure transaction would absolutely be noticed, and possibly flagged before it was permitted to continue.

What do you mean not common? Bank account fraud is extremely common here in montreal, it even has a slang name "peter des guichets". It's probably much more common than crypto fraud here, and up until a couple of years ago it was so easy that your average person with no real technical knowledge could do it. Reversing an interac transfert here is just very very hard to do too

Just like SMS access to 'mfa' your bank account also provides an attack vector if they steal your number, stupid (aka all find-able) security questions don't help protect, they are another attack vector. I thought everyone puts fake answers and keeps them in a separate location. Then of course someone can come in an steal them too!

Since 16 year olds can hack into auth providers like okta and then hack into microsoft and steal source code, and this crypto stealing endless happens, there's just not good electronic security. But what is good is I can go to my bank in person and fix things. It would be so much harder for someone to get fake id. I actually have a personal relationship with my advisor at my 401k. Those things do give me some additional security, at least I think so.

Reply on news.ycombinator.com