Hacker News Reader

Comment by dpark | Hacker News Reader

I don't know about you, but I'm not generally keen on giving my account number to someone so they can wire me a few bucks. That's rather error prone and a little shaky on the security side. It can also be rather expensive, depending where you're sending to/from.

View on HN

The IBAN account numbers we use in Europe have a 2 digit checksum against errors (mod-97 - see http://en.wikipedia.org/wiki/International_Bank_Account_Numb... ). Banks are also not allowed to charge more for inter-EU transfers than for national ones, so in most cases transfers are free (because they are free within the country).

The banks didn't do this willingly, they were forced to by the EU.

I think most of the applications (like the ING example) have the recipient supply that information to the sender's bank, not to the sender himself. Not totally sure it works that way in Europe, but I think so.

That doesn't address the error-prone nature. I don't know off the top of my head my account number or routing info. Looking it up is a pain and typing it in can be done incorrectly. This isn't something I want to do regularly.

I'm also not clear how the recipient supplies their info to the sender's bank. If I don't have an ING account, how can they verify that I'm me, and not someone else who's pretending to be me in order to intercept the transfer? As I recall, when I've done wire transfers, I've always been given the account info of the recipient for me to provide to my bank (but I haven't done this very frequently).

Edit: I just saw your other reply where you describe the ING app. I guess that works, but it's rather unfriendly. I'm always a little wary of high-security stuff (such as money transfers) that depend on email, too, but that's also an issue for Dwolla and probably a lot of the other payment startups.

> I don't know off the top of my head my account number or routing info. Looking it up is a pain and typing it in can be done incorrectly. This isn't something I want to do regularly.

But how is that any different from a credit card number? I have all my bank info in my pocket, right on my Maestro card. No expiration date, no CVV code. Just an account number and a publicly-known bank number. If I'm authorizing a direct debit, that's all I have to enter.

My guess would be the size of the collision space. Bank account numbers tend to be shorter, and depending on date of opening and institution, may have been sequentially assigned. It would be much more difficult to accidentally enter someone else's credit card number than someone else's bank account number. In addition, if you accidentally sent $5k to 61-019341 instead of 61-018341, chances are the recipient would be less than willing to be a good citizen and admit it was an erroneous deposit.

UK bank account numbers is a 6 digit sort code + 8 digits account number. The account number is unique for the bank, and assigned however the bank wants. It might very well have been sequentially assigned for some institutions.

The 6 digit sort code is unique for the bank branch across all UK banks, generally the branch on record for the account (most UK banks use the sort-code for the branch the account was opened at). Unless you happen to mistakenly enter an account number and sort-code that matches, and you manage to mistakenly enter the name of the account holder for that bank account, they'll usually catch it.

The situation is similar across Europe, so if this is a problem in the US, it's a problem of the banks own making, and one easily solved the same way it was in the UK: By adding a sort-code, and matching on the name as well.

As davidhansen said, a typo on a credit card number is likely to be an invalid number. In addition to that, I almost never give anyone my credit card number directly. I swipe the card so there's basically no chance that I'll get the number wrong. And the security is addressed by the credit card company, who guarantees that fraudulent or incorrect charges will be credited or reversed. There's no such guarantee with a direct debit, and that makes it a much larger security risk. (This is one of the reasons that Visa charges 2%, of course. You're paying for insurance.)

In practice, you can't type an IBAN incorrectly. The checksum is good enough that I force myself to never check an IBAN I've typed - because I trust the maths.

In Europe it works like this: If you want to receive money, you give the sender your bank account number. The sender can then transfer money to you using his bank's website or mobile phone application. There is no risk involved, because knowing somebody's bank account number only enables you to send them money -- but not to withdraw money. Transactions are usually free, but take one to three work days to complete.

http://helpcenter.ingdirect.com/ingd/Topic.aspx?category=C3B...

This was true sometime ago. Now, the recipient only needs to supply the sender with the last 4 digits. They then verify their own information to complete the transaction.

Look at the bottom of your checks. You give out your account number (and routing number) every time you issue a check.

I avoid writing checks as much as possible in part because of that.

Knuth stopped sending checks for rewards specifically because it turns out that giving random people your account info is a bad idea.

The only thing an account number gives access to is sending cash to it.

I fail to see what negative consequences that have.

How is it any different than writing a check? All of the same information is there, namely ABA routing number and account number.

I answered that.

http://news.ycombinator.com/item?id=3239600

My apologies for being redundant, then!

I have a hunch that the penalties for check fraud are disproportionately severe compared with crimes of a similar social impact. I wonder if the same would be true with ACH transfers. My point is that governments take bank crimes seriously as prosecute them aggressively.

No worries.

I'm sure that the penalties for check fraud are quite high. Nonetheless, I don't want to be a victim of check fraud. It's a massive amount of hassle when you have to fight financial fraud, and sending the criminal to jail doesn't change that.

Reply on news.ycombinator.com