Hacker News Reader

Comment by PaulDavisThe1st | Hacker News Reader

This does not negate the parent post at all. You're just describing another deficiency of the US banking system.

Out of curiosity, how do European banks avoid this issue? If my debit card or ACH info is compromised and someone drains my checking account, is there a way to use the stolen funds before the bank/court finishes their investigation?

The law says that the bank needs to give back your money immediately, at least in my country. If it turns out that it was your fault you don't get to keep the money, but you will have money to pay bills with during the investigation.

Laws and security adapts to whatever medium people tend to use, so common problems tend to have solutions. The laws in Europe are made to make debit card transactions and security reasonable, because almost everyone uses debit cards.

US law does the same thing. But you need to deal with it.

My credit card was compromised and AMEX has a problem. My debit card is compromised and I have several problems.

Giving someone your bank account number (~EU ACH info) only allows them to send you money, not take it from you. It's not a secret, some retail businesses list it on their websites.

How would they drain your bank account? There's quite a bit of 2FA they'd have to defeat. Easiest is stealing the card after skimming their PIN, but if you know it's stolen, you're going to block it pretty quickly, and there are limits to how much you can withdraw from an ATM.

The big problem with credit cards is that all the info needed to authorize a transaction is right there on the card. The second problem is that quite often you submit that data directly to the merchant or to whichever payment provider the merchant chose.

In the US, automated payments tend to be "pull based", where a company tells your bank "give me this much from this account, I have permission". The company can lie but, by the time you find out, the money is already gone and it can take a long time to get it back. The bank has no real incentive to get your money back.

With a credit card, on the other hand, you see what was taken _before_ you pay them. So you can tell the credit card company "this amount that was charged to me is not me, I'm not paying that". Then the credit card company has to look into it; they have incentive to figure out what happened (unlike banks) because they aren't getting payed back their "loan" to you until they do.

In India, now you have to approve all such scheduled payments with a 2FA and upto a limit. So even if I have approved ShadyCorp they can't demand more than approved amount.

Dutch banks used to work like that too, by "incasso", and in fact still do to some extent. But any incasso that hasn't been directly authorised by you with the bank can be undone (and apparently at an additional fee to the company that originated it; they really don't like it when that happens). So that's actually very similar to how credit cards work, but without the additional fee. These days you can easily manage all upcoming incassos through your banking app and block them before they happen, though I generally prefer to pay such recurring payments through automated "push" transfer.

The problem is that since direct debits are so easily reversible, in Germany they are not seen as a final form of payment (until the charge return time limit expires) as there is no form of dispute arbitration involved.

Merchants will usually not ship goods or provide services for a direct debit alone.

In Netherland incasso is mostly used for recurring membership fees, not the purchase of goods. Those are generally done through a direct, authorised transaction, which isn't so easily reversible.

Technical exploits are only a subset of fraud. Scams bypass 2FA with no problems.

A gun to ones head is one universal way to drain any bank account or bitcoin wallet.

AFAIK none of the banks will reverse this activity, since technically you've authorised this transaction.

> The big problem with credit cards is that all the info needed to authorize a transaction is right there on the card. The second problem is that quite often you submit that data directly to the merchant or to whichever payment provider the merchant chose.

Same with my (UK) DD card, when I use it online. I occasionally get challenged by Visa/Mastercard for some passphrase or whatever. For retail purchases, I can usually just swipe. Periodically I'm asked for a PIN.

I prefer DD over CC, because I have full control over my liabilities, should someone try to drain my account, just by adjusting the balance on the account (and I can't link my deposit account with the card; so that's where the rich pickings are kept).

Also, way back when, I was pretty relaxed about credit balances, and the CC company kept raising my limits; I got into a lot of debt. Nowadays I don't use credit unless I'm forced to (which hasn't happened for 20 years). So I have a CC, with a zero balance (and the CC company is going to shut it down, because I'm not using it).

There’s a lot more approval-related stuff and general friction.

When you know someone’s bank account number you can only send them money. This issue simply isn’t possible.

That's not true. As a business, at least, I can run an ACH Debit[0] with just a routing number, account number and name. NACHA rules prohibit this, but nothing programmatically prevents this from happening.

[0] https://plaid.com/resources/ach/how-does-an-ach-transfer-wor....

u/vimy was talking about European banks. There is no "pull" there. People freely share their account info because one can only push money in with that info.

That's still not true. Pull-based schemes are widely used across the SEPA region and in national schemes such as the UK's Direct Debits.

A notorious celebrity in the UK famously revealed his bank details as a stunt to show that a large-scale data loss incident wasn't a big deal and he ended up making an unexpected payment to a healthcare charity shortly afterwards.

I don’t know about the UK but in my SEPA country only companies can create pull-based schemes and they can’t do it without authorization of the bank account owner. Mostly used for things like utility bills. So there’s zero danger in sharing your bank account number with someone.

1. It's easy to setup a company 2. There's no validation that the direct debit is being setup by the account owner

1. It’s a bureaucratic mess. And scammers will also need to deal with the bank first. 2. With a paper form they need your autograph and other ID data. Or when it’s digital you need to authorize the request with your banking app.

In the UK it's £10 to register a company online in minutes.

Direct debit instructions require nothing beyond a name and account number.

Quite the opposite – SEPA direct debit is an extremely successful payment scheme in many European countries.

Note that, at least in France, you can't do a SEPA direct debit with only the account number.

You need a SEPA dd "mandate" which is a (paper or electronic) document account owner asks their bank for, containing a unique identifier

Its called Direct Debit guarantee, UK had it for decades:

"Immediate refunds. You can get a full and immediate refund from your bank (also known as an “indemnity claim”) for any payment taken in error."

https://gocardless.com/guides/posts/dd-guarantee-in-plain-en...

Who defines whether a payment is or is not in error? Has the USA really made me that cynical?

You (the account holder) do. Direct debits are instantly reversible for a month (maybe 2?).

You'll have to explain to the company that deducted the money why you reversed the charge though, and if it was legit after all you still need to pay them.

There's no time limit for reversing direct debit transactions.

https://www.cleardebit.com/indemnity-claims/

There is. It‘s 8 weeks (for any reason including "I‘d like my money back and rather do something else with it") or 13 months (for unauthorized charges).

https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...

Out of curiosity, how do European banks avoid this issue?

In the UK we have a system of Direct Debits that is popular particularly for making recurring payments like household bills or subscriptions. You provide your bank account numbers to the merchant and they can collect the required money directly.

It sounds like a huge opportunity for abuse by merchants but the easy setup is balanced by a universal Direct Debit guarantee for account holders that basically says if any erroneous charge is made then you get your money back from your bank first and questions are asked later. Merchants are required to provide all customers who pay this way with certain information about the guarantee scheme (and everyone actually does).

That in turn sounds like an opportunity for abuse by customers but having personally run a business that accepts Direct Debits I can tell you that we have never seen a single abusive reversal of a Direct Debit payment. In contract we've had a few problems with legitimate charges to cards being reversed later and the whole system around chargebacks with credit cards seems to be unreliable for both merchants and cardholders.

German banks require the account owner's permission to pull money from a bank account and the owner has a 6 week window to get all their money back, no questions asked.

"SEPA Lastschriftverfahren" is what it's called.

> If my debit card or ACH info is compromised

There's two ways this could happen, but neither is super easy:

1) You've handed over your physical debit card and it's PIN code to a baddie and not informed your bank. Unlike the security code on credit cards the PIN code is not on the card. Unlike credit cards you need the actual physical card to transfer money.

2) You've given a baddie your online login info and had him send you a QR code which you then scan and approve the amount.

Notable what does not happen, which does with credit cards, is making a payment at a webshop and that webshop then leaking your card info to a baddie. No one other than the bank ever sees the "secret" part of the card info.

It happened to me at a French bank. I got refunded everything within a few days, I just declared it to the bank.

At least in Germany, the dispute process for bank account debits is literally clicking a single button in online banking.

No proof or even reason for this is required in the first 8 or so weeks since the charge (or more than a year if the debiting merchant does not have a "direct debit mandate", which essentially means some sort of evidence of the account holder agreeing to be debited).

Can you explain how this is a deficiency of the US banking system?

According to stats I can find, the European central bank reported 1.03B Euros of fradulent transaction via cards back in 2019 (https://www.ecb.europa.eu/pub/cardfraud/html/ecb.cardfraudre...).

So the only way those fraudulent transactions won't hit your bank account is if your bank account is not directly tied to the card, which makes it a credit card by definition (because you are being given credit for purchases and not having to pay for it immediately).

So it seems like what the parent is saying is true outside the US as well?

There are always scams and exploits. Legal consumer protections are necessary regardless.

Reply on news.ycombinator.com