Hacker News Reader

Comment by RyanCavanaugh | Hacker News Reader

It's the same question as why people keep so many valuables in houses where you can just break a window, walk in, and take stuff: because you go to jail if you do that.

If ACH was different and you could just, say, walk up to an ATM and punch in a routing/account number and withdraw cash, it'd be a very different situation. You can only interact with the ACH system through a regular bank, and regular banks have KYC regulations that mean the recipient of those funds has a name, address, and SSN. Doing theft via ACH means the funds end up in account clearly tied to your identity, and you go to jail.

View on HN

Bingo. This is something the cryptocurrency extremists just willfully refuse to acknowledge. It turns out that transaction reversibility and the ability (and willingness) of law enforcement to get involved are extremely useful tools in most commerce scenarios.

If reversibility is needed any "cryptocurrency extremist" will tell you that there is no trustless solution to this kind of transaction and that a trusted intermediary (usually an escrow) is needed.

This is what happens with fiat money anyways, it is just so intimately mixed by now (credit cards, ACH, etc.) that you figure it's the only kind of transaction that exist or should exist.

Crypto is providing an alternative to this point of view, if you don't think you need it, don't use it, pretty straightforward... and if you want to stop it because you want people to think like you, try to stop it, let's have fun.

I think it’s the evangelism of crypto that irritates people, not the personal use of it, although there are the obvious environmental issues with that too.

I don't think anybody asked what was annoying about crypto, we are talking about irreversibility and why it can be a useful option for some people. But thanks for sharing your concerns I guess.

you spent the last paragraph of your comment complaining about people having a problem with crypto as if you have no idea why that might be

also perhaps consider taking a less passive aggressive tone. throwaway accounts are not an excuse to be rude

There isn't a single "complaint" in the paragraph you refer to.

If stating the factual matter of what you can do with or against crypto is "rude" to you, feel free to not answer next time, as your whining/concern trolling won't change much to these facts... especially when they don't relate to what was debated: reversability of transactions.

There is nothing inherent to cryptocurrency that prevents the ability to reverse a payment, it can be done in a contract, only both sides must agree to use it. Personally i see the inability of government ( or anyone else ) to arbitrarily modify transactions as crypto's greatest strength. Want reversibility? you can have it. Want a custodial institution to manage your account? you can have that too, Nothing stopping you. The system is flexible and secure in ways the traditional financial system is not.

The parent is referring to reversibility without both parties agreeing. I send merchant money from my bank to buy widget. Merchant doesn’t send me widget. Bank can reverse transaction without needing merchant permission. And the buck stops with the courts who can enforce the final action.

Can you really say this and not see the problem with it? Is it possible so many people have become this utterly complacent they can’t see tyranny when it’s right in front of their faces?

The same banks that caused 2008 and got bailed out can unanimously control transactions. The same banks that cause endless global conflict, that fix elections, that manipulate politicians, that rig the fabric of capitalism and democracy all around the world, that enable socialism for the rich and rugged individualism for the poor…those same banks are the ones you trust to “reverse transactions without permission”.

This is the problem crypto fixes. It removes the banks power. It has reversibility; it just needs to be integrated with the/a identity mechanism and legal system. The main purpose is to cut out the bankers.

I just want to be able to get a refund if the toaster that I ordered doesn't get delivered. How would crypto go about doing that without it being in the sole discretion of the seller?

How do you do that now, with a market like Amazon?

It works the same way. You can introduce voluntary trusted market intermediaries and utilize things like escrow. Big enough markets can provide liquidity such that all transactions appear realtime, but sellers can provide a deposit to the market to cover problems.

That is one method among a gazillion.

We do not need banks. All bank functions need to be mathematically automated with no trusted parties.

There is nothing preventing the use of neutral third party contracts, For example a non profit arbiter of such cases, recognized for impartiality in an open market. Just like the better business bureau, or similar organizations. Merchants can display a "your purchase protected by" banner, the market itself will determine the best form the material incentives for such an organization would take, perhaps "loser pays the fee" could work, or a subscription model, more like a traditional bank.

This doesn't really answer the question though. People steal things all the time. The easier it is to steal the more they do it. Bikes, breaking into cars, purses, etc...

We have passwords and two factor to prevent this stuff for lots of situations but in this ACH case we seem to have nothing. What's special about ACH vs all other situations? Why do I need a password and two factor on other accounts but not ACH? It's just as illegal to break into those other accounts is it not?

You could hack someone's business bank account and ACH debit other people, yes.

But then you have to get the money out of that account, and into cash in your hands without leaving a trail that leads to you. It's possible, but complicated. And if you could do it, there was probably already significant money in the account you hacked into in the first place. No need to pad it with ACH debits that might set off alarm bells.

You can't just take money with the numbers.

You have to be a bank or otherwise registered with the clearing house.

So you can ask your bank to pull money from my account, and if I object my bank will claw back the money from your bank and they will know who you are.

And if it wasn't all a misunderstanding or a typo, then they know where to find you.

You can just take money with the numbers. A business can just ask for ACH account info for payments. That means a customer could use someone else's "numbers" to fraudulently buy thigs. And maybe that other person wouldn't be liable for the fraudulent transaction, but the customer would still have the stuff they bought without leaving an ID behind.

What businesses allow you to pay via ACH?

Off the top of my head, the only ones I can think of are utilities, other banks (so you can make loan payments), and consumer payment processors like PayPal. In the first two, they'll have your ID. In the latter, they do the "make two deposits" thing to verify you own (or at least have access to) the account.

I can't go to Wal-mart and pay via ACH. Do they even take personal checks anymore?

Of course they still take personal checks. How else would elderly granny that does not trust "plastic" pay? Some would do it with cash, but many have paid with checks their whole lives, and will not stop until they drop dead.

And it certainly used to be common for e-commerce sites to accept "electronic checks" by having you type in the routing and account numbers, with no additional verification. These days, there usually is additional verification.

It is still commonly accepted with no verification for payment for things like utility bills. This appears to be on the assumption that if there is check fraud they probably know the guilty party, because who else would be trying to pay your power bill?

> What businesses allow you to pay via ACH?

Pretty much anyone with a Stripe account can accept payments via ACH.

https://stripe.com/docs/payments/ach-debit

I worked at an ISP and we definitely appreciated it when our customers paid via ACH instead of credit card. (Less fees.) We were tiny, too; you don't have to be a giant company to get this going.

Stripe is still "your bank".

Happens plenty in B2B but, again, reputational risk is involved

This business would run the risk of being cut off from the financial system.

Okay, but the business has no way of stopping this attack, so it is fruitless.

The question I think is more “why does someone have to give me their account details and so allow me to remove an arbitrary amount rather than me providing my account details knowing that all you can do is give me money?”

The answer is that people DO steal via ACH, just like people rob houses. They are caught and prosecuted. What makes you think no one ever steals via ACH?

I actually know someone who was a victim of this, they had written some checks and the recipient had used them to make unauthorized withdrawals. I believe everything was reversed after the police got involved.

This. Same as fraud. I could put up a website right now, point some ads to it, and start harvesting thousands of CC numbers to sell. But then I would go to jail.

18 U.S. Code § 1343 - Fraud by wire, radio, or television

https://www.law.cornell.edu/uscode/text/18/1343

ACH fraud is wire fraud

Is credit card fraud not?

"Credit card fraud frequently involves elements of both bank fraud and wire fraud"

https://www.justia.com/criminal/offenses/white-collar-crimes...

> because you go to jail if you do that.

The people involved in money transfer scams are never, ever going to jail, ever.

Wow, you can't do crime because it's illegal!

How do you explain the widespread availability of "drop" accounts in the US? Cybercrime forums are full of people offering services to "cash out" illicit bank transfers into cryptocurrency.

It's not that you can't, it's that the risks of getting caught doing it and punished for it are too high relative to the reward.

If you don't believe that deterrence is a real thing, there is a lot more human behavior that needs explanation than just the relative lack of ACH fraud.

You still don't seem to understand why "it's illegal" is not a great insight to lead your example with. Even if true, the answer would lead with what makes this illegal thing so less prone to violation than other illegal things.

it is illegal and easily detectable

I got that part. Still doesn’t justify a comment that starts with a paragraph implying that illegal things can’t happen because deterrent. That doesn’t help.

no one said they can’t, just this is largely why they don’t. are you going to rob a supermarket where you have to hand in ID at the door? or will you find somewhere easier?

https://www.nbcnews.com/news/world/margaritas-story-how-one-...

https://www.ice.gov/news/releases/russian-man-pleads-guilty-...

They do this, at giant scale. When you're earning tens of thousands of dollars per account, it's worth it to train people to go open bank accounts using fake passports.

That my point: “it’s easy to catch and enforce” would be the relevant fact to lead with, not “duh it’s illegal silly!” The latter is true for a lot of things that aren’t enforced, and is really condescending to start with.

They never implied that it couldn't happen, they implied it didn't happen that often because it is illegal.

Which is a bad explanation. Lots of illegal things happen often anyway. Implying that being illegal automatically contains it is a bad explanation and a bad premise to start from. The question is, why is this illegal thing not more violated? Just like I said in the past two replies.

It being illegal makes parties involved forced to cooperate. If someone hacks your Twitter and tweets something - the FBI isn't going to investigate who did that. If someone commits a wire fraud with your account - FBI will investigate.

How do you explain the widespread availability of "drop" accounts in the US? Cybercrime forums are full of people offering services to "cash out" illicit bank transfers into cryptocurrency.

The question wasn't "why is there NO abuse of the ACH system" it was "why isn't there MORE abuse of it"

The answer is, it is illegal, and easy to catch, so people don't abuse it as much as they would if it wasn't illegal.

>The answer is, it is illegal, and easy to catch, so people don't abuse it as much as they would if it wasn't illegal.

Why is it easy to catch? The OPs premise that you have to provide identification to open bank accounts is obviously false.

Another explanation:

Integrating over all of the possible outcomes of wire-fraud, being put in prison is more likely than making millions of dollars and using them as you please.

Or, at least, enough people believe this, and also prefer not to be in prison, that they do not commit wire fraud. It might also be because it's difficult. (I don't personally know how I'd take up wire fraud, if I wanted to start.)

"Being put in prison" is a likely outcome because of complex and overlapping human constructs that have lead to power structures where other people can force you into a prison. This is why it's relevant that it's "illegal". Briefly, "we live in a society".

The kind of "shape" wire-fraud has (in terms of the likelihood of its outcomes, i.e. very high risk, low chance of reward) is found in many things. A lot of illegal things have this shape.

The above commenter probably assumed all this to be 'background'. With that "because you go to jail if you do that," is a succinct and basically correct statement, even if it is not prefaced with every possible exception.

But wire fraud isn't rare. There are large gangs that specialize in opening bank accounts using fake documentation who then offer these accounts on a variety of fraud-related forums.

Every Eastern European craigslist scammer has access to US business bank accounts to accept payments for their nonexistent cars and boats.

Reply on news.ycombinator.com