Hacker News Reader

Hacker News

Comment by megous | Hacker News Reader

Parent Full thread

megous

Why the extra steps of sending money if the little shit who faked the identity already had the money?

View on HN

Presumably it goes like this:

1. Apply for loan under Bob Smith's name using stolen/forged identity

2. Company providing loan will only send to a bank account in Bob Smith's name

3. Provide the company with Bob Smith's real bank account details

4. Message Bob Smith, "oops, we accidentally sent you $x in error! please send it back"

5. Bob Smith now on the hook for proving they didn't apply for a loan

So bank fell for a con and now Bob has to pay?

The house always wins.

Bob's mistake was sending the money "back" to someone other than the original sender. I'm sure you can appreciate how this appears no different to the sending bank vs. e.g. sending it to your cousin who conveniently lives in another country.

I don't see why that should be Bob's problem. Don't give out loans without proof of identity.

It's not about the loan at that point. It could be a wrong account number, or a wrong amount (e.g. https://metro.co.uk/2022/09/01/australia-crypto-com-accident... ) and Bob would still be liable if Bob moved the money out and was unable to return it.

Bank fell for a con issuing a fraudulent loan

Bob fell for a con by transferring money to someone

So even if the loan is forgiven to bob (which it should be), the bank could argue that those funds that were transferred were bob's own money, not the loan

Negative. Bob did not initiate a loan, and did not have the money to give.

Yes because how would it look different if Bob was playing both the victim and the scammer?

Can't bob see who sent the money, to find out it's a loan company, not the messager?

Yes but people are dumb and do stupid things

Especially when the fraudster says "you can keep $1000 for your trouble if you do it today!"

Would be easier to find Bob's stolen identity information on the darkweb and open a new account under those credentials. If not Bob, then someone else. Fairly easy to get a set of stolen US identity documents these days.

5. Bob sends it back to the bank.

And your scenario doesn't match the original:

> There is a scam where people put money into your account.

"where people put money into your account" here can mean "where people cause money to show up in your account by applying for a loan in your name".

The constrained message length and lack of edit feature on Twitter means you have to forgive people if their wording isn't exactly as accurate as you might want it to be.

If Bob has his antannae up he does. If not he sends it to the IBAN that the scammed gave him for the 'return' payment.

Bob doesn't have any of the original details of the originating bank and loan, he's sufficiently likely to trust the person who seems to know what's going on and who messaged him out of the blue, saying "Please, please, I beg you, transfer the money that just showed up in your account [from Loaning Bank] back to me, at Different Bank by means of Western Union." Bob, being a kind and honest person, is unlikely to guess at the existence of the loan.

If the person does look up the details and just transfers the money back to the loaning bank, that doesn't cost the scammer anything.

At step 4, my default has always been "Please work with your financial institution to reverse the transaction." and then don't touch the money they've sent. Not touching the money and saying you are completely willing to return it but want to ensure it follows the correct process through the financial institution will protect you legally should it be an actual accident, and if it is a scam it'll disappear on its own when the scam runs out of time (bank determines you were sent money through a forged check and reverses it or something similar). Ignore any sob stories about how they need the money, the more convincing the sob story the more likely it is a scam to begin with.

If you had the private info to apply for a loan in someone’s name, you also have the information to create a bank account in someone name.

You don’t need to prove that you didn’t create the loan. It’s up to the company to prove that it was you. Having private information isn’t enough. At most you need to file a police report to expunge it off your credit report.

$250k is also the amount that involves the Feds. Most scammers won’t hit that amount since they know the state/loc police don’t have the capability/resources to investigate electronic funds transfer type scams.

> If you had the private info to apply for a loan in someone’s name, you also have the information to create a bank account in someone name.

Creating a bank account (fully, not just the application to do so) generally requires going into a bank branch. At least in Australia and UK anyway.

Going into a bank branch would mean real potential risk for a scammer, as they'd then be caught on camera. And if the bank figures out they're a scammer before hand... potential police waiting.

My point being that the post you're replying to makes a good point. A scammer could do a bunch of things that aren't all that risky, compared to creating an account in person... which seems like it would introduce a _lot_ more risk.

You don’t need to go in to make an account on fidelity. There are other online only banks as well.

That account will let you start investing right away. Try to pass 250k through it and I think you'll find fraud and KYC flags are in effect until you've done something that verifies your access to your address, etc, go change your address to a forwarder and that will affect your credit report, and so on..

Regular banking is pretty indifferent to the future profits of a new account that can pay out cash as it examines risk, while a loan salesman's interest in believing he has a sale..

KYC requirements are wrapped up in the AML rules. It's the same. Any one handling money needs to know their customer. Banks will run "credit" checks on new accounts usually through Chex Systems. It checks if you had a bank account closed due to negative balance.

Also pushing $250k to a bank/sweep account won't set anything off because the risk to FI handling the money is minimal. There's minimal risk it can be clawed back and the risk is on the FI that pushed the money. If you pull the money, thats a different story due to rules around ACH clawbacks. I assume fidelity lets you fund your account with no max though a push either ACH or Wire but to pull, you're limited to $50k or a lower amount per day. If you try to transfer that money out from a pull, it will get locked down till the ACH clawback period expires.

Assuming this is the US. There are lots of online only banks. Also I think Paypal offers banking services. Most discount brokers offer banking services like Etrade, Ameritrade and they allow people to signup online.

> requires going into a bank branch. At least in Australia

Not true, wheres the bank branch for ING? https://www.ing.com.au/

Good point, I'd forgotten about them.

I did say generally requires going into the bank in person though. ;)

They didn't. I guess it's easier to apply for a loan for someone else if the money goes to their account (otherwise you'll have to fake a bank account, too. and with KYC rules and such it is probably not so easy). But I don't know how they could fake the sender, so this is probably something else?

There's a variation where somebody owns money, sends it to you, convinces you to send it back, and then reverses the original transfer.

Maybe GP's description mixed two similar frauds, maybe both variations exist

Reply on news.ycombinator.com