My experience with check fraud

It does seem, however, that modern digital payment systems (mainstream, non-crypto) have largely caught up with the times. Your bank password is essentially a private key. It's not foolproof, but the challenge of keeping your password private is no different than keeping your private key private. From an OPSEC standpoint it's a level playfield.

Of course these systems are still vulnerable to social engineering attacks, credential theft, outright fraud etc. These kinds of human problems can't be solved with technology.

The old security holes still exist (check fraud, credit card fraud) as the system continues to support ancient/deprecated payment methods. Eventually they'll be obsoleted. I read a report stating that check use has been declining steadily. In 2000 there were 42.6b check payments, in 2018 there were only 14.5b. I'd say we're getting there. The younger generation embraces the new tech, it's only a matter of time.

If this was 15 years ago, I'd say crypto was providing a solution to a problem. But since then bank systems have caught up, and have additional protections of FDIC, regulations, etc. I'd say that modern digital finance is already largely meeting the promises made by crypto enthusiasts, with none of the downsides.

Put another way, if crypto matures and doesn't die in flames, it will basically look like one more competing digital payment system to those already offered by TradFi.

People get caught up in the tech, but at the end of the day all that matters is you can use a password to digitally move money. We can do that now. Crypto is ubiquitous / crypto is irrelevant.

Apple did part of this with their card - no numbers for waitstaff to copy - and for that reason it’s my main “handing it over to anyone” card*.

I’ve thought about degaussing its magstripe to make it truly compromise-proof, but I haven’t gone that far yet.

*well, except when it’s 5% restaurant cash back season at Discover.

They have the logs, you don’t. This is probably the worst day of your life or close to it, while it is just a normal regular occurence for your bank. They have policies to handle it from their side. They will ask a lot of question, perhaps ask you to make a police report.

I ask you this, if you have chest pain and shortness of breath, would you:

a; jurry-rig an oscilloscope to check your ECG, start reading wikipedia all about cardiology, and then find a nurse to tell them about how concerned you are about your QT interval

Or

b; go to a hospital and tell them that you have chest pain and shortness of breath?

If they didn't how would the receiving bank be able to get the money from your account?

What specifically makes you feel uncomfortable? If the person is truly "random" then guessing your account number is just as "random", no?

For example with UPI the only thing you need to send are disposable virtual addresses which are basically like email IDs. By themselves these IDs can't authorize any transactions which is always 2FA

File a police report, same as in article with washed /rewritten check...

Then figure out how you got compromised so it doesnt happen again.

Presumably you want their money to be returned, but would you want the same if it was physical thieves pretending to be the alarm/security company that went in to "repair" the physical safe and made off with all its valuables? Would you still want the money to be returned (ultimately subsidised by all other customers of the bank or the taxpayer) if someone physically withdraws all their money in cash and hands it over to someone who pretends to be a bank employee and has a convincing name tag?

Looking at it from the bank's perspective, the user willingly delegated their identity to the scammer by voluntarily handing over control of their authentication instrument. There is not much the bank can do in this case that wouldn't also hinder legitimate usage - this may have very well been a legitimate transaction for buying a car/house deposit/etc.

FYI, there is recourse against authorised push payment fraud, but it's a goodwill scheme that most banks participate in as opposed to a legally mandated feature. Nevertheless, it's worth trying out.

If a delay is beneficial it can be introduced artificially for those who want/need it

For instance, my bank limits the total daily transfer, with any changes to that amount taking time to take effect.

You could use a bank with disposable one-time credit card numbers.

You could disable online payments and only enable then when you do transactions.

You could set up limits, say 100$ a month, after which transactions get denied unless you alter it. So you wont be incovenienced too much if you do need a card for netflix and other recurring payments.

There are so many ways electronic payments are more secure in new banks that care about this.

Norway BTW. Perhaps our small population makes it easier to just end old legacy shit?

Paying a new person is at a minimum a 3 hour process using online payments for me if they don't accept credit card payments.

Also, my checks don't have my full name or billing address on them. Credit card payments require disclosing at least part of these (at a minimum, billing address zip code) to the payee. Wire transfers disclose the full name on the account. I want to send money, not PII.

If I have their bank routing number and account number, sure I can do that (then it's effectively the same thing as a check but without the slip of paper). But I don't always have that info particularly for informal one-off payments (e.g. yard cleaner that came to haul debris away) so it's easiest to hand them a check.

^ This. I'm not sure if this is actually EU wide yet.. but there are several payment systems available, which aren't AFAIK yet usable across countries or at least not many countries. They're in any case members of the European Mobile Payment Systems Association. The goal is to make an EU/EEC-wide mobile payment system.

Unlike Paypal, Venmo etc. these are directly managed by the banks, i.e. nothing like the horrors you sometimes hear about from those private companies. With the variant I use I just need the/a phone number from the recipient, I enter it in my app, I see a name come up, I pay (with a pin), either directly from a bank account or from e.g. a credit card - I can choose at pay time. So, for that example where you need to pay someone doing garden work for you you don't hand over a check, you simply ask for the phone number, enter the details, show the guy "Is that you?", if "yes", then pay, show the guy the receipt on your phone, deal done. Instant, if it's paid from your account, or "Real Soon Now" if from your credit card (the transaction will fail if you don't have the credit - you don't get a receipt to show. You do get an instant receipt if your credit card works, so there's no doubt on the receiver's end that the money will come).

Very convenient. Works in lots of shops too, and, as it's free up to a certain amount, and you only need a phone number you don't have to invest/rent anything, as in getting a card reader. When that's said, until this became popular you could more often than not use a credit card for anything including flea market sellers, parking meters, everything. The only limitation I've run into is with, of all things, doctor's offices where their payment machines for some reason only accept bank (direct debit) cards, not CC. The dentists accept everything though, and everybody else accepts everything too. But the phone payment is so extremely easy, and safe, that it's taking over everything. Splitting a bill at the restaurant? Phone transfer. Someone forgot their credit card at the gasoline pump? Phone the amount to someone who's got a CC and then the person with the CC can fill up the car. I do prefer contactless CC payment in shops though.

(That's where I keep my checkbook; I only just keep a single, blank, folded-up check in my wallet for the unexpected need.)

Add to that that snail mail is still the main way people who ask for money communicate with you, so now you'll have to type in the IBAN by copying it from a piece of paper. The IBAN is also not authenticated, so you don't really know who you're transferring money to.

This may vary with the banks, but in some cases their website is horrendous. It's the case for my bank, BNP Paribas. I very much prefer to write a check and send it over snail mail if it means I can limit my use of their site.

My point is that, historically, personal checks were the default for a lot of person to person transactions in the US but they carried some risk--depending on the situation.

It's somewhat the opposite in the US. Many recurring payments can't be paid with credit cards (loans in particular, since they don't want you paying credit with credit). And many places, but government and municipal services in particular, charge extra fees for credit card use (I understand why, because it costs them more to accept a credit card, but I'm not interested in paying more so I give them a check to save money).

Earliest in my career I worked with many banks developing cryptographic alternatives to check payments. Definitely a big culture clash between us from the crypto world (crypto = cryptography to be clear) who expected everything had to be mathematically secure and the banking teams who didn't care about any of that which seemed baffling to me.

The misconception you express, shared by my younger self, is that the security of a check is somehow related to what's on the piece of paper. That's wrong. Everything on the piece of paper is right there in cleartext trivially reproducible by anyone. Nobody pretends it has any security, it doesn't need any. The security of the checking system is in the process and the laws and verifications fine tuned over more than a century of resisting attacks. So turns out it works very well. A battle hardened system that can't be matched by any "move fast break things" fintech startup.

Not concidentally, this is very analogous to the cryptocurrency world which thought all finance regulation was nonsense and are now collapsing with fraud every which way. Turns out all that regulation (at least most of it) has been written from the experience of centuries of financial fraud and has good reasons.

There's no option in doing it from the app/ATM afaik.

I’m not the commenter you are asking from I also used to live in central europe. There as far as I can tell the concept of a “check” simply doesn’t exist. So much so that I don’t even know what is the equivalent word in the local language. If I would get one I would need to go to my bank in person and ask them if they can do anything with. I would already count that as a hassle, but I just looked it up online and it seems my bank doesn’t handle checks. There are rummours online that some other banks do cash checks, but it seems some of those have changed their policy since and they are no longer accepting checks either.

All in all it works as well as being paid with a rai stone or a cowry sea shell, while lacking the aesthetic benefits of those.

At one point, I got tax refund and stimulus checks from the Treasury, and it turned out to just be easier to endorse them to my remaining US account and mail them to the branch that has my account.

In theory I could use the bank's remote deposit capture service, but: 1) The checks were too big, there's a ~$2500 limit on RDC, and 2) The bank has complained in the past that I'm not supposed to use it when I'm overseas. There's some regulation that they're worried about.

I've seen a couple of checks in Ireland that haven't been from the US, mainly tax refunds IIRC, but they're super rare and no ATMs will take them. They'll take Euros for deposits, but not checks. So it's a trip into see the Cash desk at the bank.

Admittedly a number of years back, a Canadian company paid me for a photo of mine they found online that they wanted for an article.

Ended up having to go to a human bank teller to deposit it.