Hacker News Reader

Comment by opportune | Hacker News Reader

Completely agree that banks should provide prescriptive guides.

IME they really don’t like when you work around their eg 50k/day ACH transfer limit by initiating 50k ACH transfers on 4 consecutive days to move an account of 200k. But they don’t tell you what they actually want you to do if you want to move 200k - and for obvious reasons they probably don’t want to make these transfers fully frictionless. They just assume you’ll know to show up at a branch in person or get on a phone to ask about it and treat you like a criminal if you don’t.

View on HN

Is that even "working around" the restriction? Surely moving 50k on each of 4 days is what you're expected to do in that case. It still means the maximum a fraudster can get away with is 50k if the fraud is discovered in one day.

My last bank had limits like 20k/day and 50k/week, so it seems like yours could have 50k/day and 60k/week if they "really don't like" you using it like this.

One of the reasons banks have these restrictions (besides the obvious thing of making it difficult to take large sums of money out because it hurts their business) is to prevent fraud. They want to prevent the case where some criminal gets physical access to my computer, or my login credentials, and drains my account without my knowledge. So they want you to initiate a manual verification that you really do intend to move such a large sum to prevent that fraud.

If you do what I did, you usually get a temporary hold on your account and some very skeptical bank employee calling you to grill you on what you’re doing.

On one hand I get it. For every story like mine, where this is just a temporary frustrating inconvenience, there’s probably a story where grandma lost her life savings after talking to the nice man from Microsoft on the phone. But also they don’t make it clear at all what you are supposed to do as non-criminal to work around their restrictions, which is just bad for customers.

> So they want you to initiate a manual verification that you really do intend to move such a large sum to prevent that fraud.

Yes, it's hilarious.

One of my banks requires me to do the transaction over the phone if it's above a certain limit.

At which point, you talk to someone in a call center, and they proceed to ask you exactly the same information which you needed to introduce in their web interface to make the wire transfer yourself, and nothing else.

This includes giving your web interface credentials over the phone, which could be heard by someone inadvertently or even phished if you happened to have misdialed accidentally. Or stolen by the call center employee.

It's also great fun to have to spell out 20+ account digits, the names of the other people/companies, phone numbers and email addresses to receive confirmations and even a description of the transaction (fortunately I don't always buy sex toys).

Gosh, how I love to spell out all this information, digit by digit, letter by letter, over a phone call! But since it's for my protection it makes it OK, right? Right? Hello?

No, you're expected to call and set up an appointment with a banker who can sell you on some kind of business account that has appropriate services for moving money in that way.

And yes, this will cost more and take more time than the spreading-it-out method.

no, this is too cynical. just give them a call, authenticate yourself, and they'll happily raise the limit for you.

maybe if you're moving 50k/week they'll try and get you on a business account, but at that point you're already not using the account for the purposed you claimed when you opened the account.

working around a restriction is called "Structuring" in the US:

https://en.wikipedia.org/wiki/Structuring

This is not true. Structuring is much more narrowly defined, including in that Wikipedia article. It requires you to be working around a legal or regulatory reporting requirement.

Part of the problem is a bank training you on recognizing that they have countless silly obscure rules for their own purposes - for example in what your password may be and how messages to their employees might be (mine limits the messages to be very short - no space to explain anything.) So you are quickly trained to make do with the silly rules. I.E. multiple ACH over several days and move on with your life... Or in the case of messages, I just continue my explanation in multiple messages.

Either way, the bank has trained the customer to work around limits. They can't have it both ways.

And people are surprised why so many were excited to use cryptocurrencies. The current banking system is broken to the root.

And getting progressively more broken, due to increasingly stricter and more numerous laws, and more effective enforcement.

Hell, in Spain you can't even legally pay anything in cash if it costs more than 1,000 EUR. In Greece, the limit is 500 EUR.

> I.E. multiple ACH over several days and move on with your life...

Surely, just picking up the phone and speaking to them is faster and easier than engaging in structural transactions like that.

Is it? Usually no, it's not. At one bank, they want me to always talk to the same person - who is generally competent but also usually not available and sometimes outright on vacation with no warning. At another bank, they want me to go through the basic 800 number - where the person who answers usually knows much less than I do. Picking up the phone is usually not a good solution.

One, this isn’t structuring. Just because you read what structuring is 5m before you read my post doesn’t make this structuring. 50k is way over reporting limits.

And also no it isn’t faster to pick up the phone, even if I don’t get out on hold at all. An ACH transfer takes seconds, it’s like writing a digital check. Doing it 4 times takes very little time.

I didn't mean "structuring" in the legal sense, I meant it in the technical sense (arranging transactions in order to avoid something).

I find it's much easier to engage in a 15 minute phone call than to do multiple transactions over a number of days. You may find it different, of course.

Banks have an incentive to create as many roadblocks as possible to prevent you from transferring out large sums of money.

You may be surprised at how difficult the regulators make life for the banks.

Read this case-study from the UK. https://www.financial-ombudsman.org.uk/decisions-case-studie...

"We thought the spending on Marta’s account was very unusual for her and – after the first few payments – the pattern of transfers from her account should have caused the bank some concern meaning that it ought to have intervened. We thought that if the bank had asked Marta about the transactions she would have told it what she was doing."

Consider the implications of this.

It gets worse, "In deciding fair compensation, we also considered if would be fair for Marta to bear any additional responsibility for what happened. However, as we thought the trading platform and correspondence with the fraudsters was very convincing, we decided against that on the facts of this case. So we asked the bank to refund all the transactions which took place after the point we thought it should have intervened."

This regulator does not respect the concept of personal responsibility.

These problems are also downstream of systematic public policy failure. We have had telephones for about a century. Yet in 2023, it is still routine for pensioners to receive calls from organised fraudsters. There is no reliable way to trace the source of these calls, to block ranges of numbers, to prevent scam call centres, to issue pensioner-friendly forms of telephone with higher safeguards. These problems are not technically difficult to solve. All could be fixed if the telcos behaved responsibly. That work should have been done thirty or more years ago.

Since that work was not done, there is now a fraud crisis. In response, regulators have forced controls to the last point possible, which is with the banks. Huge inefficiencies follow.

Ouch. Marta literally answers a get-rich-quick ad, then installs a program that lets a fraudster remotely control her computer to send money to a bitcoin exchange account that was opened in her own name (requiring her own ID documents to do so), and then send the bitcoins onwards the "investing" platform.

> The CRM Code did not cover this type of transaction, because the payments Marta made from her bank account were sent to an account held in her own name with the crypto exchange. However, outside of the CRM Code, banks have other fraud prevention obligations – including to look out for unusual transactions.

In other words although there's a document saying what a bank should try to do, that is actually meaningless because the regulator believes banks should somehow stop all fraud even in cases where people are literally giving random strangers total control over their bank account, deliberately, because they can't be bothered understanding how to operate their own financial accounts.

The cherry on top:

> If you invest in a firm which isn’t authorised by the FCA, you risk losing your money, without any protection.

Apparently not, because if some civil servant thinks you are pitiable and the scam was convincing, they'll force the bank (i.e. other customers) to make you whole again anyway.

Interesting, thanks for sharing.

This situation creates a market for new fraud-detection products, if anything just so that the banks can tell the regulator that they did their due diligence. Of course it depends on how common situations like Marta's are, and how expensive they are for the banks.

They have those, lots of them. It doesn't matter if the regulator will take a stance like "we think (with the benefit of hindsight) it looked suspicious, so pay up". And unfortunately this is a very common thing for regulators to do. A lot of money laundering fines against big banks are like this. A civil servant comes in five years later after being handed some evidence that some transactions were criminal, says the bank should have known (without explaining how) and levies huge fines or gets a huge settlement.

If you're the largest customer at a small bank they'll be happy to see you move it out because that much money can make them nervous.

Unless they're so small that you taking out your money results in them experiencing liquidity issues.

That's the situation that makes them nervous.

In which case they already have bigger problems.

In particular in the US, they are on the hook for almost all of it if the money was fraudulently moved out.

They'll try to dissuade you even if they know the transaction is legitimate.

Not the banking industry but I had an issue with a leaked Twilio key once and it was a funny conversation like that. They kept telling me that I had been a victim of fraud (long story, a contractor pushed a key to a public GitHub repo). It only took about 7 repetitions for them to finally acknowledge that it was in fact Twilio who had been the victim of fraud: someone, pretending to be me, had asked them to send $1000 worth of Netflix spam and they obliged.

It wasn’t ever really resolved in a satisfactory way but it got to the point where I was so frustrated and tired that I said “fine, we can settle on $200” because it wasn’t really worth pursuing further (based on my hourly rate and how much wasted time I’d already sunk into it)

There are some systems, banking for example, where "hacking" them and trying to be smarter than others can, and actually does, backfire.

"But they don’t tell you what they actually want you to do if you want to move 200k"

They will tell you to use a wire transfer.

Don't know where you live but where I leave this thing is pretty common when you are buying some property. The goal in this case should be pretty obvious.

You do a wire transfer.

Yes, my point is that banks don’t make it clear that maxing out their ACH quotas will get your account frozen and that you should do a wire transfer. You shouldn’t have to learn this the hard way by getting your account frozen (which is very stressful when it happens to you for the first time), and banks should make it clear what you should do, which is my point

Whenever I've been moving amounts at that scale, I've already had a close working relationship with my bank as a natural side-effect of my business activities. As a result, I'd be doing those sorts of transfers by talking to my account manager at the bank.

I suspect that's the norm that banks are expecting.

It's a pretty niche problem though, so I guess not surprising they aren't great about communicating it (it probably was communicated, on page 30 of your agreement in small confusing text).

probably not communicated. Banks usually don't like to say: "your account will totally get frozen if you do this thing up to the limit of what we said you're allowed to do".

They like to keep the impression that account freezes are discretionary not automatic.

Ok with this context I understand what you are getting at.

For which they kindly charge you a fee

schwab doesn't charge a fee to wire from a brokerage account. by the way, there's no minimum balance or fees required to open an account with them. you pick up the phone, get connected with an intelligent person who understands exactly how to help you, and wire the money. usually you don't even wait for an agent.

I'm gonna sound like a shill, but 99% of the problems people are writing about in this thread would be solved by opening an account at schwab. unless you routinely deposit/withdraw large amounts of cash, there's no reason to waste time with other banks.

Thanks - good pointer!

Couldn't you just send a wire?

Yes, but that involves talking to someone and waiting on hold. If there’s no rush, doing 4x ACH is easier, if you don’t know it’ll get you flagged. All I’m saying is banks need to be more prescriptive about telling you “we’ll put a hold on your account if you move large sums without telling us” rather than giving you some fake limit that actually utilizing will raise red flags. This is a common failure mode

I presume the argument some middle management type makes is that exposing their security protocols makes it trivial for a fraudster to work around. Obviously this is a fallacy because any genuine fraudsters has the incentive to work this all out by trial and error, if the information isn't freely available to them on some dark corner of the internet.

Trial and error takes time. Potentially a great deal of time. A motivated fraudster will likely get caught and stopped several times along the way if they're attacking a particular bank.

It's worth bearing in mind that most financially motivated criminals are after easy marks. If you're too hard or expensive to hit, they'll find another target. If you're seeing like a bank, that's a victory and the protocols are doing their job by reducing fraud.

Those typically have huge fees.

$25 to move $50k in an atomic, irreversible way isn't a huge fee IMO. when you're dealing with that amount of money, the risk of it getting frozen or flagged for fraud is > $25. A lot of banks will let you send wires for free if you have a large enough balance.

Not int the context of these amounts.

$20-ish to move 200k safely is nothing. If you are doing it internationally, it's typically tiny compared to the FX cost.

I’d be happier keeping the $25 tyvm.

And risk getting your account frozen "for no reason", really smart.

Sure, write a personal check then and expect a lengthy hold. Or something else on the risk vs. PITA vs. cost framework.

Point is, wires are cheap for what they do. They aren't your only option, but all options have tradeoffs.

This is a debate between sending 4x ACHs over 4 days (presumably from the comfort of your own web browser) vs a wire (often requiring a visit or phone time).

right, and the trade off there is you may get flagged for structuring and locked out, right?

As I said, there is a range of cost/risk/PITA options available. This is niche enough I don't think it's particularly worrying the banks don't support it easier.

What structuring? Both are way over mandatory SAR thresholds.

Reply on news.ycombinator.com