Evolve Bank and Trust confirms LockBit stole 7.6M people's data

I noticed a couple days later by accident, randomly checking my balance in the app. I got no notifications from Wise app at any time.

Thing is, although I have a physical Wise card, it was never used anywhere since the account was opened, so I suspected something was way off. Can't be stolen credit card info from some random store online, or ATM skimming etc.

While I don't know what all the possible ways to pull this off are, had a feeling I'd be reading about it on HN soon. This breach, or some other breach, looks to me like someone has enough info to charge random Wise accounts.

How do you know this, does Wise provide auth response data? (Merchants are not required to respect the CVV check, so it's possible for txns to go through with a non-matching CVV response code.)

I'm also curious about the lack of notifications. That would seem to indicate a level of account control beyond the cardholder data. Unless they were failed due to NSF before the notification step.

So when you open an account with mercury, under the hood they’re opening an bank account with a bank and sending transactions through it.

There’s a lot of kyc/kyb regulation around financial services. Eg banks can’t provide services to certain people. So the underlying bank needs to know who you are.

> Why not partner with a major bank, or Column?

Column didn’t exist when mercury was founded. And it’s not that easy to secure a banking partner. Its not like signing up for a free checking account.

Looking that up on Google Maps and Street View, it appeared to be a small branch in Brooklyn, on a street that looked immediately familiar to me as the starting area in Grand Theft Auto IV.

Since then, every fintech has had essentially the same business model:

- Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card transactions. (Online bank account, instant international money transfer, loan, etc.) - the trick is that to get the money, you swipe that debit card.

- Partner with some small bank so that they are one the one providing the debit card. The law essentially has a loophole on it allowing this.

- The fintech company sets up essentially everything, with all the small bank does is have automated accounts created for cardholders when the fintech's software says so. No money is kept in the customer account until the moment of that debit card swipe - then it is instantly transferred in and instantly transferred back out for the payment.

- This requires reserves, but the fintechs and small banks collaborate on how to get good interest on the reserves involved.

There are now fintechs which offer "fintech as a service" which will set all of this up for a tiny bank who can then offer this to any other fintech with almost no involvement from the tiny bank. All they have to do is sign a few papers.

The definition of a big or small bank is based on the amount on deposit, so they are careful to not actually have any money on deposit.

Congress needs to correct this abuse, immediately, and only allow the larger debit card fees for traditional checking accounts held by consumers where the money involved is held on deposit at that bank.

Edit: one of the major problems here is that small banks are often not staffed for adequate cybersecurity for global operations like these; they do just fine doing hometown community banking, but are very vulnerable to being cracked like this. Yet another reason small banks that are providing big-bank services should be regulated like big banks.

Because major banks won't support startups looking to compete with them. Why would JPM, BoA, etc. service Mercury who is going after their SMB business banking vertical? Banking is a cartel in the US. The bank lobby makes it as hard as possible to compete with them.

Yeah, why didn't Mercury partner with a well-established, vetted, and recognized bank like SVB?

https://stripe.com/newsroom/news/treasury

> With Stripe Treasury, platforms can offer their users interest-earning accounts eligible for FDIC insurance in minutes, enabled by Evolve Bank & Trust.

The major banks don't get into this game because the regulations on banks get much stricter the larger you get. So the fintechs are incentives to partner with "small" (this means sub $50 Billion in AUM) banks to deal with the minimum amount of necessary compliance (still a LOT of compliance working with small banks)

Thanks for pointing that article out. It made me reconsider whether it’s wise to keep money in Mercury.

EDIT: this rabbit hole goes deep. https://techcrunch.com/2024/05/16/a-us-trustee-wants-trouble... "San Francisco-based Synapse, which operated a platform enabling banks and fintech companies to develop financial services, was founded in 2014 by Bryan Keltner and Pathak. It was providing those types of services as an intermediary between banking partner Evolve Bank & Trust and business banking startup Mercury, among others."

Mercury is by far the best bank I’ve ever used. But they’re not actually a bank, just a partner to one, and the foundations seem shakier than they appeared.

I hadn’t really stopped to consider "what if Mercury goes out of business?" till now. Silicon Valley Bank seemed like a one-off disaster, but now I’m not so sure.

Is there any bank that isn’t awful? Even just reliable wire transfers was beyond the capabilities of US Bank, for example, and it was a business account.

Evolve is an otherwise obscure bank chartered in Arkansas but headquartered in Tennessee (a little sketchy) that has over-leveraged itself. This is why it was hit with a Cease and Desist from the FDIC. The C&D also probably contributed to them becoming a target for LockBit.

Evolve is also the underlying bank for Stripe Treasury, although to my knowledge, their have been no new partnerships with them. I have heard the number 2 thrown around. Of note, Shopify is the main person for whom this was built and uses this.

Consequently if you have submitted KYC/KYB information for Shopify, Mercury, Yotta, Dave, any other past Synapse partners, or some Modern Treasury partners your data was breached. This seems to be the primary information shared along with account and routing numbers. This becomes problematic especially as part of the check involves external account and routing numbers along with SSN of any UBOs.

Fintechs do not partner with small banks because of debit card fees but because of Dodd Frank regulations (primarily).

I have no clue why the submitted mobile number and email address as part of KYC.

But more generally, they will need business closure docs, including asset disposal. The defunct account will become property of the asset receiver(s).

If there's enough money in the account to bother, hire a lawyer to remind them how things work.

If there isn't enough money in the account, then you were right to ignore it in the first place. The damage from this leak was not (especially) predictable, but regardless it's done now, and won't get any worse.

[1] https://www.pymnts.com/news/cross-border-commerce/cross-bord...

And I know some people had it at like 1-2 days notice. I blamed wise at the time but I guess their hands were tied if they knew about this but weren't allowed to talk about it.