Hacker News Reader

> Yotta marketed itself as a "bank" where every time you deposited to savings you would get a free lotto ticket for the month based on how much you deposited.

The archive link shows something a little more nuanced than Yotta presenting as a bank.

The archive link in gp has a hero text that says “banking” and then a few lines down says: Yotta is a financial technology company, not a bank. Banking services provided by Evolve Bank & Trust and Thread Bank; Members FDIC.”

If I’m reading this as a consumer I’m thinking my money is protected but this Yotta thing is a lottery incentive to put deposits into those banks, maybe some loyalty incentive or marketing scheme on top of it?

Lesson learned, don't trust “not a bank” to deposit your money into the bank for you.

Just seeing the phrase 'financial technology company' is a red flag.

Plaid is a financial technology company and many HNers are happy to hand over their account passwords to them for storage in cleartext.

I'd still consider Plaid a red flag. ;)

Could you elaborate? Red flag because of risk due to using Plaid, what it says about the fintech or something else?

Not parent but, what about this does not scream red bloody flag to you?

    hand over their account passwords to them

Give my banking password to some other company? That's a red bloody flag right there. Stop the presses. Nobody should ever do that. Not outside of very specific use cases like a password manager and in that case there better be seventeen million levels of encryption and such in place.

    for storage in cleartext.

Did we mention the color red? On a flag? I think we did. Cleartext, eh? Who thought this was a good idea?

Yep, that's what I was meaning.

Storage in cleartext would indeed be a huge red flag, but Plaid says they store it encrypted and I've seen no evidence that they are wrong about that.

That still might be a red flag but not as big a red flag. Cleartext means a database leak would leaks passwords. Encrypted, if done right, would mean a database leak would not leak passwords.

Can you share a link that describes what exactly they do?

What I would expect to be table stakes is that they only ever have an encrypted version of the data on their end (like a password manager) and that the encryption key is stored on my machine or if on their side that it by itself is protected by a passphrase that I have to enter each time plaid needs to do something. If we are talking storing the clear text password somehow coz they use screen scraping to implement their features for some banks.

All I find on their site (casually looking) is marketing fluff.

Also really I would expect that they never even need my password at all and that instead they have a proper API between them and the bank(s) where I authorize specific scopes only (preferably read only scoping being available) and my password stays with me and if something bad were to ever be done with a write scoped token from Plaid it would be traceable to their token authorizing it and they would be liable. When I give them my password they basically get full monetary power of attorney and the bank would always fault me ("we can see you logged in with your user and password. We tell you to keep your password/PIN secure and to never share it. Sorry, money gone".

Here's what they say they do [1].

[1] https://support-my.plaid.com/hc/en-us/articles/4410324401047...

Relevant section for the "we do store your password" case:

    In other cases, when you link a financial institution to an app via Plaid, you provide your login credentials to us. We store those credentials and use them to collect the data to power the services you’ve chosen and, when requested, securely share it with the app you’re using and establish a secure connection that you control. We then help keep your data safe and private with best-in-class encryption protocols.

Meaning exactly nothing. "encryption protocols" may simply mean that when they log in to screen scrape your bank's online banking they do so over HTTPS.

Sorry but this has zero meaning and I maintain: Red bloody flag. If there's any actual proof out there of them doing all this in a secure way, I'm happy to have my mind changed but this is just part of said marketing fluff.

Like Synapse, this sounds like the "put all your eggs in our digital basket" style of fintech "disruption" is bound to blow up in the faces of everyone involved.

Square, Stripe, Cash App, Venmo, Paypal, etc...

Over and over we've seen the same financial scam play out:

a) company starts up that explicitly avoids being a bank

b) company does something where some amount of money is placed in FDIC-insured banks, and it TRUMPETS on its website: "FDIC INSURED" over and over

c) consumers are misled into thinking their money is safe

d) regulators do not act

e) consumers lose all their money

f) profit (for a very specific set of individuals)

The company can even fake up a bunch of social media accounts to tell people reassuring lies right up until the scam collapses.

These scams will continue until regulators get serious about putting people in jail for them.

https://www.reddit.com/r/yotta/comments/1ctf25r/is_our_money...

>These scams will continue until regulators get serious about putting people in jail for them.

Which is so much more likely under turmp.

It used to be I could be sure this was sarcasm. I miss those days.

Is this a job for regulators or just criminal prosecution? Sounds like step (b) is either fraud or not, depending on how the trumpeting gets done.

Criminal prosecution only works on poor people.

Crimes where the individual is elected president or just gets rich don't do anything of merit.

Unfortunately, the kleptomaniacs are in charge.

Please try again in 4 years

Should I be suspicious that Wealthfront Cash accounts will fail as well?

What about Fidelity Cash Management Accounts?

>Wealthfront isn’t a bank, but we work with partner banks to get you an industry-leading APY, the security of FDIC insurance, and a full array of fee-free, no-strings-attached checking features — all wrapped up into one label-defying package we call a Cash Account.

https://www.wealthfront.com/cash

>The Fidelity Cash Management Account is not a bank account. It is a brokerage account that allows you to spend, save, and invest. The account offers competitive rates as well as spending and money movement features including a free debit card, checkwriting, Bill Pay, and more.

https://www.fidelity.com/spend-save/fidelity-cash-management...

Fidelity’s brokerage business would be covered by SIPC, which would include its cash management accounts. They also likely sweep cash out to FDIC-insured accounts. More importantly though, Fidelity is large enough that you’re unlikely to need that insurance, and that’s really how I’d prefer to approach this.

Yeah we can look at 2008 and say no institution is safe, but if there’s risk everywhere, I’ve just got to try and minimize that as best I can. Fidelity didn’t give me any sort of scare that year fwiw. Disclosure: I’ve been using Fidelity for basically all of my money for most of my career now, including cash management.

Fidelity is very regulated, and large. If something happened it would be a systemic event that the government would definitely get involved. Wealthfront may be fine too, I just don't know.

To put it differently, Yotta’s customer’s misfortunes are because they are poor and not politically connected. If Fidelity fails, their customers are rich and they vote: they must be made whole.

Kind of like the SVB failure. SVB customers were made whole. Systematic risk and all that.

These could have similar issues with gaps in FDIC protections due to money is being “managed” by intermediaries or because of the type of account. Their fine print discloses as much.

As a sibling comment points out, Fidelity is seemingly a reputable enterprise with other business that would be adversely effected by poor management of this product and the reputation harm that would come with it.

Among other features Wealthfront are trying to manage around the $250K FDIC limit for you by moving your money into multiple insured accounts - this is probably a new area with not enough regulation.

Any comment on what issues there are with paying somebody to open accounts for you with, I assume- a power of attorney allowing them to do explicitly that?

At that point the only thing at risk is fraudulent use of said POA, and whatever funds are held outside of actual accounts.

> At that point the only thing at risk is fraudulent use of said POA, and whatever funds are held outside of actual accounts

Which exactly the reason why the FDIC didn't intervene in the article: the Fintech startup didn't deposit the unaccounted(!) millions of customer funds into FDIC-insured accounts. The law should be tightened up to prohibit claims of FDIC protection without meeting the reporting and deposit process requirements.

The two scenarios: 1) handing a business your life savings to manage, a 2) authorizing a company to manage your finances so they're in FDIC insured accounts

Are completely different. There's no laws to update, and the FDIC isn't skittering out of paying on a technicality.

And, frankly, if anybody reading this is looking at option #2- do yourself a favor and get an accountant and a wealth manager that both have fiduciary duties. Might as well find a lawyer as well.

Just casually reading r/fidelity on Reddit (which is a subreddit run by Fidelity) would make me run fast and far from using their cash management account for anything. Widespread check fraud has caused Fidelity to be extremely cautious -- read slow -- in giving people access to checks they deposit into their CMAs. I'm not saying this is a bad thing, at least Fidelity is being cautious about taking care of their customers' money, but it's created a good deal of pain and anger for people who are depending on Fidelity for everyday banking-style transactions. I'll invest with Fidelity, but I prefer to keep my everyday money in a traditional bank or credit union.

if you have investments at fidelity you can just use the brokerage account as cash management. the brokerage account can access funds using a debit card and ACH just fine; I do still recommend opening a CMA for ATM fee reimbursements though.

none of these funds availability problems can happen if you have margin enabled; note that you won't pay any margin interest either as funds on hold are tradable immediately.

> Banking services provided by Evolve Bank & Trust and Thread Bank; Members FDIC.”

I just don't understand why on Earth it's legal to use the term "FDIC" one sentence away from "not a bank" without there being a regulatory framework defining minimum record keeping and reporting requirements to avoid exactly this type of failure.

The European "e-money" scheme seems to be exactly the opposite: Deposits are not insured (I believe there are requirements on the stability of the depository bank), but intermediaries, i.e. "financial technology companies", have to make detailed reports about their customers' balances available on a very short time frame to avoid exactly such problems.

Ideally, there would be a combination of both (pass-through insurance against bank failure and reporting requirements to reduce the blast radius of non-bank failure).

Prize linked accounts is a thing. In the US, it started with banks in Michigan 15 years ago

https://en.m.wikipedia.org/wiki/Prize-linked_savings_account

> but the FDIC has helpfully pointed out that no FDIC insured account has defaulted which is the necessary condition for FDIC insurance to pay out

This is what scares me. I use Betterment for everything, which strikes me as a much more legitimate company, but it follows the same model where accounts are "FDIC insured" by being distributed among various bank partners. I always thought that meant it was safe if the company had troubles, but it seems not.

I don’t think Betterment distributes funds to centralized accounts like Synapse does, it establishes accounts in your name at those partner banks and provides a unified interface over those funds. You can do the same thing yourself by going to each bank individually and opening up accounts manually, but then you’d have to deal with KYC for each one and their online banking interfaces of varying quality. That’s how they get their $2 million insurance number, since they open accounts at 8 banks and FDIC insures $250k per account.

That was my understanding when I looked into Betterment Cash Reserve (I ended up just going the manual route because I’m paranoid).

Good to know! Yeah I guess that's the inverse of the OP: one account spread to multiple bank accounts vs multiple accounts dumped into one bank account

> every time you deposited to savings you would get a free lotto ticket for the month based on how much you deposited

reminds me of a payment scheme someone in Poland described about getting a car on 'lottery', where every month one person 'won' the rest of their payments paid off as the prize, while the 'worst loser' paid twice the price of the car? i was pretty young so i'm sure i'm missing the details

I've had an account with them. It looks like in March they quit giving automatic tickets monthly based on funds. Now the app looks much more like a casino, with other games and a separate yottacash balance for playing games including the lottery that use to be automatic and based on cash in the account. Withdrawing isn't possible but it still shows I have a $400 balance. Evolve bank is sending me $0.06 based on my balance because of the synapse bankruptcy. I'm just glad I moved most of the money I had in it to a different bank a few months before the issues started, I had 10k in it at one point.

It looks like the drawings are still happening and it says someone won 33k this month. That's gotta be bitter sweet. They won big but probably won't actually collect the prize considering it's not possible to withdraw. I wonder if they are going to have to pay taxes on that prize despite it not being accessible.

Notably, they promoted this scheme to people with troubled finances and tried to morally justified it by talking about how they were encouraging people to save their money who otherwise wouldn't. In principle that sounds good, but the reality is they just funneled those people into a glorified casino.

tbf the UK government does the same thing: https://en.wikipedia.org/wiki/Premium_Bonds

Premium Bonds are quite a popular savings product especially in times of low savings interest. What I find interesting is that NS&I, being government backed guarantee the security of all money in their accounts across all products, well past the ~£80,000 obligation that banks have.

> someone will go to jail for financial crimes,

I like where your thinking and you seem confident, but history has shown this to not always be true. However, even if it does happen, people sitting in jail does nothing to fix the loss of the victims.

The fact that one of the parties involved hasn't done an audit of their accounts because "they can't afford it" is the chef's kiss of the clown show this debacle is.

Being a cynic means I also am confident someone will go to jail for financial crimes, but I am not confident that whoever does so will be the most guilty.

Probably whoever gets it the longest just failed to properly reinvest their ill gotten funds into legal advice.

It reminds me of a certain country where one of the wealthiest powerful people set up a lottery system to persuade people to sign a petition espusong values of a politician well-known for not paying companies the full amount they're owed.