Hacker News Reader

Comment by stnikolauswagne | Hacker News Reader

My wife recently filled out a SEPA-Lastschriftmandat for an account in my name and all she needed was my name, IBAN address and a signature. Name and Address is semi-public and signatures can be faked. I'm no financial criminal but I would be shocked if there was no attack vector that gets enabled from knowing an IBAN and a name.

View on HN

The thing is, burden of proof is with the bank. For a lastschrift, you have 8 weeks to reverse it, if you didn't actually sign the Ermächtigung, you have 13 months.

Unless you don't care what transfers happen, that's pretty much always enough time

In Germany you'd be afraid to reverse lastschrift because if by some accident it's legit, the companies like service providers will go berserk at you.

It takes ~2 weeks to resolve and will cost you tens of Euros. The biggest threat is that they won't want to deal with you anymore, at least for a while. Happened to a flatmate of mine 15ish years ago.

I'm certain that it also involves receiving and sending a letter.

Letters are why it takes so long, yes

Pray its not a fax.

I wouldn’t be afraid, but I also wouldn’t reverse a legit one. When you do that, you get sent to collections, which makes sense.

I am not worried about the money staying gone forever and I have ample cash reserves, but I can imagine that someone who might have to worry about a bouncing rent wire or electricity bill would be more worried about their safety cushion potentially being gone until they get it fixed with their bank.

Justified fear. A former flat mate of mine reported an unexpected outgoing transfer to his UK bank and they blocked his account for 3 months. He was essentially unbanked. He had to pay his rent in cash after getting it from an ATM with a credit card (which cost a lot extra and hit limits). Resolving it took months even though we lived right next to a branch of that bank, where he went every day.

I had a situation where my mortgage took money from my account, but used the wrong company/reference name.

I didn't know what it was so I clicked a few buttons in the app and the money was back instantly.

That was on Commerzbank. Dunno if others are the same!

The issue is more "I checked my account yesterday, I have 600€ on there, so I know the 150€ utilities bill due today is not an issue" and then a weird withdrawal happens and all of a sudden the utilities payment bounces. Even if i get the money back instantly once I notice it theres still the issue that now I have to deal with a bounced payment to a utilities provider.

But no company cares about an occasional failed payment? That's part of doing business?

So they send a polite email informing you of it and you pay it a few days late?

No reasonable entity would charge late fees as that's a great way to anger otherwise perfect customers?

But again, I am not talking about myself, im talking about the hyptothetical person who might not be the perfect customer. My in-laws have had their gas cut more than once because of non-payments, or were only allowed to keep the gas running because they told them "we will wire you the last 3 unpaid invoices at once on day x".

For me to personally end up in this situation the bank would need to somehow SEPA out like 2 years worth of mortgages at once in a short timeframe, which is not a realistic scenario.

If you have an app, you'll notice immediately that a payment bounced, via notification. If not, you'll get a letter informing you that it bounced.

Also: it takes A LOT of letters and court orders for them to cut your utilities. I'm not joking, it's more than a couple of Mahnungs, then it goes to debt collection, then it goes to court. The court will then take the money out of your account.

That's all before power gets cut.

It definitely won't be because of a single missed payment.

Even in the situation above: if your in-laws somehow had no balance "at once on day x" because of a fake SEPA, they would be able to reverse via app, or go to the bank and reverse.

Paypal (as an example) only asks for the name and IBAN and they do identity verification themselves, by depositing (!) a small amount of money on your account.

But yeah, it's a very high-trust society. Of course any charge can be reverted via your bank app in seconds. But it's still a nuisance to have to check, so people are wary of giving it away.

It's not high trust society. In Germany service providers have easy and instant access to your bank account. Like TSA to your body on American airports. They absolutely don't trust that someone will voluntarily make monthly bank transfer, so I'd call it zero-trust system.

It depends.

Telecoms, kinda. They will try to force this on you via contract. You can say no, but they will lie to your face that it's impossible. You can always get a pre-paid, too. I witnessed the same situation (forced by contract) in some Gyms as well.

Vatenfall and other electric companies, the government itself, banks, landlords, Hausverwaltung, all are surprisingly chill about which payment method you use.

But then again, Telecoms and Gyms are always trying to cheat and steal from you in every country that I lived, that I'd call this the exception to the rule.

In USA a company that knows your bank account number can withdraw money from it.

They're financially incentivized to behave, but that's it. The ability is there.

Reply on news.ycombinator.com