Hacker News Reader

Comment by SapporoChris | Hacker News Reader

I'd be hesitant to give any app any sort of access to my checking account. I would only do so with a second account with just enough there to cover my purchase. While it is a nuisance, the phone is simply too large of an attack vector to consider anything else.

View on HN

I hope to move to Mercury Bank soon, which allows you to create a (practically) unlimited number of checking accounts without additional verification, including for cases just like these. Just need to find another job to afford the fee ($240/yr)

be aware that Mercury is a fintech, not a bank, and doesn't participate in the FDIC insurance scheme. So there is no backstop if they fail.

To be fair to Mercury, they are quite open about this fact.

Also fintechs tend to close accounts without notice easier than traditional banks

From Mercury’s own website “ Get up to $5M FDIC insurance through our partner banks and their sweep networks to ensure eligible deposits are protected.”

That's exactly the point though. Mercury is not a bank. So giving them your money and getting it back safely relies upon the partner institution.

As an example: fintech builds front end that takes deposits from user, but not much more. The deposit passes to an intermediary that pools deposits and puts them in FBO accounts at a real (FDIC) bank. Intermediary collapses. Now neither the bank nor the fintech know who had what.

This is exactly what happened when Synapse collapsed (which impacted Mercury at the time too)[0]

[0] https://www.yalejournal.org/publications/the-synapse-collaps...

They are starting their own bank!

https://www.retailbankerinternational.com/news/occ-grants-co...

https://www.linkedin.com/posts/mercuryhq_big-news-not-a-bank...

Mercury is going to be a bank, their national bank charter was approved earlier this year. I'm really looking forward to Zelle support!

Check the rates! If 3.5% beats your current savings rate, and your balance is high enough, it might pay for itself.

It would if I had a balance. Won't have any savings until I can make more money!

I'd be hesitant to install software from a gas station (or most any retailer, really) on any device I own.

Everybody with access to, or capable of guessing, your account number is capable of "access to your checking account".

Are ACH returns really that difficult to initiate in the US? I've fortunately never had to do one, but in SEPA land, it's usually a single click in online banking, or at worst a simple message to customer support.

While true that all you need is the account's MICR number and the bank's routing number, you also need access to the ACH network which I assume is only open to other banks and their official clearing partners and their services such as Zelle.

Fraudulent ACH transactions would be a federal crime if you found a pathway to do them, and you'd probably be tracked down pretty quickly because unlike crypto, ACH transactions are fully trackable and auditable between accounts that have identified owners.

Yet ACH fraud happens. Not all merchants originating ACH debit transfers verify their customers as diligently.

To be clear, this fraud happens similarly to credit card fraud: Fraudster F gets accountholder A's account and routing number, opens an account with merchant M and racks up a bill; M charges A, A reports an unauthorized payment to their bank. Usually M ends up eating the loss.

> Everybody with access to, or capable of guessing, your account number is capable of "access to your checking account".

No, ACH authorisation is an entirely different matter. I could agree to show you the check I wrote to my landlord, but I'm not willing to give you my check book with my signature — and no other data — on all the blank checks.

ACH authorisation is an analog of the latter, not the former.

Nobody verifies ACH authorizations for non-disputed payments though. Your account and routing number is really everything anyone needs to debit your account.

You can then easily dispute them, but I'd still call that "access to your account".

Reply on news.ycombinator.com