jhuckestein

hey, i work at monzo

we're currently making money from interest charged on loans that we make to our customers, from interest that the central bank pays us on our deposits, as well as from interchange that we earn when our cards are used. this is what most banks do (except they also make lots of money from fees that we don't have)

there are several other ways we'll make money and we just started experimenting with a few of them. we launched a premium account that charges a monthly fee [1], we operate a savings marketplace in which we earn a commission [2] and we help people switch their bills to a cheaper provider if they are currently overpaying [3]

we release our financial statements every year and new ones are coming out soon. feel free to have a dig then :)

[1] https://monzo.com/plus

[2] https://monzo.com/features/savings/

[3] https://monzo.com/blog/2019/05/08/switch-energy-supplier-thr...

Hey, thanks for flagging. I will look into that. The number is definitely meant to be staffed at all times

Massive congrats to the team - what a great and well deserved outcome :)

I have been reading HN regularly for 10 years. It has taught me everything I needed to know to get started. I applied to YC 4 times, got rejected 3 times, crashed one startup and ultimately found my current cofounder through the YC community.

HN is not perfect, but I am incredibly grateful for everything it has given me. Like so many here, I couldn’t have done it without Hacker News :)

To this day, the advice I give anyone who wants to get into technology or starting a company is to read everything on HN for 3 months and to look up all the things you don’t understand.

I work at Monzo. We've posted an update on the situation on our blog: https://monzo.com/blog/2017/03/05/outage/

CTO at Monzo here. We are really sorry about that.

One of the things we have learned from this incident is to proactively reach out to all customers as early as possible, even if it means alarming a large number of people.

We did tweet about the incident and updated our statuspage the moment we discovered it, but we didn't proactively message all customers until a few hours later.

The thing is, the user experience of Uber, Lyft et al is strictly better than public transport. Some would even say it is 10x better (in the From Zero to One sense). It picks you up whenever you want, wherever you want and drops you off exactly where you need to go.

I agree that buses are more ecological, but doesn't this just mean that we should combine Uber and public transport? In the future I see a fleet of larger vehicles combined with a Uber Pool type app working really well. And even further in the future these vehicles would be self driving.

Monzo | Backend, Web or Android Engineer | London | VISA, REMOTE, INTERNS https://monzo.com

At Monzo we aim to build the best current account in the world. We are always keen to hear from capable, creative engineers who want to help us accomplish that goal.

Our backend engineering team have a variety of different backgrounds: we have several non-graduates; only a couple of us studied Computer Science; one of the team has a degree in Marketing; some of us have worked in huge companies; some have only ever worked in startups; others are former consultants. As long as you enjoy learning new things, we’d love to talk to you.

We work in project-based sprints, and take turns to be the floating engineer who handles interrupt-driven work and non-critical bug fixes. We work directly with everyone across the company, from customer support to regulation, product to financial crime, and we run regular knowledge-sharing sessions so you’ll learn heaps about everything from how banks work to effective communication.

We encourage an open and transparent working environment. You can get involved in any aspect of the business you are interested in and, following Stripe’s example, all emails in the company are visible in an email archive. We regularly run hackathons in which people build things on our third party API and we contribute to open source software as much as possible. We’ve also made our product roadmap public and give sneak peeks of features in our community forum.

If you’re unsure about applying or have any questions about the role or team, please don’t hesitate to email our CTO Jonas (jonas@monzo.com) directly :) We're very open about what we do in general, so our blog is a good place to learn more about what we do.

Stack: Go, Cassandra, Kubernetes, Kafka, Linkerd/Finagle

Learn more on our careers page: https://boards.greenhouse.io/monzo/jobs/244898

Monzo | London | REMOTE, INTERNS and VISA all welcome

We are building a bank from scratch using modern technologies. Our product is a mobile first bank account for retail customers.

We are hiring for

- Backend developer - Web developer - Android developer - Security engineer

You can get a better sense about what we are doing on our blog (https://monzo.com/blog) and in particular the blog post about our backend platform (https://monzo.com/blog/2016/09/19/building-a-modern-bank-bac...)

As long as you are a nice person that learns things quickly we would encourage you to apply. We care deeply about our company culture, fostering an environment of inclusiveness, transparency and feedback. We're 18 months old, 60 people, raised £13M in funding, have 50k prepaid cards in the market and 200k people on our waiting list.

Our interview process consists of an informal phone call, a take home exercise, an exercise review call and an on-site or Google Hangouts interview.

For a full job description, please have a look at our job ad on our website: https://boards.greenhouse.io/monzo/jobs/244898

All banks in the EU will have to offer APIs in 2017 because of PSD2: http://www.out-law.com/en/articles/2015/january/key-features...

The alternative to open APIs is that third parties ask customers for online banking passwords. This practice is significantly less secure than, say, OAuth2 or similar and is generally against a bank's TOS, which makes the customer liable.

I work at Monzo.

I agree that using microservices and kubernetes is not what allows us to provide a good user experience. We could provide the same user experience if we had built everything on rails and postgres. In fact, that would have been much easier.

The reason we are investing so heavily in a rock solid platform is that we want to still be able to offer the best possible user experience in 10 years time. This is what we mean when we say we want the platform to be "extensible".

Many large banks IT systems are not extensible, in the sense that it is very expensive to make changes. Take, for example, the ability to freeze a card in the app at the tap of a button. A friend at RBS told me that they considered this feature many times, but it took a long time to work out which 20 IT systems would need changing and some of them had been under change freeze for a few years. So eventually the idea was discarded as too expensive.

The freeze card feature would be easy to implement for a startup, regardless of their stack. The key is to still be able to implement such a feature easily in 10 years time :)

I wonder if OpenAI could define and build against a robot API that hardware robots would implement in different ways. That way OpenAI could focus on the software and various other teams could compete to solve all the mechanical challenges you mention.

What does replacing the auth page gain the attacker? At worst the user enters their email address into a phishing page. The important thing is that there isn't a password :)

The devil you know I suppose ;)

IIRC we didn't go too far down the client cert route because we're behind CloudFlare and we like it that way. Something to revisit in the future.

As much as I love Stevie, teller.io and this demo: Why not both?

OAuth 2 is not "bad" in general, you just need to consider the implications of using it. If you have an API that allows clients to move customers' money or take out loans, you should take additional steps to defend against MITM attacks. For example using client side certificates :)

That said, TAuth looks really good and tidy. Of course the developer may still lose the private key, so in the end you'll always need to additionally monitor API requests for suspicious behaviour.

Thanks a lot for the link :)

I'd rather hire a CISO that understands security and teach them how to think like a regulator than vice versa! Heck, I have long hair myself and didn't have any contact with policy documents until just over a year ago. And both our CTO and CEO like to write code.

Basically, we're looking for our Alex Stamos. Any more ideas you have how we might find somebody like that and avoid the stigma of the "Bank CISO" job would be much appreciated.

[I work at Mondo] Yes please! We're currently working out what form that will take exactly.

Why do you ask this? I'm keen to hear what you'd like to see from us :)

During our current alpha test we don't invest your money at all. It's just kept in cash with our partner bank Wirecard.

[I work at Mondo] You raise a good point, indeed. Security is something we take very seriously. As others have stated already on this thread, groups that target banks are incredibly sophisticated and well capitalised. All other banks face the same issues, of course, but unlike them we can't afford to simply write off losses to cybercrime.

We see Mondo as an opportunity to build a great security culture from the ground up. We're currently hiring a Head of Security role in London: https://getmondo.co.uk/careers

If you know anyone that

- is an excellent communicator

- likes to code and does so regularly

- can think like a black hat (CVEs and PoCs please!)

- doesn't mind writing the occasional policy document

please send them my way: jonas@getmondo.co.uk

BTW, at the moment we are not holding customer balances or approving transactions so we're not a particularly juicy target, yet. That said, we've already conducted pen tests and invited a number of security firms to come and break our software :)

Here's a video from a similar talk at Golang UK: https://www.youtube.com/watch?v=cFJkLfujOts

I work at Mondo. We will be a member of the Financial Services Compensation Scheme (FSCS) and all customer deposits will be insured up to £75k per person.

During our current alpha test (and before we have a banking license), your funds are actually held by our partner bank Wirecard.

Edit: The internet beat me to it. My work here is done :)

DuckDuckGo uses Google search results

I've responded to the same question here: https://news.ycombinator.com/item?id=10623845

I take your point that you wouldn't want to open source everything, especially not the few critically secure bits of your infrastructure.

That said, money transfers take a couple of days because most interbank clearing houses were modelled after paper-based batch processes where people shuffle through paper a few times a day.

There are several real-time payment schemes in the world. Retail customers in the UK mostly use Faster Payments (FPS) for interbank transfers and they clear within a few seconds.

I work at Mondo. People's savings are generally insured in banks.

Once we're a bank, customer funds up to £75k per account will be insured via FSCS.

In the meantime, the customer balances held on our prepaid debit card sit ringfenced in customer-specific accounts. If we went bankrupt, the funds can't be touched by our creditors and will simply be returned to the customers.

Edit: spelling

Hi DomBlack, I work at Mondo.

The cards we're issuing now are prepaid debit cards backed by another firm's license (Wirecard Card Solutions Ltd).

We're aiming to have a full banking license and issue our own cards by the end of next year.

Hi redbeard0x0a, fully agree! We do try to open source as much as possible. We have open-sourced large parts of our stack already:

https://github.com/mondough/

Hi, I work at Mondo.

We need to work through a bunch of KYC and AML issues around EU-wide signup, but it's definitely high on our priority list.

That said, our accounts will initially be GBP only, so we'd hold your balance in pound sterling.

If you sign up to our waiting list we'll reach out as soon as we know more :)

Hey, I work at at Mondo. We're building a startup retail bank with an API for developers.

You can find our API documentation here: https://getmondo.co.uk/docs

The APIs will be publicly available to developers and account holders. We've only just started rolling out our first cards, though, so we're not on boarding many third party developers at the moment.

If you'd like to play around with the API, send an email to developers@getmondo.co.uk and we'll see what we can do :)

Yep, a friend of mine is building a product that exposes the private APIs that banking apps use in a developer-friendly way: http://teller.io/

That said, using your account data in that way with third parties is often against the terms of service that a customer has with their bank.

You can still derive some information from this kind of analysis.

We can conclude that "this idea sounds stupid" or "this is a first-time founder" are not good reasons to dismiss an investment opportunity. In other words, the mentioned traits don't appear to be strongly negatively correlated with startup success.