Comment by jasode | Hacker News Reader

Comment by jasode | Hacker News Reader

Parent Full thread

>[...] and security.

Disagree about the security. I just found out last month how unsecure the use of paper checks actually are because they expose your bank account & routing number.

I had an old checking account that was dormant and I hadn't written any paper checks against it for 10 years. What then happened was a landscape service asked me for payment for some work so I had my credit-card ready to settle the bill but they surprised me by saying they would charge extra 3% fee for processing the card. However, they said there was no fee if I paid by paper check. I didn't want to pay hundreds extra in fees so I used that dormant checking account to pay them with a paper check. They cashed my check the next day and I didn't think anything about it.

About a month later, I saw a mysterious "e-check" that subtracted money from my dormant checking account! It was not ACH; it was a generated e-check from a billing service popular with adult companies. So somebody from the landscaping company used the numbers on the bottom of my paper check to generate a fake digital check. The thief was on a website that let you pay for a subscription by creating an echeck; the web form would have fields for entering anybody's bank routing # and account #. (Example: https://solutionscout.com/payment-processing/e-check/)

When I talked to Bank of America about the fraud, I asked the customer service representative if there was any security setting that would prevent fake checks like that from deducting money from the account. He said "no". The fake e-check even had a totally bogus check # that was out of sequence with my real checks and he said their system doesn't verify the sequential #s. Literally, you're powerless to stop it and the only thing you can do is let the fake e-checks steal your money -- and then later file a fraud claim hoping to get the money back!

Paper checks are flawed with a critical security hole by letting companies generate fake e-checks. This means the more paper checks you write and release out into the world, the more of your banking surface area is exposed for you to become a victim of fraud.

For business accounts, "positive pay" and "reverse positive pay" are solutions to check fraud. With "positive pay", you upload the check number, the payee name, and the amount to your bank, if any of them don't match, such a check is rejected. With "reverse positive pay", your bank delegates the responsibility of approving any check to you.

Paper checks are useful, if you have various accounts with different banks. You can write a check for yourself to move money around.

Even mailing personal checks is not secure, as they are stolen. Even postal employees are involved in this [1].

[1] https://www.nbcnews.com/news/postal-worker-3-charged-24-mill...

>their system doesn't verify the sequential #s

Not sure what good that would do. I keep a few checks in a travel folder and have a couple pads of checks in different places around my house. I don't necessarily write checks in sequential order.

Yes, they're not very secure. It's also a system that generally works pretty well for a lot of people. And, yes, it's a good idea not to keep an excessively large bank balance for a variety of reasons.

>Not sure what good that would do. I keep a few checks in a travel folder and have a couple pads of checks in different places around my house. I don't necessarily write checks in sequential order.

Yes, I understand that scenario where the checks are not written in exact sequential order by the account holder -- nor are they presented to the bank for clearing in exact sequential order by people trying to cash them.

However, when the last real check I wrote is sequence #3374 and the fake e-check hitting my account is sequence #1687557289469, that's an arithmetic difference of 168 billion checks!

We're not talking about a fudge factor difference of +/- 50 in check numbering because real people write paper checks out of sequence. We're talking about basic sanity checking for fraud. E.g. Do bank account holders typically write billions of checks such that the simple subtraction of 2 different check sequence numbers is billions apart?

Here's the crazy part... The Bank of America website UI for online banking already visually warns you when it detects a out-of-sequence check # gap! It just doesn't use that existing logic to stop payment on an obviously counterfeit echeck.

The system you're envisioning whereby banks refuse payment on otherwise valid checks based on Reasons seems a lot crazier.

So a valid check is presented to my bank with sequence number N and cashed. Another valid check is presented with sequence number N+10000 and refused. So now I've got to pay a fee to the second vendor for the returned check, they probably won't accept a check from me now so I've got to pay with a credit card and there's a decent chance I'm paying 3% more for that pleasure. So the bank trying to be helpful just cost me $25-50+3% and has done nothing to prevent actual fraud from occurring - I would not be using that bank for very long!

The guy at that landscaping company already committed a bunch of felonies, it's computer fraud, bank fraud, probably one or two others. Not sure what the bank wasting its efforts trying to combat this would accomplish.

>Not sure what the bank wasting its efforts trying to combat this would accomplish.

It would prevent me from losing my money! I filed a fraud claim form that also required an affidavit with notarized signature and Bank of America still won't return the stolen money. That money is gone.

>The system you're envisioning whereby banks refuse payment on otherwise valid checks based on Reasons seems a lot crazier.

My point is that BofA computer systems already have some aspects of "suspicious activity" algorithms and heuristics in place to prevent counterfeit checks stealing funds from the account. The banks are already "wasting effort" as you put it to try and distinguish real vs fake checks. E.g. When the landscaper tried to cash my legitimate check that had my handwriting and my signature, the bank sent me a phone alert which I then had to explicitly approve. Otherwise, they would reject the check. (An example of "Reasons" as you put it.) This is what the verification alert that requires explicit approval looks like: https://imgur.com/a/62dCsBx

But the next check a month later that someone faked, with a weird sequence #, without any signature, and the "payee" to a company notoriously known for unauthorized checking account withdrawals and fraud... No alert for my approval was sent; instead, they just went ahead and paid it.

If the banking system allows 3rd parties to fabricate e-checks with no verification, they should also offset that dangerous power by allowing account holders the security tools to stop those types of echecks from being cashed. E.g. a smartphone approval step.

It is likely because the bank doesn’t know what checkbooks you own and use, and has no way to know it. You could have ordered more third-party checks (legal, not fabricated), and if you do, commonly you would use a different sequence starting point for those, so that you can distinguish which checkbook you used. More commonly the case for businesses but you can buy them from Intuit for example: https://intuitmarket.intuit.com/checks

> It would prevent me from losing my money! I filed a fraud claim form that also required an affidavit with notarized signature and Bank of America still won't return the stolen money. That money is gone.

As someone who was previously a customer of Bank of America and suffered my own form of theft and fraud (I was pickpocketed and someone used my debit card illicitly afterwards before I could cancel it). I can tell you with an absolute certainty that your experience is very specific to Bank of America or large national banks generally and not any sort of rule or law.

Do yourself a big favor and close your accounts with BoA and join a local/regional credit union. Nearly a decade after my first incident, I had another issue and the experience and how I was treated by my credit union vs how BoA treated me were worlds apart.

Either one will require an affidavit, the credit union offers members a free notary service at any branch so I simply filled it in person at a branch. The affidavit is to protect the bank by ensuring you are liable for false statements. The credit union also helped me pressure the police to actually do something, which resulted in three arrests of a group of teenagers that had more than 800 stolen cards in their possession when arrested. And I had the stolen funds returned to my account the same day at the branch, good as cash.

In that interim decade I stopped carrying a debit card and only used credit cards because of how badly my experience with BoA was. I now know that it’s not the card you use, it’s the /bank/ you use that makes the difference.

> We're talking about basic sanity checking for fraud. E.g. Do bank account holders typically write billions of checks such that the simple subtraction of 2 different check sequence numbers is billions apart?

When I last used checks (about 30 years ago?), my sequence numbers would vary by that much because I used them to encode metadata about the check. Only the last 3 digits were actually a sequence number.

Reply on news.ycombinator.com