Hacker News Reader

Comment by a1k0n | Hacker News Reader

This is sort of frightening. The obscurity of ACH was the only real security it had; now if I write a check, anyone who sees it can trivially withdraw whatever they want from my account using the above API, no? What sort of fraud protection is there?

View on HN

This end point only allows you to send money to a bank account.

Only to a bank account? haha and the money never comes from any bank account, huh? Again: what fraud prevention is there?

Presumably, they have some sort of funding system, where they can control/screen the intake and perform verification.

MichaelGG, you're correct. We verify the bank accounts of the companies that register w/ Balanced to use our ACH API.

Ah, I misunderstood. That makes sense.

> if I write a check, anyone who sees it can trivially withdraw whatever they want from my account using the above API, no

You always were able to do that - even before this post - using traditional online banking. I won't go into the details here, but trust me, it's frighteningly easy[1].

> What sort of fraud protection is there?

This isn't up to Balanced to solve. It's a banking system problem at its core.

[1] The problem is actually much worse, because it allows anyone to compromise your entire banking account (not just your checking account) trivially, but I'll leave that as an exercise to the reader!

If you're in SF, I'll buy you a coffee and we can talk about how terrible the ACH network is. I have very strong opinions on this. We're just trying to jump on the grenade and make it bearable for everyone else :)

I'll buy you coffee AND hear what you have to say.

:-)

just read your CV. WF, Singly, Cars.com, you must know the pain of payments, marketplaces, and APIs very well.

Email me at my HN handle @balancedpayments.com

Unfortunately I'm in NYC, though I'd love to hear your thoughts on ACH! Let me know if you happen to make your way out here at some point - my email is nqvgln@nqvglnzhxrewrr.arg (ROT13).

Reply on news.ycombinator.com