Oh yeah, this was one of the most insane things I experienced moving to the US.
If someone has your bank account number they can withdraw money from it. For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it.
It gets better: if you have someone’s bank account number you still cannot transfer money to them. It would literally be easier to tell your bank (say etrade or whatever) that it was your bank account.
That’s why all these absurd abank payment systems exist in America. The act of just giving someone money is incredibly hard.
Yes, though they must be a bank or have an agreement with a bank. Random person can't just do it by just having the numbers. And a bank can get in trouble if it allows shady clients access to ACH.
> bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took
In my experience, it is usually the reverse - they put a small sum there, and then withdraw it back after auth. But the end result is the same, of course (except if you have less than $1 on your account).
> if you have someone’s bank account number you still cannot transfer money to them
That's indeed weird, because I see no technical reason (at least with my knowledge about ACH - btw HN had recently a couple of nice articles about it) why that would not be possible, but my bank only allows me to transfer money to my accounts. No idea why. Maybe some legal stuff?
OTOH there are apps like venmo which make it easier.
Nope no requirement that they be a bank. Plenty of places allow you to pay online by “direct deposit”, which in every country other than the US involves them providing you with their bank a/c details.
In the US you give them /your/ bank account, and /they/ initiate the withdrawal. Anyone with your account details can pay for something from your account, including to a service they can withdraw from.
Better yet fraud insurance covers credit cards, not debit or “cheque”. Specifically: if someone uses your bank a/c# you are responsible for recovering the money.
> Plenty of places allow you to pay online by “direct deposit”
Looks like you've missed the "or have an agreement with a bank".
> if someone uses your bank a/c# you are responsible for recovering the money.
I do not think this is true. Of course credit card fraud liability policy only covers the credit card, but there are rules about bank transfers. My reading of https://www.law.cornell.edu/ucc/4A/part_2 is that the customer is liable for the payment only if it is authorized and passes "commercially reasonable" security procedure. If somebody just gets you bank account number, it's clearly not an authorized payment (unless they make it look authorized, i.e. by stealing your identity or passwords, etc.) and you will not be liable for it.
> For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it.
That is crazy! I remember Paypal doing the opposite in the UK, they made 2 or 3 tiny deposits and asked how much they were.
I'm not sure what "errands bank account" means, but I'm in the US and making a couple random deposits <$1 to confirm an electronically linked bank account is mine is how things are done here in my experience. They always take the deposits back afterwards, too.
If someone has your bank account number they can withdraw money from it. For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it.
It gets better: if you have someone’s bank account number you still cannot transfer money to them. It would literally be easier to tell your bank (say etrade or whatever) that it was your bank account.
That’s why all these absurd abank payment systems exist in America. The act of just giving someone money is incredibly hard.