News for hackers. Stuff that matters.
Re:Senators push to ditch social security numbers in light o... by kuschku on Thursday November 09, 2017 @01:02AM (#15660240)
SEPA Direct Debit, yes, is used like that.

But abuse is very low, as it requires that whoever does it identifies themselves first at another bank, and opens a merchant account (which has other verifications). And then reversing it is easy, too.

And you can't even shop with stolen IBANs at Amazon, because every major retailer will first send you a 1ct transaction with transaction info set to a OTP you use to verify that you own the account.

Re:Senators push to ditch social security numbers in light o... by espadrine on Thursday November 09, 2017 @01:43AM (#15660371)
Wouldn't the equivalent of ACH transfer be SEPA Credit Transfer (SCT)?

I'd add that SEPA being mandatory for all participating countries has simplified transfers a great deal. Now most banks remember creditors, just like a phone book but for money, so sending money from your phone is pretty neat.

Additionally, the SEPA effort created ISO 20022, which is gaining ground worldwide as a one-stop-shop format for financial transfers. See this article from the US Federal Reserve a couple of weeks ago: https://fedpaymentsimprovement.org/news/press-releases/feder...

Re:Senators push to ditch social security numbers in light o... by kuschku on Thursday November 09, 2017 @01:55AM (#15660431)
Well, depends on if you consider push or pull.

SCT is entirely push, and requires signing the transaction with your card, or using at least 2FA for verification. This doesn’t happen by accident.

SDD is entirely pull, and is the only one that could theoretically be abused, but that’s as mentioned also not that easy.

Re:Senators push to ditch social security numbers in light o... by uf on Thursday November 09, 2017 @01:51AM (#15660412)
And the merchant needs to have a valid direct debit mandate that he has submit to his bank which in turn transmit it to your bank for it to check. After your bank has confirmed the mandate the transfer can be initiated.

SDD can be reversed without giving any reason for a whooping 8 weeks by the customer sometimes simply by clicking "reverse" and entering a TAN.

B2B is a different beast though.