To allow someone a direct deposit they should only need your name and bank account numbers. You shouldn't be giving them access with things like your password.

Giving them your name/account number is all that's needed for someone to withdraw from your account. That's how gyms work. They just require your account number and/or a void check (which has your account number). They don't need you to sign into your bank account.

I don't think any responsible bank would let you withdraw using just an account number. What kind of security would that be? My bank certainly doesn't - allowing a debit requires me to authorise via 2FA - they obviously can't just take money.

>> I don't think any responsible bank would let you withdraw using just an account number.

That is literally how checking works in the united states. You can withdraw money from a bank account if you have a routing number and bank account number and "permission." The permission could be a signed check, it could be an auto-pay ACH you set up by handing a paper form to someone, it could be a web-form you signed without looking over the fine-print.

Most extractive companies (e.g., gyms, verizon) have so many fine print and so many lawyers that they can literally take anything from you without recourse. You'd spend tens of thousands in lawyer fees without getting the money back. You could go to the attorney general's office for your state. Good luck with that, unless its a common issue, you just have to eat the cost as part of being American.

Or it could be nothing. In this case, its still on you to figure it out and get the money back in time.

My state prohibits gyms from requiring ACH exactly to prevent this sort of abuse. It doesn't stop them from trying, or structuring their fees.

The gym industry is very predatory and it needs far more regulation.

It should be noted that in the US, some banks will allow you to request a default ACH block/lock on your account, and I highly encourage you to ask for such.

That's not only a States thing. Direct debit works similarly in Europe.

That said I haven't heard of companies or fraudsters abusing it

Direct Debit in Europe has strong guarantees in favour of the customer, e.g. reversing charges.

"A no-questions-asked, fast and simple Refund procedure available within eight weeks of the debit date."

Within 8 weeks of the charge, you just phone (or otherwise) your bank and ask them to undo the charge.

> That's not only a States thing. Direct debit works similarly in Europe.

Maybe it still works that way in some parts of Europe, but in others it has been changed to work differently, or doesn't exist anymore and has been replaced by other systems, depending on how you want to put it.

>I don't think any responsible bank would let you withdraw using just an account number

What do you think a check is? It's a piece of paper with your account number, who to pay, and how much. There's a signature field, but it's not checked too closely (I don't think my bank even asked for a signature sample when opening my account) and signatures are trivial to forge.

> What do you think a check is?

My bank doesn't give me a cheque book any more - haven't see a person use a cheque in about a decade. I can't believe they'd let someone cash a random cheque with no authorisation.

Just guessing by "cheque", are you outside the US? The checking system & ACH might be more of a US-centric phenomenon. It's been busted forever, but it's just how we do things around here.

> It's been busted forever, but it's just how we do things around here.

Which is why the rest of the developed world wonders: So why don't you stop that and catch up to, say, the 1990s?

I do that when people send me money for birthdays once a year. Stick the check in the atm, i get money and the person wasn’t asked.

My bank allows me to deposit a check just by photographing it with their smartphone app. No more visits to ATMs needed.

This is every bank in the United States.

Our payment infrastructure ... has some legacy features.

> I don't think any responsible bank would let you withdraw using just an account number.

It happens in Australia as, just fill up a direct debit form which has the client's name, account number and sign.

Are you talking about the paper forms you find at banks, because they dont work that way.

I got the form from the rental agency which directly debits from my bank account for the rent.

Honestly it's absurd that that we have two distinct numbers (account and routing) but you always use both, they don't change, and they are good for both deposits and withdrawals. It would be so easy to only require an account number for deposits and to have a unique routing number for each withdrawal. Maybe for convenience you have some fraction of your assigned routing numbers be good for repeat withdrawals but only for the amount and frequency specified for the first instance. Thus you can hand out your bank account number to anyone without concern, and they can give you money easily, but only those who you legitimately desire to pay can take money from you and their opportunity for abuse is limited, and all the infrastructure remains relatively unchanged.

This is not the case in the rest of the world.

It’s the same in Canada. I had to setup direct withdrawal for a strata (condo) fee by visiting my strata’s bank with a “blank cheque” (print out of a .png from my own bank’s website, trivially forged). The teller had already set up the monthly withdrawal before I reminded her she forgot to even check my ID!

It gets worse too - once I moved and wanted the withdrawals to stop, my own bank claimed there was no way they could stop them, only the withdrawing bank could cancel it. Of course I wasn’t a signer on the strata account as I was no longer a resident, so was completely reliant on them to stop.

Legacy features doesn’t even begin cover it. Those people that keep all their money under their mattress aren’t quite as insane as you might think.

No, you can do it in New Zealand too. I’m so weirded out by it that I just pay these things manually, so have never actually filled in the form that allows it.

It is; the US banking system is a mess. Everything clears through the fed, believe it or not.

There are two things you can do, however: one is request your bank set a default ACH block, and the other is to create a sub/second account from which you do all your ACH transfers for utilities and whatnot. It's a bit of an extra hassle (unless your bank allows for scheduling automatic transfers; many do) but it assures that stuff like can't happen. I've done it for a business that took paypal payments, specifically to stop paypal from being able to yoink back funds a month or two later. Within hours of a payment coming in, I'd transfer it out of the ACH-linked account into the business's main account.

> fucking crazy

It’s true though. This was essentially the plot of “catch me if you can”.

It's a carryover from before the internet. It still exists because it's still used.

You might enjoy looking at how things were done before the internet existed, because all the stuff that you do with the internet also was done before just in a different way.

There is a similar thing in EU but it's very regulated (though all processes are very lengthy and paper-heavy) and used for paying utilities etc, not gym.

I assume checks in the USA have the equivalent of sort code and account number printed on them (as well as name of the account holder) like they used to in the U.K.?

Checks in the US have two numbers; the number that identifies the bank, and the account number. That’s all you need to transfer money between bank accounts in the US.

You should be funneling income into a separate account and moving it elsewhere after.

I do this as well.

This reminds me to look into a long standing request of mine. I want Chase to give me an account that has no external bank access allowed. Money can only be moved into/out of it from the other Chase account under my ownership. My immediate look a few years ago did not reveal any built in way to make this possible.

I have a friend that is extremely wealthy. He can pretty much buy whatever he wants.

He does this all the time. He has a "cannon fodder" bank account that gets just enough for the expected payments.