News for hackers. Stuff that matters.
Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @06:27AM (#30904994)
Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare.

https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin...

https://www.reddit.com/r/UKPersonalFinance/comments/db9j5z/m...

https://www.theguardian.com/money/2020/jun/06/monzo-customer...

I'd be far more interested in a blog post explaining that than how great their infrastructure is.

Re:How we secure Monzo's banking platform by YawningAngel on Monday April 04, 2022 @06:53AM (#30905142)
No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen....

Source: used to work on Monzo's financial crime team.

Re:How we secure Monzo's banking platform by jagged-chisel on Monday April 04, 2022 @07:34AM (#30905425)
Others replying here are jumping to conclusions.

A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything.

Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.

Re:How we secure Monzo's banking platform by physicsguy on Monday April 04, 2022 @07:44AM (#30905502)
The law is really strict. If you look on reddit.com/r/ukpersonalfinance there's loads of people complaining that Monzo have frozen accounts and won't tell you way. In pretty much every circumstance, the person involved has been moving large amounts of money around through Crypto, so it's fairly obvious why they might flag that up as potential fraud/money laundering and cause an investigation.
Re:How we secure Monzo's banking platform by dmje on Monday April 04, 2022 @10:03AM (#30906761)
I'm in the process of trying to open a UK business bank account for myself and two other directors. The hoops we have to jump through are insane.
Re:How we secure Monzo's banking platform by xyst on Monday April 04, 2022 @09:15AM (#30906248)
It’s definitely their anti money laundering (AML) detection system kicking in. However it’s clearly getting false positives and their internal AML team is getting hit with a high amount of them thus causing the delays in resolving them.

This is why you don’t build your own solutions to well solved problems.

Re:How we secure Monzo's banking platform by avianlyric on Monday April 04, 2022 @11:04AM (#30907483)
Monzo’s system is a little unique in that it runs fraud and AML checks in real-time while the transaction is being processed, and thus able to block a high risk transaction before it completes. As a result Monzo is frequently able to return stolen funds to victims.

Other banks run their AML systems in batch at the end of the day, and will only freeze an account after the money has left.

So yeah, you’ll see a lot more people complaining about Monzo, because their money will be frozen while they’re trying to exfiltrate it. That doesn’t mean Monzo has an unusually high false positive rate, it just means that people are used to being able to get away with fraudulent behaviour, and have their accounts frozen empty. Rather than being stopped mid-act and having their accounts frozen while they still contain illegitimate funds.

Re:How we secure Monzo's banking platform by Nextgrid on Monday April 04, 2022 @09:18AM (#30906277)
I wonder if their system, by virtue of being modern, is too good and catches a lot of fraud that would otherwise remain undetected by legacy banks' systems? Not to mention, opening a Monzo account is much easier and can be done remotely, thus it could be attracting a lot of malicious activity that just wouldn't even reach the legacy banks because the laborious account opening process would filter those out?
Re:How we secure Monzo's banking platform by dalyons on Monday April 04, 2022 @11:27AM (#30907752)
I work for a different fintech and both of your points are spot on. Much higher baseline fraud attempts due to online/remote accounts, but much more sophisticated real-time ML/detection systems.
Re:How we secure Monzo's banking platform by dylan604 on Monday April 04, 2022 @12:13PM (#30908344)
>getting false positive <snip> delays in resolving them.

There should be a penalty for this. When "innocent" users are denied access to their money, those actions are much more felt by the user than the bank. That user's money is a rounding error to a bank, but to the user it is everything.

An incorrectly frozen account should come with some sort of "oops we're sorry" type of something that a bank can understand: monetary reward for the user.

I would rather criminals get away with a laundering transaction than me not being able to buy/pay for something in my day to day because of some dumbass AI algo.

Re:How we secure Monzo's banking platform by avianlyric on Monday April 04, 2022 @03:18PM (#30910853)
> There should be a penalty for this.

There are, the FCA and Financial Ombudsman hold banks to an extremely high standard and hand out fines and compensation on a regular basis. Denying access to funds is a serious issue which banks and regulators take very seriously. However there’s an acknowledgment that AML systems have false positives.

> I would rather criminals get away with a laundering transaction

Easy to say when it’s not your money that’s been stolen. Most money being laundered through retail banks like Monzo isn’t drug money, or high stakes bank heists. It’s the millions stolen every year from normal people subjected to high pressure, complex, coercive and extremely effective social engineering scams.

We’re talking about peoples house deposits (because their solicitors emails got hacked), their life savings, their retirement funds.

Don’t assume you’re immune to these scams, or that you’re paying a cost for it. The scams trick even the most savvy individuals. Costs are borne by everyone with a bank account because victims are reimbursed, and I can assure you, no bank is sacrificing their profit margin to do that.

Re:How we secure Monzo's banking platform by KptMarchewa on Monday April 04, 2022 @08:57AM (#30906077)
Generally when your account is locked any complaint against that doesn't even touch customer service, but compliance department.
Re:How we secure Monzo's banking platform by Nextgrid on Monday April 04, 2022 @09:20AM (#30906307)
The concerning thing is that the other commenter says it took him a year and a complaint to the financial ombudsman to recover his money.

False positives are one thing, but it shouldn't take a year to resolve?

Re:How we secure Monzo's banking platform by acallaghan on Monday April 04, 2022 @10:01AM (#30906732)
I suspect this is more to do with the financial regulation & the bodies that investigate these things, rather than Monzo.
Re:How we secure Monzo's banking platform by smnrchrds on Monday April 04, 2022 @10:29AM (#30907025)
So if we pick any UK bank we will see the exact same issues?
Re:How we secure Monzo's banking platform by 0des on Monday April 04, 2022 @06:55AM (#30905158)
I'd love to read a thread where you and OP try to see maybe what happened, theoretically, in Minecraft of course.
Re:How we secure Monzo's banking platform by YawningAngel on Monday April 04, 2022 @11:47AM (#30908032)
I used to work there :)
Re:How we secure Monzo's banking platform by tawaypol on Monday April 04, 2022 @08:54AM (#30906038)
This happens in the US too. This kind of thing is why I'm using crypto for as much as I can, I always feel like my bank account might disappear one night and all the money in it will be tied up for a month or so. It's already happened to me once.
Re:How we secure Monzo's banking platform by gadders on Monday April 04, 2022 @07:21AM (#30905321)
So 100% of account locks are due to money laundering, then? Not card theft, fraud, error or anything else?
Re:How we secure Monzo's banking platform by stavros on Monday April 04, 2022 @07:26AM (#30905367)
The link doesn't really clarify much for me, can you elaborate? Are you saying the GP laundered money?
Re:How we secure Monzo's banking platform by YawningAngel on Monday April 04, 2022 @11:46AM (#30908020)
I'm saying that the bank gets royally fucked if they ever tell anyone who is even suspected of money laundering anything, so as a result they simply don't tell anyone anything. Whether the GP actually did it or not isn't really relevant because banks would rather lose a customer than incur the regulator's ire.
Re:How we secure Monzo's banking platform by melevittfl on Monday April 04, 2022 @11:04PM (#30914893)
I’m sure you know this, but it’s not just regulator’s ire. It is a criminal act in and of itself to disclose that someone is a target of an investigation.

And it’s not just a criminal act for the organisation, but the individual customer service agent can be held personally criminally liable for disclosing, even accidentally.

So yeah, they have a really strong incentive not to tell you anything.

Re:How we secure Monzo's banking platform by stavros on Monday April 04, 2022 @01:53PM (#30909773)
Ah I see, thank you.
Re:How we secure Monzo's banking platform by MaxBarraclough on Monday April 04, 2022 @06:52AM (#30905132)
> "we refuse to tell you why" and in some cases holding onto their money for months

I don't know anything about Monzo specifically, but perhaps anti-money-laundering laws might be the reason. Monzo is presumably obligated to take steps against money laundering, under UK law, where it's essentially an offence to say Our system has flagged you as a potential money-launderer. [0] Freezing your account without comment may be their safest course of action.

edit I see this explanation was mentioned in the reddit thread.

[0] https://www.lawsociety.org.uk/en/topics/anti-money-launderin...

Re:How we secure Monzo's banking platform by nvarsj on Monday April 04, 2022 @08:04AM (#30905666)
Happy Monzo customer here with it as my primary account for the last 2 years. Haven’t had any issues, and neither have any of my friends. It’s the best possible banking experience imo. I’m happy they are proactive about suspicious activity.
Re:How we secure Monzo's banking platform by Milner08 on Monday April 04, 2022 @10:07AM (#30906800)
Same here. Its funny that you get accused of being a paid shill, yet the people who so loudly complain get taken seriously. I dont know anyone who's had an issue and I would say 90% of my friends have monzo.
Re:How we secure Monzo's banking platform by festive-minsky on Monday April 04, 2022 @11:41AM (#30907922)
Same here. I've been using them as my main account for years, no problems since I'm not trading crypto. People act as if no other bank has issues with fraud detection
Re:How we secure Monzo's banking platform by stuckkeys on Monday April 04, 2022 @08:57AM (#30906070)
Sounds like a paid “amazon” review. lul
Re:How we secure Monzo's banking platform by Closi on Monday April 04, 2022 @11:25AM (#30907730)
Ah yes, a long term commenter with 10 years of posts, housands of Karma and hundreds of unrelated comments was just playing the long-game so they could shill Monzo. And it was a person who just joined the site that found them out! /s

I've also had great experiences with Monzo, so will also back them up.

Re:How we secure Monzo's banking platform by nvarsj on Monday April 04, 2022 @11:07AM (#30907521)
Haha, I just wanted to provide a counter example to the complaint. Yeah, it did sound a bit like a shill. Just a happy customer though.
Re:How we secure Monzo's banking platform by xyst on Monday April 04, 2022 @09:31AM (#30906425)
Probably works at Monzo
Re:How we secure Monzo's banking platform by benhurmarcel on Monday April 04, 2022 @04:43PM (#30911728)
Re:How we secure Monzo's banking platform by corobo on Monday April 04, 2022 @07:08AM (#30905234)
My money is on it being crypto related, but that’s because the only people I’ve seen complaining about this publicly were doing some crypto stuff (tx both in and out) and it looked very laundry-esque out of context when you get into the actual details

And yeah as others have said that’s not a Monzo thing not telling you, no UK bank would tell you why they think you’re laundering money

Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @07:23AM (#30905338)
Not in my case - no crypto, no recent large transfers. I'm a boring middle-aged IT consultant, not a terrorist, drug dealer or crypto trader. There was absolutely nothing I'd done with my account that should have caused this to happen.

That's what's so kafkaesque (and frankly rather violating) about the experience: you literally haven't the faintest idea what you've done wrong and the bank refuses to tell you.

Re:How we secure Monzo's banking platform by antihero on Monday April 04, 2022 @07:50AM (#30905555)
Yes the law compels them to be like this. It’s actually criminal to tip someone off they’re being investigated.

Perhaps the law is too strict due to the impact it can have on individuals.

Re:How we secure Monzo's banking platform by porker on Monday April 04, 2022 @07:37AM (#30905452)
Use First Direct. They're designed for boring middle-aged IT consultants. :)
Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @07:56AM (#30905601)
Not disagreeing (First Direct has a far better reputation) but it's really a brand of HSBC. The irony of having to move to a bank suspected of funding [1] actual drug dealing/laundering/terrorism so my accounts won't get frozen over imaginary drugs/laundering/terrorism is somewhat amusing.

[1] https://www.thebureauinvestigates.com/stories/2021-07-28/mon... / https://www.forbes.com/sites/afontevecchia/2012/07/16/hsbc-h...

Re:How we secure Monzo's banking platform by aaaaaaaaata on Monday April 04, 2022 @08:36AM (#30905900)
They're not suspected, they admitted it, and paid their speeding fine.
Re:How we secure Monzo's banking platform by ijonas on Monday April 04, 2022 @08:36AM (#30905901)
I had a similar experience, not crypto-related.

My employer paid me a couple of grand in expenses, which I quickly moved to another account. That triggered an account freeze.

I asked the customer service rep for "why" - couldn't tell me. They then asked me for payslips to prove my story. I told them feck off because they could see the monthly entries marked "Salary" from the same source.

I escalated the matter and it took several hours before my account was unfrozen.

Lesson: only keep a minimum amount of money in UK bank accounts.

Re:How we secure Monzo's banking platform by dwb on Monday April 04, 2022 @06:49AM (#30905118)
Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @06:58AM (#30905170)
Sure, but that doesn't explain the sheer scale on which it happens (more than other UK banks and with seemingly worse consequences) or how the system actually works. It's also notable that this post was written a year before some of the news articles, indicating that Monzo really hadn't done anything to improve it.

One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability for a broken system that's literally ruining lives.

Re:How we secure Monzo's banking platform by samjmck on Monday April 04, 2022 @07:27AM (#30905375)
> Sure, but that doesn't explain the sheer scale on which it happens

How do you know the scale and how are you not sure that it's a vocal minority? After all, Monzo does target more tech-savvy users that might be more likely to voice their frustration online than with other high-street banks.

> One gets the feeling they're hiding behind the "we can't tell you why" excuse to escape accountability for a broken system that's literally ruining lives.

Because maybe they are being forced to hide behind that? UK banking regulations are notoriously strict when it comes to what banks are allowed to share with their customers.

Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @07:35AM (#30905429)
> How do you know the scale and how are you not sure that it's a vocal minority?

Read the articles and look for similar experiences for other banks. There's definitely a lot more noise about Monzo doing it. Maybe (as another comment suggested) there's a selection bias at work but I assure you it's a real thing, and appallingly handled by Monzo when it happens.

> Because maybe they are being forced to hide behind that?

That misinterprets what I said. If there are rules that say they don't have to be accountable for a misfiring fraud prevention system that hurts real people, where is the incentive to fix it?

Re:How we secure Monzo's banking platform by physicsguy on Monday April 04, 2022 @07:46AM (#30905527)
What's the average age of a Barclays or TSB user vs a Monzo user? According to this, 72% of Monzo customers are 18-35: https://www.businessofapps.com/data/monzo-statistics/

If that's the case, it's fairly obvious why there'd be a lot more noise - a lot larger percentage of people in that age group doing crypto, and a larger percentage are "very online" and likely to complain about it there.

Re:How we secure Monzo's banking platform by drcongo on Monday April 04, 2022 @08:43AM (#30905948)
I've switched to Starling. I still use Coinbase yet Starling have never frozen my account or held on to my money for a year.
Re:How we secure Monzo's banking platform by KptMarchewa on Monday April 04, 2022 @08:57AM (#30906071)
You know that it does not happen to 99,9% of their customers either? For some reason everyone here thinks they are a snowflake.
Re:How we secure Monzo's banking platform by drcongo on Monday April 04, 2022 @09:00AM (#30906101)
You're rather contradicting yourself there. If it's not happening to 99.9% of their customers then we obviously are special snowflakes. Maybe you could think through your attempts at insults a bit better.
Re:How we secure Monzo's banking platform by KptMarchewa on Monday April 04, 2022 @10:21AM (#30906929)
It's you who claimed that nothing happens at your other accounts and that has to be "proof" of anything.
Re:How we secure Monzo's banking platform by drcongo on Monday April 04, 2022 @10:33AM (#30907075)
No, I didn't. Try reading it again.
Re:How we secure Monzo's banking platform by Milner08 on Monday April 04, 2022 @07:24AM (#30905344)
They are 100% not behind the 'We cant tell you why'. It only takes the smallest amount of reading to figure that out. They have to report it to the FCA and you can read the reports from the FCA that suggest its not actually any worse than other banks. Its just more talked about. (No I am not going to dig them out for you).
Re:How we secure Monzo's banking platform by mocko on Monday April 04, 2022 @07:48AM (#30905539)
Searched and I can't find any. I did, however, find a Which? article that says "Resolver found almost three-quarters of complaints about frozen bank accounts mentioned ‘digital’ banks".

Statistically it doesn't seem likely that Monzo and its ilk would be so overrepresented merely because their customers are more fazed than others about having their money taken away. Still, if the FCA have published meaningful statistics I could be proved wrong.

https://www.which.co.uk/news/2021/09/why-banks-are-freezing-...

Re:How we secure Monzo's banking platform by bostik on Monday April 04, 2022 @08:31AM (#30905869)
I can't tell which way the arrow of causality points, but all the digital banks in the UK are in various stages of still growing to reach the scale where they can become sustainably profitable.

This in turn means that they will have their risk assessments inverted from the usual high-street banks: optimise signup/account creation flow, and deal with AML requirements in a slightly delayed fashion. Making it really easy and smooth to open a current account brings in a surprising fraction of the crowd who would be rejected or otherwise earmarked by high-street banks.

Being digital upstarts, these modern banks also don't have the fraud and risk departments their established competition has. In order to not get hammered by the FCA, they almost certainly veer on the blunt instrument side when dealing with suspicious activity. And law of large numbers guarantees that there will be a significant number of false positives.

Re:How we secure Monzo's banking platform by dazc on Monday April 04, 2022 @09:04AM (#30906142)
As a former Barclays customer I can confirm this. Last year I changed from self-employed to limited company and changing my business account at Barclays proved to be impossible despite always previously being in credit with no issues at all. I was able to open a monzo business account in less than 20 minutes.

This, I should add, at a time when there was a high incidence of fraud with people trying to open business accounts for dormant and non-existent companies simply so they could claim Govt backed loans where it was clear that very few checks were actually being carried out.

Re:How we secure Monzo's banking platform by nnx on Monday April 04, 2022 @11:00AM (#30907437)
Most likely some automated AML check...

You are simply a false positive of this ineffective policy that has a success rate of 0.2% according to recent United Stations study: https://www.effectiveaml.org/un-slams-aml-success-rate/

Globally, it has almost zero impact on crime for an infinite cost.

Re:How we secure Monzo's banking platform by maxehmookau on Monday April 04, 2022 @08:48AM (#30905983)
Yeah, this ended up on Watchdog on UK TV which was entirely unfair. No UK bank can tell you why your account was frozen, it's illegal to do so.

(I don't work for Monzo, but I've been a happy customer since day 1)

Re:How we secure Monzo's banking platform by drcongo on Monday April 04, 2022 @08:37AM (#30905908)
Disgruntled former Monzo customer here too. Froze my account after I cashed out some bitcoin on Coinbase, held on to all my money for over a year and refused to answer support requests. Only got my money back off them when I brought the financial ombudsmen into it.

Don't touch them with a ten foot pole.

Re:How we secure Monzo's banking platform by Milner08 on Monday April 04, 2022 @10:08AM (#30906808)
They explicitly tell you that Cypto is banned tbf.
Re:How we secure Monzo's banking platform by Dig1t on Monday April 04, 2022 @11:20AM (#30907668)
Wait huh? Is this a UK law? Or they don't support transfers from Coinbase for some other reason?
Re:How we secure Monzo's banking platform by traceroute66 on Monday April 04, 2022 @08:11AM (#30905718)
> Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? I

As others have pointed out already, AML/KYC laws are strict. They are strict in general for financial services, but for banks, because of their privileged position in the financial system, its even stricter.

But there is a second aspect which is that challenger banks such as Monzo take an even more cookie-cutter approach. If you don't fit their definition of what a "client" is then you will be in for a hard time. Normal banks do this too (to a degree) but challenger banks are much more hard-core about it because if you fall outside the cookie-cutter then you mess up their fragile business model.

Case in point, I know of a well-known, well-established, UK VoIP operator. They moved their business over to one of these challenger banks (might have been Monzo !) because the challenger bank provided APIs to enable integration to their internal systems, which is something that the old-school high-street bank did not offer - and the banking fees were lower too, always a bonus !

TL;DR: $challenger_bank had a definition of a client that did not include provision of VoIP services. So after about a year as a client, said VoIP provider found their account frozen (in this instance they were explicitly told, it wasn't a silent freeze). VoIP provider attempted to constructively engage with $challenger_bank but it was like talking to a brick wall "computer says no".

(N.B. I have oversimplified the story a bit, so please don't nitpick !)

Re:How we secure Monzo's banking platform by Nextgrid on Monday April 04, 2022 @09:25AM (#30906355)
Is it Andrews & Arnold? I remember their director blogging about moving the business to Monzo so they can get real-time webhooks for incoming payments. I've just checked and they still appear to be using Monzo as per their "bank details" page.
Re:How we secure Monzo's banking platform by traceroute66 on Monday April 04, 2022 @12:24PM (#30908505)
> Is it Andrews & Arnold?

Nope, not them. I'm surprised they haven't been frozen given Monzo's stated policy[1]:

"Certain industries have higher risks, where we need to put extra checks and controls in place. We’re currently focusing on industries that don’t need these. In future, we might offer accounts to some of these industries. But we appreciate this is disappointing for some businesses at the moment."

Followed by a long list that includes "technology equipment, like lasers or telecommunications"

(For those wondering, telecoms wasn't there at the time the other guys had an account, and they were not selling equipment anyway)

[1] https://monzo.com/i/business/eligibility/

Re:How we secure Monzo's banking platform by rand49an on Monday April 04, 2022 @11:51AM (#30908083)
Didn't ever have that trouble but I have been repeatedly turned down for a joint account while both me and my partner have good records with credit, high earners and no worrying financial history.

Switched to Starling instead and created one instantly.

Re:How we secure Monzo's banking platform by lnxg33k1 on Monday April 04, 2022 @07:25AM (#30905360)
the fear of that happening to me was the reason I terminated my account too, reading people having their main account frozen out of nowhere for months was very concerning