News for hackers. Stuff that matters.
Re:Ask HN: Why hasn't the ACH system been more abused? by RyanCavanaugh on Monday August 29, 2022 @02:08PM (#32641423)
It's the same question as why people keep so many valuables in houses where you can just break a window, walk in, and take stuff: because you go to jail if you do that.

If ACH was different and you could just, say, walk up to an ATM and punch in a routing/account number and withdraw cash, it'd be a very different situation. You can only interact with the ACH system through a regular bank, and regular banks have KYC regulations that mean the recipient of those funds has a name, address, and SSN. Doing theft via ACH means the funds end up in account clearly tied to your identity, and you go to jail.

Re:Ask HN: Why hasn't the ACH system been more abused? by ryandvm on Monday August 29, 2022 @02:42PM (#32641876)
Bingo. This is something the cryptocurrency extremists just willfully refuse to acknowledge. It turns out that transaction reversibility and the ability (and willingness) of law enforcement to get involved are extremely useful tools in most commerce scenarios.
Re:Ask HN: Why hasn't the ACH system been more abused? by glennvtx on Monday August 29, 2022 @10:48PM (#32646104)
There is nothing inherent to cryptocurrency that prevents the ability to reverse a payment, it can be done in a contract, only both sides must agree to use it. Personally i see the inability of government ( or anyone else ) to arbitrarily modify transactions as crypto's greatest strength. Want reversibility? you can have it. Want a custodial institution to manage your account? you can have that too, Nothing stopping you. The system is flexible and secure in ways the traditional financial system is not.
Re:Ask HN: Why hasn't the ACH system been more abused? by chadash on Monday August 29, 2022 @11:25PM (#32646309)
The parent is referring to reversibility without both parties agreeing. I send merchant money from my bank to buy widget. Merchant doesn’t send me widget. Bank can reverse transaction without needing merchant permission. And the buck stops with the courts who can enforce the final action.
Re:Ask HN: Why hasn't the ACH system been more abused? by survirtual on Tuesday August 30, 2022 @10:17AM (#32650786)
Can you really say this and not see the problem with it? Is it possible so many people have become this utterly complacent they can’t see tyranny when it’s right in front of their faces?

The same banks that caused 2008 and got bailed out can unanimously control transactions. The same banks that cause endless global conflict, that fix elections, that manipulate politicians, that rig the fabric of capitalism and democracy all around the world, that enable socialism for the rich and rugged individualism for the poor…those same banks are the ones you trust to “reverse transactions without permission”.

This is the problem crypto fixes. It removes the banks power. It has reversibility; it just needs to be integrated with the/a identity mechanism and legal system. The main purpose is to cut out the bankers.

Re:Ask HN: Why hasn't the ACH system been more abused? by chadash on Tuesday August 30, 2022 @03:25PM (#32654010)
I just want to be able to get a refund if the toaster that I ordered doesn't get delivered. How would crypto go about doing that without it being in the sole discretion of the seller?
Re:Ask HN: Why hasn't the ACH system been more abused? by survirtual on Wednesday August 31, 2022 @08:56AM (#32661479)
How do you do that now, with a market like Amazon?

It works the same way. You can introduce voluntary trusted market intermediaries and utilize things like escrow. Big enough markets can provide liquidity such that all transactions appear realtime, but sellers can provide a deposit to the market to cover problems.

That is one method among a gazillion.

We do not need banks. All bank functions need to be mathematically automated with no trusted parties.

Re:Ask HN: Why hasn't the ACH system been more abused? by glennvtx on Monday September 05, 2022 @10:32AM (#32724734)
There is nothing preventing the use of neutral third party contracts, For example a non profit arbiter of such cases, recognized for impartiality in an open market. Just like the better business bureau, or similar organizations. Merchants can display a "your purchase protected by" banner, the market itself will determine the best form the material incentives for such an organization would take, perhaps "loser pays the fee" could work, or a subscription model, more like a traditional bank.
Re:Ask HN: Why hasn't the ACH system been more abused? by throw101010 on Monday August 29, 2022 @05:25PM (#32643774)
If reversibility is needed any "cryptocurrency extremist" will tell you that there is no trustless solution to this kind of transaction and that a trusted intermediary (usually an escrow) is needed.

This is what happens with fiat money anyways, it is just so intimately mixed by now (credit cards, ACH, etc.) that you figure it's the only kind of transaction that exist or should exist.

Crypto is providing an alternative to this point of view, if you don't think you need it, don't use it, pretty straightforward... and if you want to stop it because you want people to think like you, try to stop it, let's have fun.

Re:Ask HN: Why hasn't the ACH system been more abused? by permo-w on Monday August 29, 2022 @06:09PM (#32644192)
I think it’s the evangelism of crypto that irritates people, not the personal use of it, although there are the obvious environmental issues with that too.
Re:Ask HN: Why hasn't the ACH system been more abused? by throw101010 on Tuesday August 30, 2022 @05:24AM (#32648318)
I don't think anybody asked what was annoying about crypto, we are talking about irreversibility and why it can be a useful option for some people. But thanks for sharing your concerns I guess.
Re:Ask HN: Why hasn't the ACH system been more abused? by permo-w on Tuesday August 30, 2022 @11:41AM (#32651701)
you spent the last paragraph of your comment complaining about people having a problem with crypto as if you have no idea why that might be

also perhaps consider taking a less passive aggressive tone. throwaway accounts are not an excuse to be rude

Re:Ask HN: Why hasn't the ACH system been more abused? by throw101010 on Tuesday August 30, 2022 @09:16PM (#32657218)
There isn't a single "complaint" in the paragraph you refer to.

If stating the factual matter of what you can do with or against crypto is "rude" to you, feel free to not answer next time, as your whining/concern trolling won't change much to these facts... especially when they don't relate to what was debated: reversability of transactions.

Re:Ask HN: Why hasn't the ACH system been more abused? by gernb on Monday August 29, 2022 @02:16PM (#32641543)
This doesn't really answer the question though. People steal things all the time. The easier it is to steal the more they do it. Bikes, breaking into cars, purses, etc...

We have passwords and two factor to prevent this stuff for lots of situations but in this ACH case we seem to have nothing. What's special about ACH vs all other situations? Why do I need a password and two factor on other accounts but not ACH? It's just as illegal to break into those other accounts is it not?

Re:Ask HN: Why hasn't the ACH system been more abused? by bombcar on Monday August 29, 2022 @02:22PM (#32641621)
You can't just take money with the numbers.

You have to be a bank or otherwise registered with the clearing house.

So you can ask your bank to pull money from my account, and if I object my bank will claw back the money from your bank and they will know who you are.

And if it wasn't all a misunderstanding or a typo, then they know where to find you.

Re:Ask HN: Why hasn't the ACH system been more abused? by sp332 on Monday August 29, 2022 @05:24PM (#32643769)
You can just take money with the numbers. A business can just ask for ACH account info for payments. That means a customer could use someone else's "numbers" to fraudulently buy thigs. And maybe that other person wouldn't be liable for the fraudulent transaction, but the customer would still have the stuff they bought without leaving an ID behind.
Re:Ask HN: Why hasn't the ACH system been more abused? by Sohcahtoa82 on Monday August 29, 2022 @05:42PM (#32643938)
What businesses allow you to pay via ACH?

Off the top of my head, the only ones I can think of are utilities, other banks (so you can make loan payments), and consumer payment processors like PayPal. In the first two, they'll have your ID. In the latter, they do the "make two deposits" thing to verify you own (or at least have access to) the account.

I can't go to Wal-mart and pay via ACH. Do they even take personal checks anymore?

Re:Ask HN: Why hasn't the ACH system been more abused? by jrockway on Monday August 29, 2022 @06:33PM (#32644420)
> What businesses allow you to pay via ACH?

Pretty much anyone with a Stripe account can accept payments via ACH.

https://stripe.com/docs/payments/ach-debit

I worked at an ISP and we definitely appreciated it when our customers paid via ACH instead of credit card. (Less fees.) We were tiny, too; you don't have to be a giant company to get this going.

Re:Ask HN: Why hasn't the ACH system been more abused? by riking on Monday August 29, 2022 @11:27PM (#32646328)
Stripe is still "your bank".
Re:Ask HN: Why hasn't the ACH system been more abused? by jsmith45 on Monday August 29, 2022 @06:12PM (#32644213)
Of course they still take personal checks. How else would elderly granny that does not trust "plastic" pay? Some would do it with cash, but many have paid with checks their whole lives, and will not stop until they drop dead.

And it certainly used to be common for e-commerce sites to accept "electronic checks" by having you type in the routing and account numbers, with no additional verification. These days, there usually is additional verification.

It is still commonly accepted with no verification for payment for things like utility bills. This appears to be on the assumption that if there is check fraud they probably know the guilty party, because who else would be trying to pay your power bill?

Re:Ask HN: Why hasn't the ACH system been more abused? by awad on Monday August 29, 2022 @06:44PM (#32644506)
Happens plenty in B2B but, again, reputational risk is involved
Re:Ask HN: Why hasn't the ACH system been more abused? by edgyquant on Monday August 29, 2022 @05:57PM (#32644083)
This business would run the risk of being cut off from the financial system.
Re:Ask HN: Why hasn't the ACH system been more abused? by cowtools on Monday August 29, 2022 @06:02PM (#32644126)
Okay, but the business has no way of stopping this attack, so it is fruitless.
Re:Ask HN: Why hasn't the ACH system been more abused? by tyingq on Monday August 29, 2022 @02:19PM (#32641581)
You could hack someone's business bank account and ACH debit other people, yes.

But then you have to get the money out of that account, and into cash in your hands without leaving a trail that leads to you. It's possible, but complicated. And if you could do it, there was probably already significant money in the account you hacked into in the first place. No need to pad it with ACH debits that might set off alarm bells.

Re:Ask HN: Why hasn't the ACH system been more abused? by cortesoft on Monday August 29, 2022 @07:55PM (#32645043)
The answer is that people DO steal via ACH, just like people rob houses. They are caught and prosecuted. What makes you think no one ever steals via ACH?
Re:Ask HN: Why hasn't the ACH system been more abused? by nerdponx on Tuesday August 30, 2022 @12:57AM (#32646767)
I actually know someone who was a victim of this, they had written some checks and the recipient had used them to make unauthorized withdrawals. I believe everything was reversed after the police got involved.
Re:Ask HN: Why hasn't the ACH system been more abused? by olliej on Monday August 29, 2022 @06:39PM (#32644478)
The question I think is more “why does someone have to give me their account details and so allow me to remove an arbitrary amount rather than me providing my account details knowing that all you can do is give me money?”
Re:Ask HN: Why hasn't the ACH system been more abused? by ramesh31 on Monday August 29, 2022 @02:11PM (#32641471)
This. Same as fraud. I could put up a website right now, point some ads to it, and start harvesting thousands of CC numbers to sell. But then I would go to jail.
Re:Ask HN: Why hasn't the ACH system been more abused? by 29athrowaway on Monday August 29, 2022 @02:24PM (#32641645)
18 U.S. Code § 1343 - Fraud by wire, radio, or television

https://www.law.cornell.edu/uscode/text/18/1343

ACH fraud is wire fraud

Re:Ask HN: Why hasn't the ACH system been more abused? by tibbon on Monday August 29, 2022 @02:31PM (#32641735)
Is credit card fraud not?
Re:Ask HN: Why hasn't the ACH system been more abused? by rsstack on Monday August 29, 2022 @05:26PM (#32643785)
"Credit card fraud frequently involves elements of both bank fraud and wire fraud"

https://www.justia.com/criminal/offenses/white-collar-crimes...

Re:Ask HN: Why hasn't the ACH system been more abused? by throwgogog111 on Monday August 29, 2022 @06:07PM (#32644170)
> because you go to jail if you do that.

The people involved in money transfer scams are never, ever going to jail, ever.

Re:Ask HN: Why hasn't the ACH system been more abused? by rosnd on Monday August 29, 2022 @02:32PM (#32641739)
Wow, you can't do crime because it's illegal!

How do you explain the widespread availability of "drop" accounts in the US? Cybercrime forums are full of people offering services to "cash out" illicit bank transfers into cryptocurrency.

Re:Ask HN: Why hasn't the ACH system been more abused? by lynndotpy on Monday August 29, 2022 @09:02PM (#32645506)
Another explanation:

Integrating over all of the possible outcomes of wire-fraud, being put in prison is more likely than making millions of dollars and using them as you please.

Or, at least, enough people believe this, and also prefer not to be in prison, that they do not commit wire fraud. It might also be because it's difficult. (I don't personally know how I'd take up wire fraud, if I wanted to start.)

"Being put in prison" is a likely outcome because of complex and overlapping human constructs that have lead to power structures where other people can force you into a prison. This is why it's relevant that it's "illegal". Briefly, "we live in a society".

The kind of "shape" wire-fraud has (in terms of the likelihood of its outcomes, i.e. very high risk, low chance of reward) is found in many things. A lot of illegal things have this shape.

The above commenter probably assumed all this to be 'background'. With that "because you go to jail if you do that," is a succinct and basically correct statement, even if it is not prefaced with every possible exception.

Re:Ask HN: Why hasn't the ACH system been more abused? by rosnd on Tuesday August 30, 2022 @04:59PM (#32654971)
But wire fraud isn't rare. There are large gangs that specialize in opening bank accounts using fake documentation who then offer these accounts on a variety of fraud-related forums.

Every Eastern European craigslist scammer has access to US business bank accounts to accept payments for their nonexistent cars and boats.

Re:Ask HN: Why hasn't the ACH system been more abused? by cortesoft on Monday August 29, 2022 @07:58PM (#32645059)
The question wasn't "why is there NO abuse of the ACH system" it was "why isn't there MORE abuse of it"

The answer is, it is illegal, and easy to catch, so people don't abuse it as much as they would if it wasn't illegal.

Re:Ask HN: Why hasn't the ACH system been more abused? by rosnd on Tuesday August 30, 2022 @05:02PM (#32655026)
>The answer is, it is illegal, and easy to catch, so people don't abuse it as much as they would if it wasn't illegal.

Why is it easy to catch? The OPs premise that you have to provide identification to open bank accounts is obviously false.

Re:Ask HN: Why hasn't the ACH system been more abused? by RyanCavanaugh on Monday August 29, 2022 @02:51PM (#32641982)
It's not that you can't, it's that the risks of getting caught doing it and punished for it are too high relative to the reward.

If you don't believe that deterrence is a real thing, there is a lot more human behavior that needs explanation than just the relative lack of ACH fraud.

Re:Ask HN: Why hasn't the ACH system been more abused? by SilasX on Monday August 29, 2022 @05:20PM (#32643706)
You still don't seem to understand why "it's illegal" is not a great insight to lead your example with. Even if true, the answer would lead with what makes this illegal thing so less prone to violation than other illegal things.
Re:Ask HN: Why hasn't the ACH system been more abused? by permo-w on Monday August 29, 2022 @06:12PM (#32644223)
it is illegal and easily detectable
Re:Ask HN: Why hasn't the ACH system been more abused? by rosnd on Monday August 29, 2022 @06:30PM (#32644401)
How do you explain the widespread availability of "drop" accounts in the US? Cybercrime forums are full of people offering services to "cash out" illicit bank transfers into cryptocurrency.
Re:Ask HN: Why hasn't the ACH system been more abused? by SilasX on Monday August 29, 2022 @06:27PM (#32644373)
I got that part. Still doesn’t justify a comment that starts with a paragraph implying that illegal things can’t happen because deterrent. That doesn’t help.
Re:Ask HN: Why hasn't the ACH system been more abused? by cortesoft on Monday August 29, 2022 @07:59PM (#32645071)
They never implied that it couldn't happen, they implied it didn't happen that often because it is illegal.
Re:Ask HN: Why hasn't the ACH system been more abused? by SilasX on Tuesday August 30, 2022 @10:35AM (#32651002)
Which is a bad explanation. Lots of illegal things happen often anyway. Implying that being illegal automatically contains it is a bad explanation and a bad premise to start from. The question is, why is this illegal thing not more violated? Just like I said in the past two replies.
Re:Ask HN: Why hasn't the ACH system been more abused? by 0x457 on Monday August 29, 2022 @08:01PM (#32645092)
It being illegal makes parties involved forced to cooperate. If someone hacks your Twitter and tweets something - the FBI isn't going to investigate who did that. If someone commits a wire fraud with your account - FBI will investigate.
Re:Ask HN: Why hasn't the ACH system been more abused? by permo-w on Monday August 29, 2022 @06:34PM (#32644429)
no one said they can’t, just this is largely why they don’t. are you going to rob a supermarket where you have to hand in ID at the door? or will you find somewhere easier?
Re:Ask HN: Why hasn't the ACH system been more abused? by rosnd on Monday August 29, 2022 @06:37PM (#32644452)
https://www.nbcnews.com/news/world/margaritas-story-how-one-...

https://www.ice.gov/news/releases/russian-man-pleads-guilty-...

They do this, at giant scale. When you're earning tens of thousands of dollars per account, it's worth it to train people to go open bank accounts using fake passports.

Re:Ask HN: Why hasn't the ACH system been more abused? by SilasX on Tuesday August 30, 2022 @10:41AM (#32651066)
That my point: “it’s easy to catch and enforce” would be the relevant fact to lead with, not “duh it’s illegal silly!” The latter is true for a lot of things that aren’t enforced, and is really condescending to start with.