Free Money

[Piru]

@stopthegop

Just as easily as money can be "direct deposited" into an account, so can money be directly withdrawn from an account.

That is nonsense.

I challenge anyone to withdraw money from my account which is 517220-52770. Bank is Kotkan Seudun Osuuspankki - Karhulan konttori, IBAN FI50 5172 2050 0027 70.

Just because US banking sector is a fragmented mess doesn't mean that rest of the world has the same. Quick hint: IBAN account details are only useful for transferring funds into bank accounts. And no, no-one uses checks anymore. Last time I saw a checkbook was over 20 years ago.

To recap: There is no need to keep your IBAN secret (at least the EU). In countries with developed banking system (such as USA), you're obviously better off by staying paranoid.

[Piru]

I just did.

Well? When are you going to transfer my money out? I'm waiting...

[Piru]

It is a known fact that you can perform a cheque-con in the USA by just knowing the account number and personal details.

This does not work in the EU (and pretty much rest of the world).

[Piru]

Here's some information about IBAN:
http://www.ecbs.org/Download/LFL9204V4.pdf

Just to make this absolutely clear: IBAN, even when combined with any personal information (even your SSN), is not enough to withdraw money from your account.

However, this doesn't mean you should be giving out your SSN, it is still used for some rudimentary authentication elsewhere.

[Piru]

Maybe I should explain how "online banking" works here in Finland.

In order to get access to my account you'd need to know my user id. It is no way related to my account number or any personal information.

Second, you'd need to know my password. It is no way related to my account number or any personal information.

Once you've logged in, in order to do any transaction you'd need to know challenge-response number from a key list (say, "enter security ID #75"). Needless to say, the lists are totally random and I have the only copy. One number is used only once. Once all the numbers are used I can order a new list (and the numbers on that particular list are only activated at that time). Note that the list itself is useless unless if you know the user id and password, too.

If the challenge is ok then you're able to perform the transaction. This is the only way international transaction can be initiated, other than physically walking into the bank (and this involves ID with picture etc).

All of those three different identification numbers are totally unrelated to each other, and to any personal information. The connection to the bank website is protected with TLS.


So could someone please explain how in earth you could somehow transfer money out of my account?

[Piru]

@stopthegop

The party initiating (say perhaps I have two accounts, one in two different banks) the transaction uses similar system to log in, that is the only way. There are no third parties involved, the transaction is between banks, or even within the same bank.

Thus, it is always secure.

No-one can remotely draw any money from my account. Only I myself can initiate transfers (exception is the contract where certain reoccuring bills, such as electricity, water, inet are paid automagic, but even in this case I have initiated the draw, by setting up the contract).

Considering this system has been up even before the EU in the current form was formed, and that EU itself is far less integrated than United States, it's quite weird US hasn't been able to set up similar system. Perhaps there are profits involved, and thus resistance against change?

[Piru]

@JosephC

What Mr. Piru means is that his bank does not allow him to purchase things online. Piru is banished from the entire world internet economy.

I didn't say CC wasn't available.

It has absolutely nothing to do with my account number, however.

[Piru]

@nBit7

Changes every log in? Holy crap that sounds a bit over the top.

That's the whole point of the challenge-response system. Even if your login and password leaks, that final lock is still at place preventing abuse.

It'll take that any day compared to losing money.

There does become a point were more security is not a good thing.

Sure. This isn't one of those cases however.

[Piru]

@nBit7

How sure are you that someone knowing enough basic details about you; couldn't get on the phone and convince the person on the other end that they are 'you'. Change your mailing address and get a new codes.

Resetting the password requires physical visit to the bank (at least here). Also, they'll never send the login/pass over mail (except the initial login/pass when you create the account).

Only thing you get via email are the challenge/response lists (which are useless without the login/pass).

Believe me, they have thought these things over.