Too Easy For Bank Accounts To Spring a Leak 208
The NYTimes has a cautionary tale of automated clearing house fraud. Parties unknown siphoned money from an individual's bank account. Nothing too unusual there, except that it was an elite private banking account at JPMorgan Chase, and the account holder is out $250K — the bank will only cover $50K of his loss. The $300K came out of the account in small transactions over 15 months. The bank offered no recourse except to open a new account, a large hassle given that the account is more than 20 years old and its holder writes a thousand checks a month. The article details how the spread of electronic settlements between banks has given rise to growing automated clearing house fraud — if anyone gets hold of the magic combination of account number and bank routing number, and once has permission to withdraw funds, all bets are off. Banks are unlikely to question future withdrawal orders. Moral of the story: go over your bank statements line-by-line every month, and question anything that looks funny.
Re:Well... Why? (Score:5, Informative)
Re:scary (Score:3, Informative)
Thats correct.
I trawl through your trash looking for checks (photocopies or voids, it doesnt matter).
All I need is your routing number and checking acct number. Even the routing number can be obtained by calling the bank and asking for it. It's nearly public knowledge.
The only tricky thing is the requirement of ACH access. One could "pay via e-check" by getting the 2 chunks of information and forge them. There's not a damned thing that can be done about that. Once it hits an approved ACH dealer, you're screwed out of your funds.
I have ACH blocks on my account.
Re:Cover (Score:3, Informative)
The bank's responsible for 100% if you catch it within 60 days of the transaction. This guy did not piece together what had happened until 15 months after the first transaction.
Re:Well... Why? (Score:5, Informative)
Next time, try reading the article.
Or for critical reading, read the cut-n-paste
That second paragraph cues me in that he DID complain, and was given a runaround and no real answers.
Re:Well... Why? (Score:3, Informative)
Yes, but they weren't proper and secure transactions. Why should the account holder be culpable for the bank's failure to protect itself from fraud?
To your second point, I agree. Someone who has so much money that they don't notice an average of $20,000 per month missing from what is apparently a very active account should probably hire an accountant. For that much money you can get a very good one and apparently still have enough money left over that you will come out ahead.
Re:Well... Why? (Score:3, Informative)
Then... Why the limitation of 50k$ when FDIC covers 100$k ?
FDIC is not fraud insurance, it's total bank failure insurance. Big difference.
Sounds like Credit Suisse (Score:5, Informative)
And a retail bank statement is kindergarten arithmetic compared with the monthly statement for a private banking client.
I used to have a Credit Suisse account, and they did, indeed, have incomprehensible statements, even for a simple situation. They had a "current account" and a "time account". The current account didn't pay interest, but the "time account" did. Interest from the time account went into the current account, and when it exceeded US$1000, it was moved to the time account in multiples of $1000. Separate statements were provided for each account, on different schedules, didn't mention what was happening in the other account, and were difficult to match up. Lots of weird fees, too, including charging commissions on their own time deposits. It all seemed to be about fee maximization.
And this was without doing much in the way of transactions on the account. If you did lots of transactions against accounts like that, it would be really tough to track what was happening. The combination of inter-account transactions and differing statement cycles confuses the issue.
Re:My bank sends daily alerts for large transactio (Score:3, Informative)
This allows me to not only easily spot fraudulent transactions, but also allows me to keep an eye on how much money I really have available, regardless of what the bank says.
Great. So, like this guy did, you go to your bank with your QuickBooks or whatever, showing that you should have substantially more money than you do, and the bank tells you to go soak your head, they're the bank goddammit, and there's no way in hell that your accounting could be more accurate than theirs.
You know, like they told this guy. Then what the hell do you do? Apparently you can go fuck yourself, since according to the laws the banks purchased, they can hand out your money to anyone that presents trivially falsifiable certifications, and there's not a damn thing you can expect them to do about it.
This guy went every month to the bank with evidence of funny business, and they told him that he must be running the numbers wrong, and then handed him balance statements that obfuscated the transactions.
Sure, it's prudent to keep track of your own money. But what about when you've kept such good track of it that you realize some is missing? What the hell are you supposed to do then? I don't think Quicken has a form for that.
Re:It's easier than that. (Score:3, Informative)
Or you could just compare expected balances.
He did. He called to complain several times and was told that there was nothing wrong.
But the account holder has some responsibility, wouldn't you agree? If someone is siphoning money out of my account for 15 months, I'd definitely notice and report it in the first month.
Actually, you probably wouldn't have clue #1. Especially not the first month.
If you RTFA, you'll see why. Private banking statements are really hard to read if you're not used to them. Hell, they're hard to read even when you are used to them.
After my wife and I got our first statement, we had to go into our private banker and ask for a lesson on how to read the thing, and my wife and I are not financially illiterate. I am an economist, and my wife works for a bank developing new products. So if the two of use couldn't make heads or tails of the thing, then it's to be considered hard to read.
At this point, I can understand them, but they are a pain to read, so I don't read them as closely as I should. I'm not worried about the above happening to me because I don't pay any bills out of my managed portfolio, and I don't have a personal account at the private bank. If ACH debits started coming in, my banker would be all over it.
What I do not understand about JPMorgan's behavior is the following:
I cannot relay to you just how shocked I am that JPM would treat this guy so poorly. I don't use JPM, so I can't comment on their private banking division, but my banker has done everything in his power and then some to keep us happy. To allow a high net worth client to be victimized by fraud at all is just nuts, and to turn around and tell him he's just screwed... unheard of.
Re:Checks suck (Score:1, Informative)
First, if someone defrauds your credit card, you're not liable. Dispute the charge and you're done, the onus is then on the merchant to prove the validity of the transaction. With cash accounts, once the money is gone, it's gone.
Wrong, at least for consumers. In the USA, at least, Regulation E protects you against direct debits to your checking account the same as if you were a victem of credit card fraud. You have 60 days from the time you are notified about a fraudulent transaction to dispute it. Notification is generally taken to mean the receipt of a printed statement. Once you have notified your financial institution, they are obligated to research and resolve the issue within 10 days, or provisionally refund your money and take up to another 45 days. Once the investigation starts, the onus is on the merchant to prove they had authorization. Very rarely does a consumer bear any responsibility for fraudulent transactions (and then only in cases where they knew their account information was compromised but failed to let their financial institution know in time to stop possible fraudulent transactions.
For business customers, the protections are much, much fewer. Generally, you have 24 hours to disover and dispute a fraudulent transaction. The bar is higher for these folks because it is assumed that they have stock holders, employees and a dozen other reasons why they should be excrutiatingly careful with their money. For these folks, many banks will offer account reconcilation services, and, what would have particulary helped the person in TFA, Positive Pay and Reverse Positive Pay. If you aren't at a bank that offers these, you need to find one that does.
Oh, and one last thing...banks generally treat their employees like crap. No one makes any money working at a bank unless their a VP or above. Departments are criminally understaffed with folks that exit as soon as they can find other work. With interest rates so low for so long, fee incoming has become a driving factor as well. Given the disconent, low wages, and pressure not to waive fees for customers at the customer contact level, it is quite common to deal with bank personnel that have NO CLUE what they are doing, and infrastructures that don't WANT them to know. The next time someone at a bank tells you they don't know what your "real" balance is, there's two things you need to do 1) have pity on the wage slave, and 2) find another bank.
Re:Well... Why? (Score:4, Informative)
Banks are responsible for fraudulent transactions if you tell them about it in a timely fashion. Banks don't and can't know whether every single transaction is legitimate or not. There's simply no way for them to do so. For example, what if somebody alters one of your checks, for example, to read an amount greater than what you wrote? Assuming a good alteration, there's no way they could know that this is not the amount of money that you intended.
Even in the case of more obvious fraud, it should be clear that there needs to be some kind of time horizon. What if I'm the victim of ACH fraud as this person was, but I don't tell the bank about it until five years after the fact? It's way too late for the bank to do anything about it by then. And in fact this would leave the bank open to different types of fraud. For example, you arrange for a friend to "defraud" your account by some amount, split the money between you, then have your friend seal himself off from the offending account over the intervening years. Then five years later you make a complaint and get your money "back", resulting in a healthy profit for the both of you with little risk.
If we're on the same page about it so far, the question is what that time horizon should be. Well, big daddy government has already answered that for us: that time horizon is 60 days. That's why this guy is still getting $50,000 back from his bank, because that's the amount that was stolen within the past 60 days.
If this guy had noticed the fraudulent transactions in a timely manner then I would agree that we shouldn't blame him at all for failings of the system. But he managed to miss twenty thousand dollars a month leaving his account for well over a year before he figured out that he was being ripped off. He discovered trouble earlier but apparently decided that it was too inconvenient to follow up on. When asked about the discrepancy, the bank told him that their statements were accurate. What was absolutely true! Their statements included an enormous amount of theft that his records did not. But for some reason he didn't pursue these persistent discrepancies, and he is now paying the price for that decision.
Silly (Score:5, Informative)
Seriously with a bit of work it shouldn't be hard to keep track of your financials these days, especially with instant access via the Internet.
You've obviously never seen a private banking statement. For fun, I pulled out my July statement. There were 3 actual transactions on it (not dividend/reinvestment), and the statement was 40 pages long.
These statements really scream "DO NOT READ ME". I'm just sayin'. (Yes, I read and understand my statement, but I can fully sympathize with those who cannot. I needed my banker to go through the first one with me page by page just to understand the thing, and I do not consider myself to be an idiotic or financially illiterate person.)
Re:Ok so (Score:3, Informative)
Is someone forcing you to use a bank with statements that complex? Seems to me there's a lot of choice in banks out there. If you bank has statements that are too complicated, get a different bank.
Nobody is forcing me to use that private bank, and I have no particular affinity for complicated statements (although I'm pretty sure all private banks have similarly complicated statements). The only reason I use my current bank is because that's where my portfolio manager works. If he moved, I'd move too. I spent months looking for one that I trusted, and now I have experience with him to validate that trust.
When things get complicated, you hire a professional.
You're preaching to the choir here. I have a banker, financial planner, portfolio manager, bookkeeper, CPA, tax strategist, and estate planner. And that's just off the top of my head.
Go for simple investments. Nobody says you have to invest in complex things. Have a certain amount of operational overhead in a checking account, some more reserve overhead in a high interest savings and/or CD, and the rest in an index fund. No, you aren't going to make the massive returns that some of the creative schemes out there can. However the tradeoff is that it will be extremely easy to manage yourself.
This strategy fails in several ways.
There is no honor in managing your portfolio yourself if you are going to do a terrible job at it. There are people out there who are as good at managing portfolios as you are at whatever your job is. They are worth what they cost.
To me it sounds like he just kinda got lazy. Not a lot of sympathy in that case, especially since he should have known better.
My guess is his bookkeeper dropped the ball here. I mean, what bookkeeper sees $300,000 in ACH debits from Dell and doesn't even ask the boss if any of that should be reported to his CPA as a deductible expense? I get 100 such calls each year from my bookkeeper--she manages books with an iron fist.
For my purposes, I'd rather not have to deal with complex investments and complex statements, but that's what it takes to ensure that my family's financial picture remains strong.