Too Easy For Bank Accounts To Spring a Leak

The NYTimes has a cautionary tale of automated clearing house fraud. Parties unknown siphoned money from an individual's bank account. Nothing too unusual there, except that it was an elite private banking account at JPMorgan Chase, and the account holder is out $250K — the bank will only cover $50K of his loss. The $300K came out of the account in small transactions over 15 months. The bank offered no recourse except to open a new account, a large hassle given that the account is more than 20 years old and its holder writes a thousand checks a month. The article details how the spread of electronic settlements between banks has given rise to growing automated clearing house fraud — if anyone gets hold of the magic combination of account number and bank routing number, and once has permission to withdraw funds, all bets are off. Banks are unlikely to question future withdrawal orders. Moral of the story: go over your bank statements line-by-line every month, and question anything that looks funny.

Comments

Well... Why?

[Creepy Crawler]

Why are not banks responsible for fraud?

Is it not the bank's responsibility to maintain security and keep secure transactions?

Then... Why the limitation of 50k$ when FDIC covers 100$k ?

Re:Well... Why?

[larry bagina]

The FDIC $100,000 coverage is in case the bank goes bankrupt (or hits financial trouble).

Re:Well... Why?

[Creepy Crawler]

Next time, try reading the article.

Or for critical reading, read the cut-n-paste

And a retail bank statement is kindergarten arithmetic compared with the monthly statement for a private banking client. Indeed, Mr. Wyser-Pratte said that the statements have become so complicated not even a Wall Street veteran like himself could detect the continuing theft.

"I kept complaining that the bank's records showed I was overdrawn when I shouldn't be," he said. Each time, he was assured that the statement was accurate, even if he could not decipher it.

That second paragraph cues me in that he DID complain, and was given a runaround and no real answers.

Re:Well... Why?

[Free the Cowards]

He really just complained that he couldn't balance his checkbook, though. If the difference was so large, he should have tracked it down line by line until the discrepancy was resolved, or fraud discovered.

And I don't understand how a statement can be "complicated". For each transaction, there is a line. There is an amount, and a name of some kind that tells you what it was for. You compare this with your records. If you have a match, then you're good, move to the next one. If nothing in your records matches that line, then you have an error, red alert, call your bank and tell them you've found an important mistake or fraud.

Sounds to me like he found a discrepancy but never went through the work of tracking it down. And as a result this theft went undetected for far too long.

Re:Well... Why?

[EvilIdler]

If you have that much money, eight hours per month to keep it seems reasonable.

Re:Well... Why?

[Belial6]

If he writes that many checks a month, the cost of hiring someone to go line by line through the statement would be trivial.

Re:Well... Why?

[lysergic.acid]

that's easy to say when you're not writing a thousand checks a month.

and the fact of the matter is, he didn't issue or authorize the account transfers that he's being charged for. so why should he have to pay for fraud? is there a clause in his banking contract that says "the bank is allowed to give away your money without your consent as long as we list the transactions in your monthly statement?"

Re:Well... Why?

[mangastudent]

I do not believe he's telling the truth, and if he really is that stupid, and e.g. totally unable to hire a CPA for a few days of low impact forensic accounting, he deserves exactly what he got.

My parents are millionaires. They also did a lot of bookkeeping to get there (I can remember a number of nights when they were looking for the wrong transaction(s) that caused a balance mismatch). Nowadays they're retired and still check all their statements each month and reconcile those against their records.

I repeat: being rich does not absolve you of the duty to balance your checkbook.

Re:Well... Why?

[Free the Cowards]

Not quite. It's more that any transaction which is printed in your statement and which is not challenged by you within a certain period of time (typically two months) is considered to be authorized.

If your financials are so complex that you are unable to audit them for evidence of fraud then you need to hire professional help.

Re:Well... Why?

[Free the Cowards]

Banks are responsible for fraudulent transactions if you tell them about it in a timely fashion. Banks don't and can't know whether every single transaction is legitimate or not. There's simply no way for them to do so. For example, what if somebody alters one of your checks, for example, to read an amount greater than what you wrote? Assuming a good alteration, there's no way they could know that this is not the amount of money that you intended.

Even in the case of more obvious fraud, it should be clear that there needs to be some kind of time horizon. What if I'm the victim of ACH fraud as this person was, but I don't tell the bank about it until five years after the fact? It's way too late for the bank to do anything about it by then. And in fact this would leave the bank open to different types of fraud. For example, you arrange for a friend to "defraud" your account by some amount, split the money between you, then have your friend seal himself off from the offending account over the intervening years. Then five years later you make a complaint and get your money "back", resulting in a healthy profit for the both of you with little risk.

If we're on the same page about it so far, the question is what that time horizon should be. Well, big daddy government has already answered that for us: that time horizon is 60 days. That's why this guy is still getting $50,000 back from his bank, because that's the amount that was stolen within the past 60 days.

If this guy had noticed the fraudulent transactions in a timely manner then I would agree that we shouldn't blame him at all for failings of the system. But he managed to miss twenty thousand dollars a month leaving his account for well over a year before he figured out that he was being ripped off. He discovered trouble earlier but apparently decided that it was too inconvenient to follow up on. When asked about the discrepancy, the bank told him that their statements were accurate. What was absolutely true! Their statements included an enormous amount of theft that his records did not. But for some reason he didn't pursue these persistent discrepancies, and he is now paying the price for that decision.

Magic numbers on every check....

[mangastudent]

if anyone gets hold of the magic combination of account number and bank routing number

Ummm, you do realize that's on the bottom of every check that you write (in MICR). That's how your check gets matched up to your account for processing....

Indeed.

[xstonedogx]

A bank account is a loan to the bank in exchange for money or services. If the bank is defrauded out of some money, why is it the account holder who loses out?

If someone claims to be my bank and tricks me into giving them $200, can I deduct that amount from my next car payment?

Really think about what has happened here. Person A loans Person B $100. Person C tells Person B that Person A owes them $100, so if Person B pays Person C $100 everyone will be square. Person B obliges not realizing Person C is lying. Is Person A the one out $100?! He had no control over the actions of Person C or Person B!

Re:Indeed.

[mysidia]

Yes, but in this case Person B tells Person A about the transfer to person C, in the form of a printed statement.

Person A acknowledges the correctness of the written statement by failing to report an error after Person A has examined it.

The banking laws give Person A a legal obligation to take due care in examining the statement within 30 days. If there was an unauthorized ACH transaction, it may be reported within 60 days time, which is ample opportunity for Person A to rectify the situation.

In this case the fraud was over 15 months, right? So there would have been a good number of statements with transactions on it that Person A did not authorize.

Checks suck

[ed.markovich]

We just had a story on automatic bill pay where I voiced my support for credit cards over writing checks. This story supports that:

First, if someone defrauds your credit card, you're not liable. Dispute the charge and you're done, the onus is then on the merchant to prove the validity of the transaction. With cash accounts, once the money is gone, it's gone.

Second, checking accounts are difficult to reconcile as can be seen from the linked story. The person in question despite being financially sophisticated, was not able to be SURE about what his balance should be. Because the checks settle out of your account at the timing discretion of the recipient of the funds, it's not possible to say what your balance on any given day should be, which makes it hard to spot problems as they occur.

While the Guy (hah) in the article probably cannot avoid writing many checks due to his business, the fewer checks an individual writes the easier it is to keep track of one's balances. As long as you have the discipline to not abuse your credit card, it's the way to go.

-Ed

Re:It's easier than that.

[Free the Cowards]

There's a big difference between "your records don't agree with mine" and "this transaction, right there, was not authorized by me and does not appear in any of my records". This fellow did the former but apparently never got as far as the latter.

Sounds like Credit Suisse

[Animats]

And a retail bank statement is kindergarten arithmetic compared with the monthly statement for a private banking client.

I used to have a Credit Suisse account, and they did, indeed, have incomprehensible statements, even for a simple situation. They had a "current account" and a "time account". The current account didn't pay interest, but the "time account" did. Interest from the time account went into the current account, and when it exceeded US$1000, it was moved to the time account in multiples of $1000. Separate statements were provided for each account, on different schedules, didn't mention what was happening in the other account, and were difficult to match up. Lots of weird fees, too, including charging commissions on their own time deposits. It all seemed to be about fee maximization.

And this was without doing much in the way of transactions on the account. If you did lots of transactions against accounts like that, it would be really tough to track what was happening. The combination of inter-account transactions and differing statement cycles confuses the issue.

Retail vs. Private banking

[Slashdot Parent]

And I don't understand how a statement can be "complicated". For each transaction, there is a line. There is an amount, and a name of some kind that tells you what it was for.

That is because you are a retail banking customer.

Private banking statements are incredibly complex. I should post one of mine just so you can see. I can see how if you did a lot of transactions (I don't), it would be impossible to have clue #1 what the hell was going on. Truly. And I am an economist.

Personally, I have a manged portfolio at a private bank, but my day-to-day transactions are in a retail bank account for precisely this reason. My banker once asked me why I didn't take advantage of their transactional accounts and I told him because it would make my life too complicated.

The guy in the article, frankly, should have had a bookkeeper, and that bookkeeper should have known what was up.

Re:Retail vs. Private banking

[Slashdot Parent]

Personally I don't even know what the difference is between retail banking and "private" banking, much less what a private banking statement actually looks like.

Wikipedia.

I just don't understand how it can be so complex. I mean, any statement should have a list of transactions, and that transaction should have a date, an amount, and a description. If the transaction is a check then it will list the check number. If it's an ACH transfer, then the description will be something about the nature of the other end. I simply don't see how you can make a list of transactions so complex that it becomes infeasible to check them. If you could provide some enlightenment on this then it would be much appreciated.

No problem. I just pulled out my unopened July statement. The entire statement is structured so that you never get past the first page, if you look at it at all.

To give you an idea of how needlessly complex these statements are, consider this: My portfolio manager manages, for my wife and myself, nothing more than our taxable investments, and one nondeductible IRA for each of us. That's it. So what do you think our statement looks like?

For one thing, it is 40 pages long, and the front page gives your portfolio's total value and change since the previous month (what you really care about, anyway). Oh, did I mention that it's printed in such a way that you need to put it into a binder to even read it. The whole thing just screams, "DO NOT ATTEMPT TO READ ME".

There is a ton of information in there, and it's all in abbreviations and shorthand. It's organized funny, and the actual transactions are difficult to pick out in between all of the dividends and reinvestments. The bottom line is once you are taught how to read the thing, you can understand it if you want to, but ... let's face it... if I really wanted to be on top of these things, I wouldn't be paying someone to do it for me.

I actually do, at one point or another, read all of our statements and make sure there isn't anything grossly wrong with them. But I can't imagine just how long our statement would be if we used the private bank for our transactional accounts. They want us to, of course, but it will never happen.

The real moron in the story is the guy in TFA's bookkeeper (he must have one, because I don't believe that the guy personally writes 1000 checks per month (33 checks per day!)). The bookkeeper should have recognized those unauthorized transactions and handled it. Surely the bookkeeper didn't believe that his employer ordered $300,000.00 worth of Dell laptops via ACH debits out of his personal checking account.

or a professional

[phorm]

... that or just paying somebody monthly to keep track of it all.

Re:or a professional

[zippthorne]

Indeed. Perhaps some kind of company with expertise in financial matters. One with experience in keeping peoples money and valuables safe.

Something like a bank really...

Silly

[Slashdot Parent]

Seriously with a bit of work it shouldn't be hard to keep track of your financials these days, especially with instant access via the Internet.

You've obviously never seen a private banking statement. For fun, I pulled out my July statement. There were 3 actual transactions on it (not dividend/reinvestment), and the statement was 40 pages long.

These statements really scream "DO NOT READ ME". I'm just sayin'. (Yes, I read and understand my statement, but I can fully sympathize with those who cannot. I needed my banker to go through the first one with me page by page just to understand the thing, and I do not consider myself to be an idiotic or financially illiterate person.)