Slashdot Mirror
FTC Kills Dirty Online Check Processing Outfit
coondoggie writes "The Federal Trade Commission today got a US District Court to stop permanently what it called the illegal operations of an Internet-based check creation and delivery service, and to require the group to give up over half a million dollars in ill-gotten gains. According to the FTC, Qchex.com created and sent checks drawn on any bank account that a Qchex user identified, but did not verify whether the user had authority to draw checks on that account. As a result, fraudsters worldwide used the Qchex service to draw thousands of checks on bank accounts that belonged to unwitting third parties. 'The evidence shows that the launch of Qchex.com was a "dinner bell" for fraudsters and resulted in a high number of accounts frozen for fraud...' said District Court Judge Janis Sammartino."
Checks are insecure. The lesson: withdrawing money from people's account should require more than an account and bank routing number.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
I just found this 2005 MSNBC article that talks about Qchex.com (the company mentioned in the above), and check security.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
I want whatever those guys were smoking when they thought this was fraud-proof.
If you can read this, it means that I bothered to log in.
The real problem is the ACH system? It relies almost exclusively on blind trust. Trusting that whomever I'm debiting authorized me to debit them, etc. It always amazes me when I build an ACH file to send to the bank as part of my business and send it through without a hint of a question from the bank or the processor. They just merrily send the file on through. I guess the bank and processor are counting on me being a good citizen. Hmmm...
I'd happily pay you Tuesday for a biopsy today!
At my previous company, we got frequent emails from qchex/neovi.com sent to an email address that must have been scraped from a website -- no-one used it as their personal address, so there was no legitimate reason for the to be sending to that address.
The real "Libtards" are the Libertarians!
Man, and I just NOW hear about this!
"He who would learn astronomy, and other recondite arts, let him go elsewhere. " -- John Calvin, commenting on Genesis 1
I just read Frank Abagnale's autobiography and another book that he wrote. He was one of the greatest con men who ever lived, cashing two or three million in bad checks in the 1960's, before he even turned 21. Anyway, the last book of his I read was written around 2002 or so, and he was pretty spooked by the idea of people being able to pull money from accounts simply by knowing the routing and account numbers. He designs checks nowadays and does security consulting, among other things.
Do you have ESP?
Who in this day and age takes cheques but wont take other forms of payment? (be it credit cards, cash, paypal or whatever else)
It's comforting to know that my entire savings is up for grabs every time they mail me a checkbook.
and every time you give anyone a check, or cash any check (both transfer the same information.) after all this is not the last way to use a ABA# + account # to clear a bank account. I have in my canceled checks the account number, and bank ABA number for everyone who has cached one of my checks. I think we had a social agreement not to turn over the other guys bank info to a Nigerian scammer and wipe them out. But who knows...
of course there's a logical explanation. Linus took another much older OS called Minix written by a cranky old C.S. prof and changed the M to an L and an i to a u, and then distracted the professor with a meaningless and pointless argument about kernel architecture. Even after the Dr. found out about his former student's shameless plagiarism, he was just mostly relieved to find out that long haired dope smoking hippie Berkeley types would now target Linus' work with their "improvements" instead of "always trying to make my Minix into some kind of faggot BSD".
Linux unsuccessfully tried to compete with Microsoft on the desktop, until the KDE 4.x window manager managed to trump Vista in complexity, distracting eye candy, user confusion, bugginess and bloat.
Personal checks haven't been in use in Finland for 30 years. What we have is a system of personal direct deposits. So instead of authorizing the payee's bank to withdraw funds from your account, you transfer funds from your account to the payee's bank.
Yes, everybody is virtually forced to own a bank account.
I live in Australia and have always wondered about the security of cheques because of the place your bank account number on the cheque as well as a incrementing cheque number. The first thing I would do is make the cheque number pseudo random, so that someone who was able to get an image of a cheque wouldn't be able to create another valid cheque, just by increasing the cheque number. Even the account number could be a random number... which points to a record at the bank which determines which account the money has to come from. I think these changes could probably be implemented individually by a bank as well...ie. it wouldn't need other banks to know what is going on.
Heck, you can actually buy a check printer yourself which can even use the same magnetic ink that bank-issued checks use. Nothing illegal in that.
Never email donotemail@WeAreSpammers.com
This is just like the federal government - get rid of one of the symptoms instead of the actual problem.
if you have a better way worked out, let me know. thanks.
You just go to your bank and make a bank-to-bank wire transfer.
Actually, all you need is to have the check number, account & routing number hashed with a secret key known only by your bank & check printing company. Have this unique hash (unique to each check number) appear on the bottom of each check, and the bank can refuse to clear it if it doesn't match up, or if a check number is duplicated. You end up with the same paper check everyone is used to, but with a bit more security. The only way fraud can happen is if someone steels your blank checks, or duplicates an uncashed check and changes the amount.
You can go a step further and include a maximum dollar amount with the hash, and have separate checkbooks for small vs. large amounts
Yet you come back again and again.
protip: no all Anonymous Cowards are the same person
Arrgh. Somehow Slashdot logged me out before I posted this, so it got put up under "Anonymous Coward" - but I did have a couple things to add to it.
3% of $500,000 is $15,000, not $150. $500k would pay for a lot of concrete though - a whole lot more than a few metric tons. :-) But the point is well taken - for large transactions that kind of processing charge can be prohibitive.
ACH/wire transfers can sometimes also be expensive to set up, though not nearly as much so as credit cards - perhaps $25 (unless you're a big company and able to negotiate a good deal with the bank), as opposed to checks which are nearly free; plus they have their own security issues (once again you need the bank routing code and the account number, which allows all sorts of mischief).
Business to Business (B2B) transactions are largely based on trust and ignorance: if you don't trust your client/customer, you don't do business with them, or you put them on some kind of "cash-only" basis, including for example things like certified checks (free at many banks if you have a commercial account, but a pain to deal with because of the extra processing); and ignorance because the general public "should" never know either the bank routing codes or bank account numbers for either company.
In the long run some kind of pseudo-encrypted or even certificate-based transaction scheme will probably become necessary if the fraudsters continue to become more sophisticated, but at the moment just about all of the methods for transferring money are vulnerable to relatively unsophisticated attacks.
You mean his belly hangs over his belt as much as Ron Jeremy's does?
The article doesn't say how much the perpetrators netted from this scheme, but it is a pretty safe bet that it is a lot more than the $500k penalty, probably by about an order of magnitude. I did see a comment about "thousands" of checks.
Typical FTC "penalty". Make the crook pay back 10% or so of his take and promise not to do it again.
One additional thing. This can be implemented using the existing system, by an individual bank if they desire. Since the account number begins with a bunch of zeros, the hash (or a fingerprint of it at least) can be stored where those zeros are. So the first 10 digits become the hash fingerprint, and the remaining digits are the actual account number.
LOL, that explains it then