Slashdot Mirror
Small Bank In Kansas Creates the Bank Account of the Future
HughPickens.com writes Nathaniel Popper writes at the NYT that the Citizens Bank of Weir, Kansas, or CBW, has been taken apart and rebuilt, from its fiber optic cables up, so it can offer services not available at even the nation's largest bank. In the United States the primary option that consumers have to transfer money is still the ACH payment. Requests for ACH transfers are collected by banks and submitted in batches, once a day, and the banks receiving the transfers also process the payments once a day, leading to long waits. ACH technology was created in the 1970s and has not changed significantly since. The clunky system, which takes at least a day to deliver money, has become so deeply embedded in the banking industry that it has been hard to replace. CBW went to work on the problem by using the debit card networks that power ATM cash dispensers. Ramamurthi's team engineered a system so that a business could collect a customer's debit card number and use it to make an instant payment directly into the customer's account — or into the account of a customer of almost any other bank in the country. The key to CBW's system is real-time, payment transaction risk-scoring — software that can judge the risk involved in any transaction in real time by looking at 20 to 40 factors, including a customers' transaction history and I.P., address where the transaction originated. It was this system that Elizabeth McQuerry, the former Fed official, praised as the "biggest idea" at a recent bank conference. "Today's banks offer the equivalent of 300-year-old paper ledgers converted to an electronic form — a digital skin on an antiquated transaction process," says Suresh Ramamurthi. "We'll now be one of the first banks in the world to offer customers a reliable, compliant, safe and secure way to instantly send and receive money internationally."
This is the same tech refresh upgrade every big bank is in flight doing.
Old age and treachery almost always overcome youth and skill.
Except that Interac has been doing realtime debit transactions for many years, across all Canadian banks, both at point of sale and at ATMs. It's good news if the US is moving in this direction, because it is an excellent system, but it would be a stretch to call it the bank account of the future when it has existed for years.
The UK has Faster Payments processing across all its national banks, which allow instant payments between bank accounts. Maybe the US is married to a daily batch processing paradigm but CBW is most certainly not the first bank in the world to move away from it.
But that's the national part. There is also a claim about instant international payments at the end, but this is done via Ripple.com which uses an internal pseudo-currency for operations, and is comparble enough to similar Bitcoin-based systems that maybe there's some "News for Nerds" here, but Pickens completely fails to mention this part at all, instead putting the glory onto a bank that uses Ripple.com.
Overall, some very confused reporting; in future Mr Pickens might want to read all the links he's posted and then summarize them for the audience. C minus.
I live in Chile and we have free instantaneous wiretransfers which are required by law to be protected by 2 factor auth, Banks still make boatloads of money, not sure how the US can still be in the dark ages in this regard.
So is using the IP address the banking equivalent of the SketchFactor app? You just happen to have an ISP whose pool of addresses contains a bunch of scammers. Will this banking software decide that you too are also a scammer? What are the other "risk" factors? ACH made no judgements on the transaction.
Hopefully they have some kind of one-time/vendor-specific account number rather than the actual account! Risk-based assessments are nothing new; hopefully knowing what the factors/algorithms are doesn't kill the effectiveness.
You can sometimes spoof your IP address and when lucky have your ISP router forward them, but don't expect to get a reply. I presume making a transaction isn't going to work the one-packet fire-and-forget way.
CLI paste? paste.pr0.tips!
>> business could collect a...card number and use it to make an instant payment...real-time, payment transaction risk-scoring
Congratulations you've invented the credit card!
This sounds like it's till a bit hacked together (risk scoring?), and only available for business transactions, but it's a step in the right direction. Another ten or twenty years and you might be enjoying something like Europe and Australia's transfer system, or Canada's debit system.
The banks love float. That's why they had to be bludgeoned into shorter float times.
Personal users, not so much. When I transfer money, I'm usually counting on the money to go where it needs to be ASAP rather than gumming up my accounts. If I wanted "float", I'd simply delay when I did the transfer.
I learned all my skills from "Sneakers".
There are two types of people in the world: Those who crave closure
...But my new computer has a 28.8k modem and an active matrix display!
Disclaimer: I used to write banking software for a living, including implementing ACH management on both the customer-facing and backend processing systems.
The article is blatently misleading regarding realtime transfer of funds, but it takes some knowledge to understand why. Let's talk about ACH transactions.
ACH, or Atomated Clearing House, is the network that the majority of electronic funds in the US use. As the article points out, it's ancient and horrible, basically a 1:1 translation of the paper funds reconciliation to electronic format. In essence, a customer creates an ACH transaction, which is sent to two endpoints; the federal reserve a.k.a. The Fed, and an ACH operator. Just like a credit processor, the ACH operator is then responsible for delivering the funds to the destination financial institution (FI) and they make their money by charging the originating FI. The transfer only goes through once both The Fed and the operator finalize the transaction, which can take a day or more, and most of them are held for additional days to provide for reversals (effectively, cancellations).
Here's some important takeaways:
- To perform bank-to-bank transfers, you must either engage a third-party processor, or you must have an agreement (and process) with each individual bank you wish to transfer to.
- These transfers are subject to some very specific banking regulations, some of it relating to reporting to the Fed, who can block the transactions.
- Laws provide for effective reversal (issuing a reciprocal transaction, not necessarily a reversal) for 2 days for corp-to-corp transaction (CCD) and up to 60 days for transactions involving people (PPD).
- Just like most retailers, these are batch processed, not in real time, though the banks will reserve funds and adjust your balance accordingly. No one minds because legal protections result in at least a 2-day processing window anyway.
Okay, so what do we need to perform this transfer in realtime? Well, first, you'd have to get every bank in the US and the federal reserve to switch to a new system that actually supports real time transfers, instead of the ACH. Then we'd have to completely overhaul the 40+ years of recent laws that were written with a batch-based system in mind, including removing many of the funds reservations activities (and the legal protections that require them) in favor of a realtime system.
So how does this bank do it?
Based on the info from the article, it sounds like the bank is managing two accounts per individual account; the customer-facing one which serves the 'realtime' aspect, and the actual one that is used for the ACH transaction. The risk comes in when the bank accepts a credit or debit prior to it being authorized and completed, and thus the need for 'risk management' software, identical to the sort that ATMs use, especially when configured as a local authorizer (for branches too far from the main branch and others).
They just don't show the end user the reservation of funds like most FIs, and they assume the risk directly so there's no odd 'processing' credits or debits in their statement.
So, it's just smoke and mirrors. They have to use ACH if they want to talk to other banks, and they're not doing manual wire transfers. They just aren't telling their customers. Though if they hit the anti-terrorist check (I wrote the software that matches against the government list too, at one time), their customer is going to find out really quickly that it's really just an ACH after all, and they ~don't~ have those funds - it's illegal for the bank to provide them!
Welcome to the 20th Century. Oops, we're not there any more!
I deliberately wasted several hours of my bank manager's time once. When he sussed what I was doing, he asked why. Because it had taken four days for a cheque to clear - a cheque I had received every month from the exact same employer, for many years, and paid in immediately using their fast-track cheque machines that take a photo of the cheque for you, then wrap it in an envelope and send it on.
And because of the delay, for a fraction of a second, my bank account went overdrawn by a few pounds even though the cheque was in the bank's possession. They delayed and delayed it, further than necessary or normal, in order to ENSURE I was charged for going overdrawn. The cheque was an amount enough to clear the transaction they bounced several hundred times over. They then charged me £50 on top as an administration fee.
I'm an IT guy. I know that transaction takes milliseconds to process. The fraud selection? That's in place 24 hours a day on CC transactions anyway - there's nothing special about that. This is just an extension.
The antiquated system of "it has to arrive at the other branch for the cheque to clear"? Nonsense and zero justification when you have the cheque in your possession. This stuff is chicken feed on the bottom of the banking balance sheets, but they can play it and make money by making it slow and cumbersome. Because most people will just keep quiet and pay it.
The only question I really wanted an answer to? Has four hours of your time cost the bank more or less than the (unfair, I would posit) overdraft fee you charged? What about the loss of my banking business? How much has that cost you?
Happened to run into the same guy at another branch when I was going in with my ex-wife to sort out her account. He ran a mile.
Sorry, guys, you can make all the excuses you want, but that transaction system is slow BECAUSE YOU MAKE IT SO, not because it needs to do. The real-time clearing is already in place - try using a blocked credit card and see how long the gap is between you reporting it missing and all your vendors saying they couldn't charge you card for your usual monthly payments. The same applies to Direct Debits (in the UK) and myriad other banking technologies.
I once recorded a 3 minute interval between my phoning my bank to cancel a Direct Debit and the company that it was paying phoning me up to threaten a lawsuit over non-payment (long story short, they "agreed to overlook the matter", including the complete refund they'd had forcibly taken from their bank account, after I offered to initiate the lawsuit for them).
It's all nonsense. Banking systems do nothing special nowadays, especially not the personal / small business banking sector of the industry. They don't need tons of supercomputers and overnight batch processing - they just do that to eke out to the last second how long your money is with them.
> and as a last step, they give the money to Bob (or his account) and I don't think either that for that it is neccessary or even helping, to check Bobs credit score or IP address. He is going to RECEIVE money.
Remember we're trying to fight real-world fraud, where people do dumb things, malware exists, etc. There is a request to empty Alice's bank account and send all her money to Bob. We happen to know that Bob is a Nigerian prince. What are the odds that this transaction is fraudulent?
The next day, April 15th, there is a request to send $1,200 from Alice to the IRS. What is the probability that this transaction is unauthorized?
The likelihood that the recipient is a scammer is not just relevant, it's the crux of the issue. Even if Alice uses ten factor authentication, if "she" is sending money from her US account to a check-cashing store in Nigeria which is known for fraud , she's probably getting scammed. She might have even authorized the payment, but it's still fraud.
I've often wondered how it is that banks get away with plastering account numbers on every check or who in their right mind would want a credit card tied directly to their bank account.
Slowness of international transactions is a feature affording banks an excuse to sit on the money day(s), collect interest and then charge exorbitant wire fees on top. Who knows it might also give them some time to review transactions but I doubt it.
The fundamental security problem with many electronic systems is they operate more like credit cards and less like paypal. Until the equation is changed such that only operation possible is "giving" rather than "taking" fraud detection algorithms don't have a prayer in hell and any "progress" is limited to deck chairs of the Costa Concordia.
For this exact type of thing, check out Dwolla. Paypal-style transactions (unique id is your email, but that's where the similarities end). It's run by a REAL bank (Veridian Credit Union, that's been around since 1934), and they do bank to bank transactions for 25 cents.
Disclaimer: I'm not in any way affiliated with Dwolla and don't gain anything by this post! Actually, as a business owner who accepts Dwolla payments, it would be nice to see this thing grow and become a standard thing people have to make it easier for everyone to pay each other, including me! :)
The goal of computer science is to build something that will last at least until we've finished building it.
I learned from WarGames... Noob!
Peter predicted that you would "deliberately forget" creation 2000 years ago...
... I apologize for my somewhat undiplomatic language, but the current wire payment system is a cluster-fuck of fail.
My company is based in Canada and accepts wire payments from Canada, the US, Europe, Australia, South Africa and the Middle East. Half the time, we see mysterious deposits appearing in our account without any useful identification. We ask our customers to specify invoice numbers when they make a payment. Sometimes that comes through. Mostly it does not. Sometimes we don't even get any indication as to who the money is from.
So then we need to phone our bank and they take days to track down who just paid us. It's a total nightmare.
I'd welcome wholeheartedly anything that can improve the situation.