One cent deposit scam - banking

From article:

Scammers apparently generate random routing and account numbers, into which they try to deposit one cent ... Once the one-cent deposit clears, the perpetrators know the account is active and begin to withdraw funds from the account.

... Because the transfers clear electronically, people are not asked to verify the transactions. However, they may dispute the transactions once they notice what's happening.

"For Automated Clearing House or ACH transactions, the customer can fill out a dispute form, and we can reverse the transaction," ...

http://www.af.mil/news/story.asp?id=123049572


Better watch those bank accounts closely!

Routing numbers of banks are public...

I'm not sure how smart a scam this is... the cops/banks will be able to see the account the money got ACH'ed into as well. Seems like an easy money trail to follow.

I don't get it. If all it took was a routing number and account number then all a thief would have to do is work in a place that takes a lot of checks.

If they are "randomly generating" both the routing number and checking account they aren't even going to know the name(s) associated with the account that you would know from a check. If it was a trial deposit they wouldn't know the amount.

xerty said: I'm not sure how smart a scam this is... the cops/banks will be able to see the account the money got ACH'ed into as well. Seems like an easy money trail to follow.


1) The crooks are using stolen identities to open bank accounts. They use those accounts to pull the scams.

2) They dupe idiots into doing the dirty work for them. For example, they get a sucker to "accept payments" for their business, in return for a cut of the payment. You would be amazed at how many people fall for scams like this. They think they are processing payments for a legitimate business, and forwarding that money to the legitimate business... until the cops come. You may have seen a varation of this on Dateline a few months ago, where scammers were using people to receive and forward goods that were purchased with stolen credit cards. Same idea, but with money.

ScootyPuffSr said: I don't get it. If all it took was a routing number and account number then all a thief would have to do is work in a place that takes a lot of checks.

If they are "randomly generating" both the routing number and checking account they aren't even going to know the name(s) associated with the account that you would know from a check.I don't think the thieves need to know the name of the account owner. In the course of a routine ACH transfer, I don't think the account owner's names are validated in order for a successful transaction to occur.

For example, if I went to my credit card or cable or utility company's web site to make a payment from a checking account, and I accidentally or deliberately typed in a stranger's valid account number, I have a feeling it would go through.

I'm no expert on this matter, but I've often thought about this subject and based on what I've read and observed, I am inclined to believe that the ACH system is very insecure and is protected only by the vigilance of account owners to catch and report fraudulent transactions.

Anyone wanna test my theory and try to pay their credit card or utility bill from a a stranger's valid routing and account number?

OK, I'll leave some change in my soon to be empty HSBC Direct account after I transfer the rest to FNBO. I'll give you the routing+account number and you can pay one of your bills. I bet it will work

At least in some cases, the name is validated. I tried to ACH money from a TDAmeritrade account into a friend's account, and it rejected it.

It may not be true for all cases. My son has a paypal account, and recently I started using it for kiva. I was able to link my bank account and Paypal.

I wish there were more scammers doing this. I'd be a millionare!! if a few hundred thousand people deposited a penny that is

It may not be true for all cases. My son has a paypal account, and recently I started using it for kiva. I was able to link my bank account and Paypal.

I think that is an example of Paypal's lax security practices.

I suspect many CC companies have similar treatment, they might not even do the trial deposits verification, I suspect security is sacrificed for "customer convenience".

The problem is there's no guarantee of uniformity -- you might find one CC company verifies the account name is the same, and the next one across the street just processes the transaction, no questions asked, after receiving routing, accounting number, and dollar amount.


Some online banks/brokers will require approval of the link, even manual approval, or confirmation of the information with your bank matching the name of your account, before establishing the external account link, others will establish it automatically just based on your ability to view trial-deposits.


There is also the matter of whether the drawee bank or the bank initiating the transfer does any manual verification, and what information exactly is provided.


I suspect most likely if the dollar value is large, say $50,000, there will be some sort of manual review.

nosatalian said: The whole ACH system is retarded. The concept of an ACH "Pull" doesn't make any sense from a security standpoint. All transfers should be "push" only, and that would eliminate all of these types of attacks.

An ACH pull is merely a check converted into an electronic format, and your signature (either a written signature or an electronic signature) is supposed to be required to execute it, just as is required of a check.


If you extended this philosophy to written checks, the recipient of your check could not go to your bank and get cash, they would go to your bank and submitting the check would be submitting a "request"; they would then have to wait for your bank to deposit the funds into an account in their name from which they could withdraw cash.

It would be more secure, in the sense that withdraws without additional confirmation from you would be impossible, but people would be inclined to not accept bank accoutn information as payment, as they could not be assured of getting the money from your electronic check, if your signature wasn't sufficient to make the amount payable by your bank.

I suspect most you do business with would start demanding you pay by cash or debit card, and refuse ACH transfers if you providing the information only allowed a "request" for funds, eliminating much of the usefulness of EFT.

That's why it's the banks taking on the liability by not verifying the pre-authorized transfer forms. They probablyh consider it a cost of doing business until it becomes bad enough to make some changes.

Let's use some logic people. You guys aren't stupid.

OK, so they can sit there and randomly generate account numbers.

Or, they can go get a retail job (not hard to do) and copy down tons of 100% guaranteed first try legit account numbers, every single day.

Your information is thrown out into the world every time you write a check. Every time. I wouldn't worry about someone randomly generating it and that being more of a threat.

We recently had a credit card problem. Two one cent purchases were made (as it turned out, from Germany...)

The following day, two purchases were made at an online florist in a state about 600 miles away from us--purchases totaled $750.

Luckily it was resolved in a few days--we got a new credit card #, the charges were removed. The florist said they had caught it as fraud and never processed the orders.

Then, of course, we wondered how they got the info. But at a business conference last week, my hubby learned that 100,000 of this particular bank's cards had been compromised, so obviously the leak came through the bank.

But yes, we all need to check our accounts regularly.

Many banks allow only ACH push and block the pulls.

HSBC Business Checking allows unlimited ACH Push and does not ask for anything other than the account number and routing number. They charge 25c per transfer, IIRC.

Usually you are required to confirm two small deposits before enabling ACH pulls - that's because anyone to whom you gave your check has your account number and routing number. Sometimes that account number on your check does not correspond to the internal account number that is used for ACH. At least one credit union where I have an account is set up this way. Unfortunately, their internal account numbers are based on SS#.

Names of the account holders typically are not required. They are checked occasionally. I had my HSBC Bank-to-Bank transfer suspended when I linked an account that was joint with my wife (and her name appeared first). I had other similar accounts linked without any problems though - even a business account at BofA.

Kanosh said: xerty said: I'm not sure how smart a scam this is... the cops/banks will be able to see the account the money got ACH'ed into as well. Seems like an easy money trail to follow.

I agree. However I also think we're just seeing the start of it. I think the only solution is to be vigilant with your bank account, checking the balance every day.

So, the average fatwalleter should check her/his 10+ accounts everyday?

kingfrugal said: It may not be true for all cases. My son has a paypal account, and recently I started using it for kiva. I was able to link my bank account and Paypal.
In the case of PayPal, they send 2 verification deposits. Therefore, one needs to have access to the bank account to know the exact deposited amounts. However, most credit card issuers' online bill payment system only requires routing and account numbers. I haven't encountered any problem using my checking account to pay my brother's BofA and Chase credit cards; even with large balance (over 10K).

J.Mok

I suspect there will eventually be some kind of pin or code required to initiate ach transactions in the future.

Yeah, this seems a really easy scam, since it's just too easy for them to obtain routine numbers, account numbers and names from checks. I really doubt the "randomly generating" is necessary or what really happened.

But is it really that easy, when they have those information? If it is, then I think I'm just too lucky it hasn't happened to me by now. Can someone clarify how an ACH pull is done?

Jaydeedub said: So, the average fatwalleter should check her/his 10+ accounts everyday?

Look in threads for Yodlee, you can check all of your account activities at a glance. Although having all your information in one spot is also a security risk.9102128882300897809