so it was a big chunk of money and i got it back.
Re: watch out
By: MRO to All on Sat Feb 13 2021 03:13 pm
so it was a big chunk of money and i got it back.
It is a good thing they reversed it back for you.
It sucks that you have to go through all the security questions and checks and still get security breaches.
so recently i had someone empty out one of my bank accounts
and send it to robinhood.
I have no clue how they did it. the 2 things i did recently
was put my routing info into cashapp and zelle to send
someone money recently. another thing is i was using an
online password manager.
it was like they were in my bank logged in as me even though
i had security questions and all kinds of shit setup. this
bank fucking blocks it if i even try to pay bills with my
debit card and it got through. it's like the attacker found
some exploit with their system.
so it was a big chunk of money and i got it back.
i wiped my desktop computer and reinstalled the OS. i also
redid all my passwords on a clean system. i'm not using an
online password manager anymore. i dont care what they say
about encryption.
not sure if this was related to the hedgefund attacks, but
i'm glad that i found this out 1 hour before my bank closed
and it's a bank holiday monday. i was able to lock it down
and reverse it.
I suggest everyone watch out and watch closely. turn on all
the alerts for your credit cards and your bank accounts.
CHANGE your login name as well as your password with your
credit cards and bank accounts if you are able to.
It sucks that you have to go through all the security
questions and checks and still get security breaches.
that's because none of that stuff works. it's usually the
other side that gets compromised. -+-
Hello MRO!
** On Saturday 13.02.21 - 15:13, MRO wrote to All:
so recently i had someone empty out one of my bank accounts
and send it to robinhood.
Do you use the Robinhood at all? I never heard of it until it
made mention in the recent news about GameStop stocks.
online password manager.
OK.. so you spread out (or expose) your transfers across a
variety of services. Maybe just stick to one method?
They probably took the routing info (it's just a stupid number)
and managed to hack as middle-man or reverse process out of your
legit accounts. Maybe a change in one bit was all it took to
change from unauthorized to authourized. Truly pathetic -
indeed!
That's exactly what you ought to expect. Even if the hackers
manipulated the systems using your routing info, the only
direction a transfer using the routing info can occur is INTO
your account. I provide routing info to people who want to make
direct payments to me at their convenience and without the
hassle of writing a cheque or using "cards"; they can go to my
bank in person (or any branch) and make a "deposit" to the
account that bears the routing info. Routing info does not
accommodate the reverse - a withdrawal.
i wiped my desktop computer and reinstalled the OS. i also
redid all my passwords on a clean system. i'm not using an
online password manager anymore. i dont care what they say
about encryption.
Good thing. Maybe you had a keylogger inhabiting your system.
I came up with my own "encryption" method for generating
passwords, and I stick to it. I don't need complex software to
do it for me.
not sure if this was related to the hedgefund attacks, but
i'm glad that i found this out 1 hour before my bank closed
and it's a bank holiday monday. i was able to lock it down
and reverse it.
I'm surprised that the bank got anything done within one hour of
closing!
It doesn't work because they probably keep the metadata in the
clear in fancy spreadsheets and databases for easy look-up.
I take credit card purchases over the phone, but I never write
down the numbers - I enter them directly in the POS device while
the person is dictating them. The device never prints out the
whats weird is they tried to setup another bank account in
my credit union account. that's when they were blocked and i
got the notification.
then on the phone i saw the money that was transfered out.
..the systems using your routing info, the only direction a
transfer using the routing info can occur is INTO your
account. ... Routing info does not accommodate the reverse
- a withdrawal.
well they had access to do everything for some reason. i
dont think security will tell me everything. maybe they have
a flaw in their system.
I'm surprised that the bank got anything done within one
hour of closing!
yeah i'm lucky i got someone. good thing there's a waiting
period on these transfers. i'm getting all new everything
with that credit union incase i'm on some list online.
i worked at kmart years ago as a pt job and in their attic they had paper boxes full of green and white fanfold. they had all the transactions printe out with the credit card numbers on there. totally nuts. ---
MRO wrote to All <=-
so recently i had someone empty out one of my bank accounts and send it
to robinhood.
I have no clue how they did it. the 2 things i did recently was put my routing info into cashapp and zelle to send someone money recently. another thing is i was using an online password manager.
it was like they were in my bank logged in as me even though i had security questions and all kinds of shit setup. this bank fucking
blocks it if i even try to pay bills with my debit card and it got through. it's like the attacker found some exploit with their system.
so it was a big chunk of money and i got it back.
i wiped my desktop computer and reinstalled the OS. i also redid all my passwords on a clean system. i'm not using an online password manager anymore. i dont care what they say about encryption.
not sure if this was related to the hedgefund attacks, but i'm glad
that i found this out 1 hour before my bank closed and it's a bank
holiday monday. i was able to lock it down and reverse it.
I suggest everyone watch out and watch closely. turn on all the alerts
for your credit cards and your bank accounts. CHANGE your login name
as well as your password with your credit cards and bank accounts if
you are able to.
i worked at kmart years ago as a pt job and in their attic
they had paper boxes full of green and white fanfold. they
had all the transactions printed out with the credit card
numbers on there. totally nuts. -+-
got the notification.
Were they attempting to set up another account under YOUR name
or was it under another name?
Here in Canada, usually opening an account requires an in-person
visit to a bank. They want a record of your signature and other
ID on file. So, setting up an account electronically would seem
to be a red-flag.
..the systems using your routing info, the only direction a
transfer using the routing info can occur is INTO your
account. ... Routing info does not accommodate the reverse
- a withdrawal.
It sounds like the fraudsters were trying pose as you, to get a
new account (same routing info which merely identifies a
specific bank location and account), establish their own 2FA
that they could control and then deposit money into.
It just astonishes me how seemingly easily bank accounts get
compromised to this day.
no they had the routing info and my bank account info so they can do a wire transfer.
I've heard of social engineering attempts to override 2FA. One
of the Krebs On Security articles described such a scenario in
detail where the fraudster impersonates the account holder and
tries to convince someone at the bank to change things manually.
By: MRO to Ogg on Mon Feb 15 2021 04:37 pm
no they had the routing info and my bank account info so they can do a wire transfer.
It's nuts to me that all you need is the bank acct # and a routing # and you can bleed an account dry with ACH transfers.
Like, what? Why is this a thing? Why don't banks require you to log into your online banking first to approve the transfer out?
I've not had this happen to me, but I would hope that the bank's fraud department would very quickly reverse those transfers for you.
It's nuts to me that all you need is the bank acct # and a routing # and you can bleed an account dry with ACH transfers.
Like, what? Why is this a thing? Why don't banks require you to log into your online banking first to approve the transfer out?
Also, I've noticed many stores in my area don't require a signature for card transactions anymore.
Re: watch out
By: matjam to MRO on Tue Feb 16 2021 09:05 am
It's nuts to me that all you need is the bank acct # and a routing # and you can bleed an account dry with ACH transfers.
Like, what? Why is this a thing? Why don't banks require you to log into your online banking first to approve the transfer out?
Also, I've noticed many stores in my area don't require a signature for card transactions anymore.
Also, I've noticed many stores in my area don't require a
signature for card transactions anymore.
..Once we went EMV and PIN, the need for a signature went away.
Hell... in Europe, I can't remember the last time I signed
a credit card receipt.
i know another person who lost some money. this time they
think she wrote a check even though her checks are locked
away.
I've had a bank account compromised as well. They did it
by calling customer service and pretending to be me. They
knew the answers to my security questions because I had
things like Mothers' Maiden.
Just a tip for everyone: The answer to your security
question should be something insane that isn't actually
data someone can find out about you. Your First Grade
Teacher's name should be something like "ZebraFrankenstein"
and your Favorite Movie is "CoffeeDishwasherTelevision". I
learned that the hard way.
What is annoying about the Customer Service route is there
are no alerts. My bank will send me 16 text messages if
someone logs into my account on the web, or uses my credit
card to buy something. But there is no alert if someone
calls Customer Service and says they are me. Why not? If
there was I would know known there was a problem sooner.
Recently, I was expecting a payment for a special order and the
customer wrote that they could deposit INTO my bank account by suggesting this:
"Set up your direct deposits and pre-authorized payments easily
and conveniently
"Direct Deposit is a fast and easy way to receive your payroll
or other deposits directly into your chequing account. Pre-
authorized Payment is a convenient way to automatically pay your
bills from your chequing account. This form provides account
information in place of a voided cheque and is used when
arranging for direct deposits or pre-authorized payments. Simply
complete this form and submit it to the organization depositing
the payment into your account.
Put yourself in the bank's position for a moment. People DO
change their phone numbers. If the legitimate you called from a
NEW phone, how would the bank know to alert you that you called
them, especially if the old number nolonger existed? <G>
Also, I've noticed many stores in my area don't require a signature
for card transactions anymore.
That was a remnant when all the stores used that impression machine. There was always that statement on credit card receipts about paying, blah blah. Once we went EMV and PIN, the need for a signature went away.
i know another person who lost some money. this time they
think she wrote a check even though her checks are locked
away.
Recently, I was expecting a payment for a special order and the
customer wrote that they could deposit INTO my bank account by
suggesting this:
"Set up your direct deposits and pre-authorized payments easily
and conveniently
"Direct Deposit is a fast and easy way to receive your payroll
or other deposits directly into your chequing account. Pre-
authorized Payment is a convenient way to automatically pay your
bills from your chequing account. This form provides account
information in place of a voided cheque and is used when
arranging for direct deposits or pre-authorized payments. Simply
complete this form and submit it to the organization depositing
the payment into your account.
The rest of the form provides "official" sections where I write
in my bank's transit number and my bank-account number - which
is the same info found in magnetic ink on a cheque.
But I don't like the way the pre-amble is worded. It suggests
that if I comply with providing the info, then they will also
have the authority to take money OUT of my account - much like
how pre-authorized payments get arranged.
signature. The scribble on the paper by the customer doesn't
prove ownership, but it gives me as the vendor the extra
documentation that "someone" used that card and I was the
witness.
What is EMV? Also, the only cards I've had with a PIN are my debit cards. I've never had a PIN for a credit card.
Also, I've noticed many stores in my area don't require a
signature for card transactions anymore.
That was a remnant when all the stores used that
impression machine. There was always that statement on
credit card receipts about paying, blah blah. Once we went
EMV and PIN, the need for a signature went away.
What is EMV? Also, the only cards I've had with a PIN are
my debit cards. I've never had a PIN for a credit card.
But I don't like the way the pre-amble is worded. It
suggests that if I comply with providing the info, then they
will also have the authority to take money OUT of my account
- much like how pre-authorized payments get arranged.
yeah if you have direct deposit they can TAKE as well as
give. there's a place that was going out of business that
did a direct deposit to employee's bank accounts and then
took it back.
some banks and credit unions found out about it and blocked
it from happening.
since you signed that paper you authorized it so you it's
your word vs theirs. i wouldnt trust it.
Put yourself in the bank's position for a moment. People
DO change their phone numbers. If the legitimate you
called from a NEW phone, how would the bank know to alert
you that you called them, especially if the old number
nolonger existed? <G>
The alert wouldn't be conditional. It would simply send me
a text message everytime someone called Customer Service
and "authenticated" as me. Just ike the alerts they send
when I use my credit card, or perform a funds transfer.
The text message would be sent to the number they have on
file, just like the existing alerts they have. Some banks
use push notifications via their Apps. Whatever works.
..This form provides account information in place of a
voided cheque and is used when arranging for direct
deposits or pre-authorized payments. Simply complete this
form and submit it to the organization depositing the
payment into your account.
That more or less is the wording I've seen on most direct
deposit forms payroll checks, which does authorize the
reverse as well.
Needless to say, the following Monday, corporate accounting
was trying to reverse that payment, but my wife beat them to
it.
But as we were working on a repayment schedule for around
$3500, Going over all of the documents, it's pretty clear
the direct deposit forms allow the reverse to happen.
If you expect to get a text message for every authentication
attempt, the clerk/person on the other end would need to
activate a "send text alert" button or something. That extra
technology probably doesn't even exist on their systems.
Barmed wrote to Ogg <=-
My next check was repayment for an entire month, not just what Ivwas
owed. Needless to say, the following Monday, corporate accounting was trying to reverse that payment, but my wife beat them to it.
MRO wrote to Ogg <=-
yeah if you have direct deposit they can TAKE as well as give.
there's a place that was going out of business that did a direct
deposit to employee's bank accounts and then took it back. some banks
and credit unions found out about it and blocked it from happening.
Dream Master wrote to Ogg <=-
Some years ago my daughters were selling Girl Scout cookies. We had a credit card reader on our phones and we had a customer swipe and sign.
He disputed the transaction and I had to eat the cost. EVEN AFTER SIGNING!!!
Ogg wrote to Barmed <=-
What many people may not realize is that they also have the
power to re-word those things (crossing out what doesn't apply),
initial it (ideally initialled by the initiator as well) and the
modified doc is the new doc.
the system may already be coded to send these alerts without
any intervention or knowledge of the clerk... the simple act
of them accessing the account could trigger it... think
about it ;)
The PIN method or the contactless method (ApplePay, PayPass) in
Canada has basically done away with requiring signatures too.
But the POS will sometimes spewout a receipt requesting for a
signature. The scribble on the paper by the customer doesn't
prove ownership, but it gives me as the vendor the extra
documentation that "someone" used that card and I was the
witness.
Some years ago my daughters were selling Girl Scout cookies. We had a credi card reader on our phones and we had a customer swipe and sign. He disputed the transaction and I had to eat the cost. EVEN AFTER SIGNING!!!
The last time I walked into my bank, all 4 tellers looked busy
behind their shields and masks - but no one else was around.
They seemed to be clicking frantically with their mice. I
imagined they were playing games? They didn't have any other
paperwork in front of them.
no they had the routing info and my bank account info so
they can do a wire transfer.
It's nuts to me that all you need is the bank acct # and a
routing # and you can bleed an account dry with ACH
transfers.
Like, what? Why is this a thing? Why don't banks require you
to log into your online banking first to approve the
transfer out?
I've not had this happen to me, but I would hope that the
bank's fraud department would very quickly reverse those
transfers for you.
yeah if you have direct deposit they can TAKE as well as
give. there's a place that was going out of business that
did a direct deposit to employee's bank accounts and then
took it back.
That's playing dirty. Shame on that biz.
By: Ogg to Dream Master on Wed Feb 17 2021 19:59:00
The PIN method or the contactless method (ApplePay, PayPass)
in Canada has basically done away with requiring signatures
too. But the POS will sometimes spewout a receipt requesting
for a signature. The scribble on the paper by the customer
doesn't prove ownership, but it gives me as the vendor the
extra documentation that "someone" used that card and I was
the witness.
Isn't the signature practice normally carried out
depending on the store's SOP primarily based on the
amount of the transaction? That's how it was at least a
few years ago here when I last worked at a place where I
had to deal with customers and transactions (in the US).
Did you add them to the NATIONAL GIRL SCOUT DO NOT SELL LIST?
Imagine if they went to buy cookies the following year from someone else and were declined.
Dream Master wrote to poindexter FORTRAN <=-
I was using PayPal's Credit Card solution and it bit me in the ass. I switched back to Square and never had a problem afterwards.
PayPal bit me when I had an eBay auction go sour. I shipped a working camera. The buyer didn't pay for insurance and sent the payment to an address of mine that PayPal wasn't linked to (and wasn't on the auction). So, he was pissed for the delay and threatening to sue.
PayPal bit me when I had an eBay auction go sour. I shipped
a working camera. The buyer didn't pay for insurance and
sent the payment to an address of mine that PayPal wasn't
linked to (and wasn't on the auction). So, he was pissed
for the delay and threatening to sue.
Camera arrived, he opened it up, tested it, and found it to
be DOA (or broke it himself). Then instead of contacting
me, contacted UPS and told them that he hadn't ordered it.
UPS charged me for return shipping and PayPal deducted the
price of the camera and double-shipping. After an
exhaustive investigation, they ruled for the buyer, and
took weeks to refund me the second shipping charge.
...We had one buyer who purchased the a game, paid via
PayPal, and we sent her the game. She signed for it, which
was captured via USPS, but informed PayPal that she never
received it. PayPal refused to acknowledge the signature.
I was out $40.
I was pissed.
No kidding. But how could anyone ignore the fact that the
product was delivered and signed for?
Some years ago when my children were younger, my wife found a great deal on LeapFrog games at Toys R Us. She purchased about 10 or 12 of each game and went onto eBay and listed them for their MSRP. We had one buyer who purchased the a game, paid via PayPal, and we sent her the game. She signed for it, which was captured via USPS, but informed PayPal that she never received it. PayPal refused to acknowledge the signature. I was out $40.
I was pissed.
With employment agreements, as well. I had a friend who'd redline
anything he didn't want in there, and asked to speak to corporate counsel when someone told him it wasn't allowed.
So if the real you called from a new phone, then the alert can
go to the now non-existant (previous/old) phone number and
therefore wouldn't matter? OK.
But techincally, how could the actual phone alert be tied into
the phone system? I can see how such an alert can work when
visiting websites, detecting failed logins, and getting alerts.
But I don't think there even exists a way to alert you if
someone just happened to call the bank and mention your name.
If you expect to get a text message for every authentication
attempt, the clerk/person on the other end would need to
activate a "send text alert" button or something. That extra
technology probably doesn't even exist on their systems.
I get text alerts when my balance falls below a certain amount,
and when a significant payment goes through. Although the info
But the problem is how does the sending of the text message get activated? Does the customer service agent have a big red button
on their desk?
Ogg wrote to poindexter FORTRAN <=-
I did the same thing. The wording that irked me was something
aking to "will not work in the same field of work with a
competitor for 3 years following termination" ..or something
like that. So, I crossed that out.
Some headhunters gave me that tip.
.."will not work in the same field of work with a
competitor for 3 years following termination" ..or
something like that. So, I crossed that out.
Where are you? In California, non-competes have been shot
down in court several times.
| Sysop: | MCMLXXIX |
|---|---|
| Location: | Prospect, CT |
| Users: | 333 |
| Nodes: | 10 (0 / 10) |
| Uptime: | 17:52:40 |
| Calls: | 574 |
| Calls today: | 1 |
| Messages: | 235855 |