Live data from Hacker News

NY Payroll Company Vanishes with $35M

krebsonsecurity.com

11–20 of 94 posts

Re: NY Payroll Company Vanishes with $35M

#11
This was confusing to understand, because multiple bad things happened. Normally:

* Step 1: Transfer funds from each Employer's account to Cachet's holding account

* Step 2: Transfer funds from Cachet's holding account to each Employee account

Both of these steps are handled with an 'instructions file'.

---

The crime (or horrible mistake that really looks like a crime):

Step 1's file was changed so that the funds went to an account at Pioneer Savings Bank (controlled by MyPayrollHR)

Step 2's file was sent as it normally would be.

----

Mistake 1: The file for Step 2 was processed, and funds from Cachet's holding account were transferred to employees, despite funds from Employers not coming in.

Apparently Cachet had at least $26M extra in their holding account for this to work.

As a result of this, Cachet tried to reverse these transactions, since basically they hadn't actually been paid.

----

Mistake 2: The reversal file was improperly formatted. NACHA rules say these files should be ignored or rejected, but..

----

Mistake 3: Some financial institutions processed the improperly formatted file anyway.

----

To fix Mistake 2, Cachet submitted a new reversal file, which was then also processed by the companies.

It sounds like this "reversal file" was actually just a transfer in the other direction (as opposed to "undo transaction ID 937641745"), so of course it would make sense that it was processed.

----

As a result, all employees paid via MyPayrollHR were paid, then had that payment removed. Some also had the same payroll amount removed a second time.

One thing I haven't figured out, is apparently the MyPayrollHR account at Pioneer Savings Bank is 'frozen' -- but I can't find any reporting about whether it has $26M in it or not. Meanwhile the CEO has disappeared.. So did he get the money, or just cause a massive life disruption for thousands of people?

Re: NY Payroll Company Vanishes with $35M

#13
post #4

Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs? I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?

I think that this doesn't protect you and you would just end up over drafting your account, resulting in fees.

Can't you disable overdraft?

Re: NY Payroll Company Vanishes with $35M

#14
post #11

This was confusing to understand, because multiple bad things happened. Normally: * Step 1: Transfer funds from each Employer's account to Cachet's holding account * Step 2: Transfer funds from Cachet's holding account to each Employee account Both of these steps are handled with an 'instructions file'. --- The crime (or horrible mistake that really looks like a crime): Step 1's file was changed so that the funds wen…

Thanks for the explanation, based on the way Krebs worded the post I couldn't tell what actually happened.

Re: NY Payroll Company Vanishes with $35M

#15
post #10
post #7

ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.

Wouldn't a flag on the ACH that makes it irreversible accomplish the same goal with considerably less overhead? I think it's already possible to do this with a wire transfer.

You can't currently do that can you? If you can, please tell me how because I would love to know. :-)

If you mean that this could be implemented, then great I'm all for it. From a technical perspective it doesn't seem like it should be difficult. I'm under the impression it doesn't exist most likely because the banks don't want it to. Hence the benefit of using cryptocurrency.

Re: NY Payroll Company Vanishes with $35M

#17
post #4

Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs? I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?

I think that this doesn't protect you and you would just end up over drafting your account, resulting in fees.

Sure, but at least you'll still be able to pay rent etc without late-payment fees. A single overdraft fee is way less bad.

Re: NY Payroll Company Vanishes with $35M

#19
post #10
post #7

ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.

Wouldn't a flag on the ACH that makes it irreversible accomplish the same goal with considerably less overhead? I think it's already possible to do this with a wire transfer.

I'm not sure these ACH transactions are actually processed like reversals. Otherwise, you wouldn't be able to reverse the same transaction twice, as happened here. They just pulled money back out.

Re: NY Payroll Company Vanishes with $35M

#20
post #9

This does seem like a nightmare scenario for the vast majority (4 in 5?) of Americans who live cheque-to-cheque. Your pay is yanked, life doesn't stop and the bills keep coming. A few days, a week later, it's corrected and the pay reappears. Who's on the hook for your overdraft fees?

What is an overdraft fee? How much is it? Is it interest?
Post reply on HN