Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NY Payroll Company Vanishes with $35M

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 94 posts

Re: NY Payroll Company Vanishes with $35M

#71

Post by tgsovlerkhgsel »

notyourday wrote: post #21
DoofusOfDeath wrote: post #2

Is it possible to protect one's direct-deposit wages from (unjustified) ACH reversals, by transferring funds into a different account ASAP after the deposit occurs? I.e., by maintaining an account that serves only as a temporary inbox for direct deposit?

Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy i…

Sounds like for personal use, and if you can afford it, it's much easier to have your funds spread over a number of accounts (e.g. have a main account, a second account at a different bank with at least enough money for expenses until you can withdraw from a savings account, and a savings account at a third bank).

And a bit of cash in case the ATMs all go down.

Re: NY Payroll Company Vanishes with $35M

#72

Post by tptacek »

dsfyu404ed wrote: post #51
isostatic wrote: post #43

Earlier quoted context omitted.

California Civil Code section 2080.1 for example "the person saving or finding the property shall, if the property is of the value of one hundred dollars ($100) or more, within a reasonable time turn the property over to the police department of the city" https://codes.findlaw.com/ca/civil-code/civ-sect-2080-1.html

I'm sure that'll make for some great "well we can't get them on anything else" prosecutions in a few decades as inflation works its magic. Hard coding dollar amounts into law is beyond stupid. At least it's a civil infraction so you should only get a fine in most cases. (I'm making the charitable assumption that having the amount decrease over time was not intended).

"Well, if we can't get them on anything else, we'll get them on theft" seems OK to me.

Re: NY Payroll Company Vanishes with $35M

#73

Post by penagwin »

buckminster wrote: post #62
gregmac wrote: post #11

This was confusing to understand, because multiple bad things happened. Normally: * Step 1: Transfer funds from each Employer's account to Cachet's holding account * Step 2: Transfer funds from Cachet's holding account to each Employee account Both of these steps are handled with an 'instructions file'. --- The crime (or horrible mistake that really looks like a crime): Step 1's file was changed so that the funds wen…

One final step: Cachet is cancelling all of the reversals so everybody should finish up with their usual pay. Of course, this leaves Cachet with a $26 million problem, but this seems to be the least worst short term solution.

If Cachet is doing that then I'm very glad. I don't know what their legal obligations look like, but I imagine they could have said "We weren't paid to perform our service" and left the employees without a paycheck.

Given how many people live paycheck to paycheck... It's a pretty big deal.

Re: NY Payroll Company Vanishes with $35M

#74

Post by penagwin »

the-dude wrote: post #20
soneil wrote: post #9

This does seem like a nightmare scenario for the vast majority (4 in 5?) of Americans who live cheque-to-cheque. Your pay is yanked, life doesn't stop and the bills keep coming. A few days, a week later, it's corrected and the pay reappears. Who's on the hook for your overdraft fees?

What is an overdraft fee? How much is it? Is it interest?

Overdrafting is when the balance goes below 0. Policies vary by bank, but generally it's a $25~$50 (could be more or less) for _each_ transaction the bank processes while your account has a negative balance.

So looking at this case, let's say you have to go 7 days until this issue is resolved and the employees are given their paychecks. If they got automatic payments they could find that itunes, spotify, bills, etc, automatically charge them during that period. EACH charge might be 45$. Say 5 services do it, boom over 200$ in the hole in fees alone.

(If you're ever in the situation listen to the other comments about how to approach the bank about reversing over-draft fees)

Re: NY Payroll Company Vanishes with $35M

#75

Post by patio11 »

korethr wrote: post #63
october_sky wrote: post #46

Earlier quoted context omitted.

Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?

I suspect it's because he works for Stripe now, which handles the electronic transfer of monies. Therefore, Stripe would have to know about Regulation E to be able to operate effectively in that space. It has been my experience that when working at a company, even if you didn't know or care about the industry/field that company does business in before starting there, you can't help but learn the ins and outs of that…

While that was a high percentage guess, and I have learned a lot at Stripe, I have pre-existing comparative advantage on this topic as a result of Ctrl-F “weird hobby”: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

Re: NY Payroll Company Vanishes with $35M

#77

Post by ars »

Kiro wrote: post #12

Why such a complicated transfer chain just to pay salaries? In my country you just export a bank file from your payroll system and that's it.

> from your payroll system

The payroll system is a 3rd party here. Which is pretty normal, there are a lot of different taxes and things that need to be tracked, and it's easier to let a specialist handle that.

Re: NY Payroll Company Vanishes with $35M

#78

Post by korethr »

patio11 wrote: post #75
korethr wrote: post #63

Earlier quoted context omitted.

I suspect it's because he works for Stripe now, which handles the electronic transfer of monies. Therefore, Stripe would have to know about Regulation E to be able to operate effectively in that space. It has been my experience that when working at a company, even if you didn't know or care about the industry/field that company does business in before starting there, you can't help but learn the ins and outs of that…

While that was a high percentage guess, and I have learned a lot at Stripe, I have pre-existing comparative advantage on this topic as a result of Ctrl-F “weird hobby”: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

Not sure I'm correctly parsing "high percentage guess", but nonetheless, after clicking through that link, I feel like a derp, because I'm pretty sure I'd read it before and should have thought of it, but didn't. Oh well.

Re: NY Payroll Company Vanishes with $35M

#79

Post by dsfyu404ed »

tptacek wrote: post #72
dsfyu404ed wrote: post #51

Earlier quoted context omitted.

I'm sure that'll make for some great "well we can't get them on anything else" prosecutions in a few decades as inflation works its magic. Hard coding dollar amounts into law is beyond stupid. At least it's a civil infraction so you should only get a fine in most cases. (I'm making the charitable assumption that having the amount decrease over time was not intended).

"Well, if we can't get them on anything else, we'll get them on theft" seems OK to me.

Writing catch-all laws especially ones that require law abiding people to go out of their way in order to follow them seems pretty darn dystopian but I see how one could turn a blind eye to it if it's used for something they want.

Re: NY Payroll Company Vanishes with $35M

#80

Post by notyourday »

tgsovlerkhgsel wrote: post #71
notyourday wrote: post #21

Earlier quoted context omitted.

Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy i…

Sounds like for personal use, and if you can afford it, it's much easier to have your funds spread over a number of accounts (e.g. have a main account, a second account at a different bank with at least enough money for expenses until you can withdraw from a savings account, and a savings account at a third bank). And a bit of cash in case the ATMs all go down.

That's the standard opsec issue. People mess up. Positive pay exists to make that "mess up" less painful.
Post reply on HN