Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evolve Bank and Trust confirms LockBit stole 7.6M people's data

theregister.com

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#21

Post by rdl »

trollbridge wrote: post #12
lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

That is one of the more clear (and opinionated, but IMO correct) summaries of how we got here that I've seen -- thank you!

Another aspect are all the cartel-like programs of banks overall (and the banking regulators) to keep even well-capitalized fintechs from offering these services directly. For e.g. Mercury they could probably be entirely fine without the high debit card fees.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#22

Post by toomuchtodo »

jabroni_salad wrote: post #19
toomuchtodo wrote: post #17

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=36801491 ("HN: FedNow Is Live") https://www.frbservices.org/financial-services/fednow/organi... https://explore.fednow.org/explore-the-city?id=3&building=ne... $25/month to plug into FedNow instant payment rails, 5 cents to move up to $100k in value (initial limit, max is $500k), 20 second settlement SLA.

This technically exists but can you actually use it? It seems like there are no articles about it in the 2024 calendar year. I remember reading a really nice screed from walmart last year pushing the fed to turn the screws on rent seekers, but without RFP and ubiquitous participation that isnt going to come about. bit of a conspiracy here but IMO banks have been observing the fraud rates with zelle, venmo, etc and on…

In cases of unauthorized Zelle payments, consumers have legal rights and protections under the Electronic Funds Transfer Act (also known as "Reg E”). This also applies to FedNow instant payments, which has fraud management services available and includes a closed loop reporting requirement.

You should expect to see instant payment functionality that runs on FedNow rails within banking apps in the next 6-12 months. I cannot share more detail publicly unfortunately, my apologies.

(contribute at a fintech, thoughts and opinions always my own)

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#23

Post by trevor-e »

lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

FYI Stripe (and many other fintechs) uses Evolve extensively for many of its products too, e.g. Stripe Treasury.

https://stripe.com/newsroom/news/treasury

> With Stripe Treasury, platforms can offer their users interest-earning accounts eligible for FDIC insurance in minutes, enabled by Evolve Bank & Trust.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#24

Post by Eridrus »

trollbridge wrote: post #12
lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

This doesn't seem to describe either Wise (international transfers, not an account) or Mercury (business banking where you can get your money out in a bunch of ways that do not involve debit cards).

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#25

Post by bobthepanda »

jabroni_salad wrote: post #19
toomuchtodo wrote: post #17

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=36801491 ("HN: FedNow Is Live") https://www.frbservices.org/financial-services/fednow/organi... https://explore.fednow.org/explore-the-city?id=3&building=ne... $25/month to plug into FedNow instant payment rails, 5 cents to move up to $100k in value (initial limit, max is $500k), 20 second settlement SLA.

This technically exists but can you actually use it? It seems like there are no articles about it in the 2024 calendar year. I remember reading a really nice screed from walmart last year pushing the fed to turn the screws on rent seekers, but without RFP and ubiquitous participation that isnt going to come about. bit of a conspiracy here but IMO banks have been observing the fraud rates with zelle, venmo, etc and on…

Most financial technologies take years if not decades to fully propagate through the system.

Contactless cards in the US for example, first rolled out in 2007.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#26

Post by lowkey_ »

trollbridge wrote: post #12
lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

> one of the major problems here is that small banks are often not staffed for adequate cybersecurity for global operations like these; they do just fine doing hometown community banking, but are very vulnerable to being cracked like this. Yet another reason small banks that are providing big-bank services should be regulated like big banks.

Exactly — people are responding to me with comments about how SVB failed, or how the Goldman partnership isn't going well, but like... looking at Evolve's website I know for a fact they aren't hiring solid SWEs for cybersecurity.

I understand nobody's perfect, but this is the "Nobody got fired for buying IBM" ideology at work. If you chose Goldman and they got hacked, sure, I'll say "well you couldn't have known" — but if you choose a random bank based in Memphis I've never heard of, I'll naturally be more like "wtf."

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#27

Post by aketchum »

trollbridge wrote: post #12
lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

There are plenty of reasons to partner with a bank as a fintech other than to drive debit card revenue.

1. There are lots of regulations that say only banks can do certain actions, like lend in all 50 states under the rules of a single state. Or open a FDIC insured checking account. Or have a unique account+routing number for each user to send ACH funds to (various reasons this could be preferred to everyone ACH to one single global account). These are valuable services without any debit card issued by the fintech.

2. It is basically impossible to become a bank. The government only approves a handful a year. Square (block) actually got approval recently but it is very difficult to do.

As a result of (1) + (2) is that if your company needs any banking products at all you need to partner with a bank because there is just no reasonable way to legally build that functionality yourself.

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#29

Post by aketchum »

lowkey_ wrote: post #6

Can someone explain why in the world Evolve has my data? (I use Mercury and Wise for my company). I tried going to their website and I'm still completely clueless. Edit: Apparently Mercury was using Evolve as their banking partner. I know this is super common w/ online neobanks, but I'm really confused as to why they always choose the most random obscure bank. Why not partner with a major bank, or Column?

Column does not offer many of the options that other bank providers do, is fairly expensive, and may not have been in existence when Mercury chose their vendor. Evolve is not a "random obscure bank" - it is a bank that pivoted to have a main business model of providing b2b platform banking instead of consumer banking.

The major banks don't get into this game because the regulations on banks get much stricter the larger you get. So the fintechs are incentives to partner with "small" (this means sub $50 Billion in AUM) banks to deal with the minimum amount of necessary compliance (still a LOT of compliance working with small banks)

Re: Evolve Bank and Trust confirms LockBit stole 7.6M people's data

#30

Post by aketchum »

lowkey_ wrote: post #26
trollbridge wrote: post #12

Earlier quoted context omitted.

An act of Congress (I believe it was Dodd-Frank) capped debit card fees at a very low amount (fractions of a precent). An exception was left in for small banks to continue to charge credit-card-like rates for debit cards, around 2%. Since then, every fintech has had essentially the same business model: - Come up with some kind of "innovative" thing to sell consumers on that results in them generating debit card trans…

> one of the major problems here is that small banks are often not staffed for adequate cybersecurity for global operations like these; they do just fine doing hometown community banking, but are very vulnerable to being cracked like this. Yet another reason small banks that are providing big-bank services should be regulated like big banks. Exactly — people are responding to me with comments about how SVB failed, or…

but Goldman wont take your call if you are sub $100MM in revenue (probably need way more than that). So you set up your partnership early in your company life then if the relationship is working fine why would you pay hundreds of thousands or millions of dollars and rebuild your integrations just to have a larger bank partner that none of your users will ever know you are using
Post reply on HN