Live data from Hacker News

NY Payroll Company Vanishes with $35M

krebsonsecurity.com

61–70 of 94 posts

Re: NY Payroll Company Vanishes with $35M

#61

Earlier quoted context omitted.

Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?

The guy works for Stripe. I’d say as a company they’re pretty savvy about banking regulations in general, and transaction disputes specifically.

His blog also mentions that he's ghostwritten a few hundred letters to various financial institutions in order to resolve errors in credit reports (https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...).

Re: NY Payroll Company Vanishes with $35M

#62
post #11

This was confusing to understand, because multiple bad things happened. Normally: * Step 1: Transfer funds from each Employer's account to Cachet's holding account * Step 2: Transfer funds from Cachet's holding account to each Employee account Both of these steps are handled with an 'instructions file'. --- The crime (or horrible mistake that really looks like a crime): Step 1's file was changed so that the funds wen…

One final step: Cachet is cancelling all of the reversals so everybody should finish up with their usual pay. Of course, this leaves Cachet with a $26 million problem, but this seems to be the least worst short term solution.

Re: NY Payroll Company Vanishes with $35M

#63
post #32

Since this is sort of my beat: If this ever happens to you, immediately call bank, say “Electronic transaction posted in error.”, specifically identify the transaction, and ask what address the bank takes Regulation E written complaints at. If the CSR doesn’t know that answer, their supervisor does, or in the alternative FedEx HQ addressed to chief counsel or head of compliance. The letter just needs to state transac…

Hey Patrick, I'm surprised to see "this is sort of [your] beat". Do transactions like this happen to you often? What sort of speed-to-recovery do you see when you take this approach?

I suspect it's because he works for Stripe now, which handles the electronic transfer of monies. Therefore, Stripe would have to know about Regulation E to be able to operate effectively in that space.

It has been my experience that when working at a company, even if you didn't know or care about the industry/field that company does business in before starting there, you can't help but learn the ins and outs of that field or industry while working there, to at least a partial degree. The particulars of that field will necessarily influence business operations, and therefore, what you do in that company in some form or another. How much one absorbs, and how much he is aware of this will depend on both the individual and the duties of his position, and whether this comes from deliberate training or cultural osmosis. But I don't think that a person could remain completely ignorant of the particulars of an industry after being employed by a company in that space.

That's my theory, anyway. Watch Patrick prove me wrong by describing how he came into knowledge of Regulation E by some other path than training or cultural osmosis while working at Stripe

Re: NY Payroll Company Vanishes with $35M

#64

Earlier quoted context omitted.

Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy i…

Wouldn't getting physical paychecks instead of direct deposit also work for protecting your account number while receiving payments?

Unfortunately, with the Check21 whoever issued the physical check will get access to the scanned image of the substitute check together with the bank information of the account the check was credited to.

Re: NY Payroll Company Vanishes with $35M

#66

Earlier quoted context omitted.

Wouldn't getting physical paychecks instead of direct deposit also work for protecting your account number while receiving payments?

Unfortunately, with the Check21 whoever issued the physical check will get access to the scanned image of the substitute check together with the bank information of the account the check was credited to.

Ah, so you'd have to do something like get it cashed at Wal-Mart for $8 and then deposit the cash into your account. The extra trip and fees make that annoyingly impractical.

Re: NY Payroll Company Vanishes with $35M

#67
post #59

Earlier quoted context omitted.

Yes, it is a little bit of a pain in the neck however. Basically you are going to implement your own ZBA with a positive pay ( while some form of a PP may be available to non-business accounts I have never heard of a ZBA + PP combination ). You will probably need to chat with the branch manager in a midsized/regional/community bank as everyone else would look at you as if you had two heads. The good security policy i…

Thanks for this overview! I've been using parts of this flow for a few years, but it's not 100% automated where it could be. Do you have suggestions for banks that make it easy to implement this workflow?

I have had a good with with a few community banks that were in the area that I happened to be in. The poor man's implementation ( 3 accounts with the one coded for no withdrawals ) costs about $15/mo and it makes me known to the branch staff, including the managers, which is invaluable. It works for both personal and business accounts but it does not have a good online experience -- there's no positive pay.

National banks ( think Chase/Citi/Boa/WF/HSBC ) offer positive pay on cash management accounts ( corporate/treasury/commercial ) but have very complex workflow so I avoid them.

From regional ones I had a good experience with PNC.

Re: NY Payroll Company Vanishes with $35M

#68
post #65

This may be tangential and specific to United States, but is there a way to prevent someone from withdrawing money from your account if they know the account and routing number? Both of those numbers are on checks.

There isn't a good way to do that. Electronic funds transfers are generally reversible, though. After informing your bank of an unauthorized electronic funds transfer, they are required to investigate and provide you at least a provisional credit for the amount within ten business days.

Re: NY Payroll Company Vanishes with $35M

#69
post #42

Besides the banking issues, when do the people get paid? If the disappeared payroll company got money from employers, it's possible some employers may not have enough cash to pay a second time. Then they out of business, or close to it. The old businessman's phrase "You've never had to meet a payroll" is really meaningful here, the scramble to pay everyone.

The article said that Cachet is covering the transactions, even though they haven't been paid. The companies will have to find a new payroll provider before their next payroll, but not have to come up with the extra cash.

Re: NY Payroll Company Vanishes with $35M

#70
post #7

ACH reversals are horrible when they mistakenly happen. They really are a selling point for getting paid in cryptocurrency.

Yeah, until you need to pay rent, loans, credit cards, or buy groceries, or prove you are paying folks at least minimum wage.

Converting out to fiat is completely doable. People in countries where their own currency is experiencing issues make it work. Of course, ideally, ACH reversals couldn't be done without your permission.
Post reply on HN