USAA savings acct hacked for 5 figures

[MRG]

Quote:

Originally Posted by jazz4cash Thanks but it seems your point is more in favor of encoding than plain text. (I can guess the meaning.but what does MICR stand for?) Sent from my iPhone using Early Retirement Forum

More information on Magnetic ink character recognition, than I ever knew.

https://en.m.wikipedia.org/wiki/Magn...er_recognition

[davismills]

Quote:

Originally Posted by MichaelB Just curious - did USAA share with you if this fraud was carried out at a USAA branch or did it take place at another bank?

No sir. Very close held information.

[davismills]

Quote:

Originally Posted by jazz4cash Ok I'm confused about how a fake check can be drawn against a savings account. I know every check has the account and routing info in plain text (why is that not encoded) but how does that provide access to a savings account ? Sent from my iPhone using Early Retirement Forum

USAA provides savings acct checks as well as normal checking account checks. Unfortunately, I still don't know how they got the savings acct number. We'd only used the savings account checks for large items like taxes, loan payoffs, etc. I suppose it would be very easy to paste anyone's acct number to a "new" check. I'll never look at checks the same way again.

[Philliefan33]

Quote:

Originally Posted by MichaelB Just curious - did USAA share with you if this fraud was carried out at a USAA branch or did it take place at another bank?

USAA doesn't have many brick-and-mortar locations. There's only 17 "financial centers" in 11 states. I'm not even sure the financial centers do regular banking. I've had a USAA bank account for 29 years and have never set foot in one of their financial centers.

[Another Reader]

This is why I don't write checks on money market accounts where significant amounts of cash are kept. I transfer only the amount of money I need to the checking account and write the check on that account. Money market checks are locked away from prying eyes.

[target2019]

Quote:

Originally Posted by harley You're over-thinking this.

Actually, no. That was sound advice.

[AlbaCrush]

A few years back, when I logged on to my Suntrust account, I noticed that a transaction was pending. This account made it where a $1.00 transfer had to complete and the you could do wire transfer to different bank accounts. Luckily I logged in and caught this, if it went through, this person could of transferred all my money to their account. I had a freeze put on the account and Suntrust security's investigation traced the hack to the Ukraine. This took place on a Saturday and on Monday I closed the account with Suntrust. At the time, I only had about $9,000 in the account. I was so freaked out, I went on a spending frenzy to delete the funds. I paid off my bills for two months (putting extra money on the utility bills), bought gift cards, and a US Savings Bond.

[MichaelB]

Quote:

Originally Posted by Philliefan33 USAA doesn't have many brick-and-mortar locations. There's only 17 "financial centers" in 11 states. I'm not even sure the financial centers do regular banking. I've had a USAA bank account for 29 years and have never set foot in one of their financial centers.

We also bank with USAA. With check fraud, the bank that takes the check usually is liable if it is bad, I was just wondering if that was a USAA branch or another bank.

Quote:

Originally Posted by davismills USAA provides savings acct checks as well as normal checking account checks. Unfortunately, I still don't know how they got the savings acct number. We'd only used the savings account checks for large items like taxes, loan payoffs, etc. I suppose it would be very easy to paste anyone's acct number to a "new" check. I'll never look at checks the same way again.

Are these savings account checks the same as a checking account check, each one has the routing and account numbers printed on the front?

[MRG]

Quote:

Originally Posted by MichaelB We also bank with USAA. With check fraud, the bank that takes the check usually is liable if it is bad, I was just wondering if that was a USAA branch or another bank. Are these savings account checks the same as a checking account check, each one has the routing and account numbers printed on the front?

Almost have to be. Why? USAA or anyone in the business of processing checks has to have very high throughput. The hardware for high end check imaging is expensive so they tend to reuse the same solutions. Stuff is amazing to watch, I never knew paper could be moved so fast. They also love to reuse the business solutions.

The other thing I've noticed is the additional security these institutions have around check processing. Back 25 years ago, I could get into Megacorp's check processing area, pretty much anytime. When I left, no way, if I had a major issue it would require business justification approved by a couple of VP's maybe, and then I would be watched the entire time.

[Texas Proud]

Quote:

Originally Posted by MRG Almost have to be. Why? USAA or anyone in the business of processing checks has to have very high throughput. The hardware for high end check imaging is expensive so they tend to reuse the same solutions. Stuff is amazing to watch, I never knew paper could be moved so fast. They also love to reuse the business solutions. The other thing I've noticed is the additional security these institutions have around check processing. Back 25 years ago, I could get into Megacorp's check processing area, pretty much anytime. When I left, no way, if I had a major issue it would require business justification approved by a couple of VP's maybe, and then I would be watched the entire time.

And this is an important point... the check processing machines do operate at a blinding speed... the checks are going through them at such a high speed that you cannot see them.... I was doing a cost study on a facility and asked a bunch of questions....

They can set the machine at different levels of confidence.... remember, it is the written amount on the check that is the determining factor of a check, not where you write in the number.... and many people write worse than a doctor.... so the machine has to determine what was written and then say how confident it is that it is correct.... if it is not sure the image of that check is sent to a human to manually input the info.... that is very costly... so some banks put a low confidence and hope the machine got it right and if not that the customer has to find the error and tell the bank to fix it...


I do not know when it was easy to get into a check processing area... sure, it was easier than where they counted cash but not a place even bank people could go without the proper reason...

[Running_Man]

I do not understand how it was even possible for a “Check” with a wrong name on it to be cashed, that is a primary defense of fraud in the banking system. To fail at this simplest of controls, twice is pretty disconcerting for USAA.

[MichaelB]

Quote:

Originally Posted by Running_Man I do not understand how it was even possible for a “Check” with a wrong name on it to be cashed, that is a primary defense of fraud in the banking system. To fail at this simplest of controls, twice is pretty disconcerting for USAA.

That's not clear. If this check was deposited at another bank, and the account numbers are correct, the way USAA determines it is fraud is when the account holder reports it. The other bank is one the hook if it already paid the check to the fraudster.

[TrvlBug]

Quote:

Originally Posted by Another Reader This is why I don't write checks on money market accounts where significant amounts of cash are kept. I transfer only the amount of money I need to the checking account and write the check on that account. Money market checks are locked away from prying eyes.

+1. I also shredded the checks received on my HELOC as well as a savings account. I only write checks on the checking account where relatively small amounts are kept.

[Texas Proud]

Quote:

Originally Posted by Running_Man I do not understand how it was even possible for a “Check” with a wrong name on it to be cashed, that is a primary defense of fraud in the banking system. To fail at this simplest of controls, twice is pretty disconcerting for USAA.

You are under the wrong belief that they check that info...

[Walt34]

Quote:

Originally Posted by Running_Man I do not understand how it was even possible for a “Check” with a wrong name on it to be cashed, that is a primary defense of fraud in the banking system. To fail at this simplest of controls, twice is pretty disconcerting for USAA.

Not really, USAA didn't handle it any differently than any other bank would. When I retired I handled fraud/forgery investigations and as REWahoo said this is a simple forgery and that crime has been going on for as long as there have been checks to forge.

Bear in mind that it is by far the exception that a human actually reads any given check except at the point where it is initially passed. So if I have davismills's valid account number that is all the information I need to create a check, make it payable to "Donald Duck" and then deposit it into Mr. Duck's account that I have previously created for this purpose. When the check clears I withdraw the money and I'm outa there. What's so hard about that? Or I can have fake I.D. made up in Donald Duck's name and go out and buy a new car, writing a check for it.

As far as it being prosecuted, that is now entirely up to USAA or whoever ultimately takes the loss. davismills has been made whole and other than being slightly inconvenienced he has suffered no damages so his legal status changes from "victim" to "witness". The victim is now USAA unless they can kick it back to the bank where the check was accepted, then that bank becomes the one holding the bag and becomes the victim. And that bank may in turn kick it back to a merchant, such as a car dealer, since this was in the amount of five figures, and that car dealer would take the loss.

And that bank or car dealer or whoever, then has to decide "Is it worth my time and effort to prosecute this thing? Is there a viable suspect, and is he in the U.S. or Bangladesh? What are his assets that I can get to to recover my damages?" And so on. If there is a suspect but he has a net worth of $1.28, well, going after him is a waste of a business's time and they're probably not going to bother. Why throw good money after bad in the form of paying employees to go to a trial, perhaps in a different state with all the attendant travel costs without even a slight assurance that the trial judge will order restitution?

So you can see this then becomes a business decision, not a moral or legal one.

[akck]

Quote:

Originally Posted by Running_Man I do not understand how it was even possible for a “Check” with a wrong name on it to be cashed, that is a primary defense of fraud in the banking system. To fail at this simplest of controls, twice is pretty disconcerting for USAA.

In the incidents I'm familiar with, they just took our banking info at the bottom of the check and created their own checks with it. For all I know, the name they used may even have been their real name and address. In our case, they were buying things they apparently needed.


Sent from my iPad using Early Retirement Forum

[harley]

Quote:

Originally Posted by target2019 Actually, no. That was sound advice.

You're right. Just like it would be sound advice to put deadbolts on your doors and bars on your windows if your computer was hacked. Good advice anytime, just not having anything to do with the current crime.

[zinger1457]

If it was reported immediately I wonder if the fraudster ever saw any money from depositing the check. Most banks add additional time for large checks (>$10K) to clear. I received a sizable personal check drawn on my mothers estate recently and it took a full 10 days for the check to clear before I had access to the money.

[Walt34]

Quote:

Originally Posted by zinger1457 If it was reported immediately I wonder if the fraudster ever saw any money from depositing the check. Most banks add additional time for large checks (>$10K) to clear.

Probably not since it was caught so early, before the hold time has expired.

BTW, forum members have complained about that hold time even in the days of ACH (Automated Clearing House) - this event shows a good reason to keep those hold times in place.

[target2019]

Quote:

Originally Posted by harley You're right. Just like it would be sound advice to put deadbolts on your doors and bars on your windows if your computer was hacked. Good advice anytime, just not having anything to do with the current crime.

How can you discount this? Is it possible that some personal ID component was obtained through access to the OP's network?