If your routing and account numbers are ever compromised you should immediately close the account and open a new one. The banks have proven to be completely inept at this part of customer service and if you bank with one of the big boys they will sometimes hassle you to get your money back.

Posted by The Saving Freak | November 11, 2007 5:05 AM

Why would that possibly be a bad thing? As long at the flow of money is always into the account, if some unidentified stranger wants to pay off my credit card, go right ahead.

Posted by Bob | November 11, 2007 6:01 AM

Wow, that is very strange. I wonder what else this would work for. There are so many services that let you pay through a bank account, even your house payments. As I recalled, I used my account once to pay for my mom's payment and she uses her maiden name, there was no way to prove I was related to her by any means. I didn't think much of it but it did go through. That is extremely dangerous, I think its an oversight that banks need to deal with. Perhaps in addition to just the routing and account number, there should be a password as well.

Posted by Danny Tsang | November 11, 2007 12:19 PM

I've seen this a few times, which prompts me to always remind others to check their credit reports often... think how easy it would be to change other things in regards to her credit card...

PS. happily just stumbled upon your blog!

Posted by NoExcuseBudget.com | November 11, 2007 3:51 PM

I guess it was so easy because you were giving them money. If you were trying to transfer money from the account, you would probably not be able to.

Posted by SingleGuyMoney | November 11, 2007 6:17 PM

Four years ago I was facing surgery for ovarian cancer. Being unmarried, it made sense for me to add my brother to my bank accounts as an authorized signer so if I were unable to take care of my finances for an extended period of time, he could do so.

Fortunately everything turned out fine. With one exception, because this was done in California, when he became a "signer" on the accounts, the bank decided he was "part owner." And, since he had an account at the same bank, it meant that he could also have access to my money. He's an honest guy, so he never knowingly withdrew money. However, he and his wife have a habit of writing bad checks. And, as we know, banks will "sweep" accounts to assure payment on accounts with NSF. So, money is withdrawn from my accounts to pay my brother's bills. What he owes me is now in excess of $1,000.

He's said he will pay me back - it's never happened. He and his wife take exotic vacations, drive BMWs, send the kids to private schools - all on credit from the "wealth" earned from their home purchased in the late 1990s that has increased in value from $198,000 to over $750,000 at the height of the market. It has been refinanced along the way and they are now upside down on the mortgage. To keep peace in the family - I just have to write off the money.

That $1000 represents funds that could have gone into my retirement savings, debt reduction or a vacation. However, to maintain good family relations, it is worth it.

Posted by Smart Girl | November 11, 2007 6:54 PM

Just to clarify, what I was concerned about was essentially the ability for my fiancee (or a stranger) to give another financial institution my routing number and account number and take money out of my bank account with no verification that there was "authorization" from me.

Posted by 2million | November 11, 2007 7:48 PM

Hi 2million. I can't imagine that's possible. If the trasaction is initiated from your account, it's Ok. But how can they pull money in that way? By the way, I have put your blog in my blogroll. Can you add mine? My blog link is www.mycardblog.com. Thanks.

Posted by cardoffer | November 11, 2007 10:37 PM

cardoffer... have you not paid a credit card online? every company I have used allows you to log in to your account, add a bank account (sometimes they verify it is yours, sometimes they do no verification), schedule a payment, and then on the due date it automatically is pulled from your checking account to pay the bill. so in essence, if you can find a CC company that doesnt do an indepth verification process to see that the bank account is truly yours, you can just enter any random persons valid account # and have all of your bills paid for free. of course this will likely leave you behind bars, but for people residing in offshore locations, they can try this all day long with minimal threat of punishment

Posted by bryan | November 12, 2007 7:51 AM

2million - i did the SAME exact thing on my fiances account. i too was both thrilled (this bill NEEDED to be paid right away) and scared (because it was SO EASY).

Posted by pamisano | November 12, 2007 9:28 AM

This has been standard procedure for years. If I know a routing number and account number I can issue a bank draft and drain any account.

Posted by ParatrooperJJ | November 12, 2007 10:28 AM

2million:

i understand exactly what you are talking about and the issue you have with it, but i believe there are very tough laws regarding these transactions (these are achs, aren't they?). from what i understand, if you tell the bank that these transactions happened without your permission, they will reverse them.

s.b.

disclaimer: this is what i read somewhere (i don't recall where), and i have not proved it, i.e., i have no experience reversing such transactions.

Posted by some body | November 12, 2007 12:36 PM

I don't proclaim to be an expert on this topic but I do work for "your" bank--I'm surprised you were able to do this so easily as well. There are many bells and whistles built into our fraud monitoring (because they do foot the bill for fraud on customers account as long as it's truly found to be fraud and most of the time a customer has credits post within a few days to a couple of weeks at most), but somehow this flew under the radar as a questionable transaction.

I wonder if it was the dollar amount-was it a smaller amount? Typically when there is fraud on someone's account, it happens quickly with frequent transactions. The criminals do as much as they can as quickly as they can before they are caught and the transactions typically go up in incremental amounts.

It's definitely a catch 22 for both the bank and the consumer. The consumer wants ease of doing business but protection of their assets at the same time. I've had many customers come in and complain when a transaction was blocked as questionable--and others that were glad that someone was behinds the scenes monitoring the transactions (those customers are ones that have had something affect them with identity theft in the past and understand the reasoning behind it).

In any case, whatever the reason behind your ability to do this, be sure to report any true unauthorized activity on your account if it should happen, to the bank within 60 days to be compensated for the transaction.

lucy

Posted by lucy | November 12, 2007 2:33 PM

We transferred $250.00 via this transaction

Posted by 2million | November 12, 2007 7:38 PM

we transferred almost $4,000 doing this

Posted by pamisano | November 13, 2007 11:43 AM

So, what is the difference between this and you purchasing something with an online check? It's not like online banks or stores have web cams to check your identity. In cases like this, a criminal would be easy to track down should there be fraud involved.

Posted by Steve | November 13, 2007 2:16 PM

I'm not sure I understand. Everytime I've linked my checking account online, I've had to verify it to the linked account using trial deposits. There was no verification like that??!!

Posted by Mike L. | November 14, 2007 2:07 PM

Exactly, no verification was done. Only some banks use the trial deposit to verify accounts.

Posted by 2million | November 14, 2007 7:13 PM

That IS scary given that the routing number and account number are printed on every check that you hand out to any perfect stranger. That is a huge hole. Did you ask your bank about it?

Posted by shadox | November 15, 2007 4:37 AM

damn, thats terrible!

need to log into my account and make sure my money is still there!

Posted by Living Off Dividends | November 19, 2007 12:12 AM

Wow, that's scary! Goes to show we should always look at our statements monthly.

Friday when I run down the articles I most enjoyed from the Carnival of Personal Finance #127, I plan to provide a link to yours.

Best Wishes,
D4L

Posted by Dividends4Life | November 19, 2007 2:51 PM

I worked in the wire/ACH dept of a mutual fund company and we had shareholders transferring cash into investment accounts daily. Here's our process-
-Customer initiates ACH pull from a bank account to us.
-If this is a first-time draft, a pre-notification of draft (prenote) is generated. It reports routing #, acct #, name on bank account, and $ amount. (If drafts have already been made from this account, prenote is not generated.)
-We were a small operation (in comparison to Citi) and typically received 50-100 prenotes on our daily report. Due to the small volume, it was feasible to manually check prenotes.
An employee manually checks the prenote report to ensure that names on the bank accounts match the names on receiving accounts.
-There is a 3 day window for review and rejections. If the names do not match and our due diligence returns nothing to confirm a relationship, the item is manually rejected by the employee. If no action is taken within 3 days, the transfer goes through.

If her last name matched your last name at the time of the draft, it would have been approved as an authorized draft. This is common practice, as there are 10,000x more legitimite requests than fraudulent when names match.
Or, Citi simply neglected to review the prenote report within 3 days, and the draft was processed.

Posted by atlas | November 20, 2007 9:43 AM

Most banks/institutions will force you to validate an external account before they'll allow ACH transfers with it. I've seen two ways this is done. One is the pre-note method mentioned earlier. The more common method involve the bank sending two small deposits to the external account. You then have to confirm the amount of the deposits; as only the owner should have access.

Also, many banks/institutions will hold put a hold on the money if you initiated the transfer to pull from an external account.

Posted by Anonymous | November 21, 2007 3:16 PM

Who uses checks anyway?

Posted by Anonymous | November 21, 2007 7:24 PM

Atlas, Thanks for the insight. I am suprised a large company like Citi doesn't have more screening in place, maybe not like your company, but some sort of automated process.

To clarify - my fiancee's name didn't match my name at the time of the transfer. In fact we didn't have any personal information in common (ie phone, address, name, etc).

Posted by 2million | December 2, 2007 10:13 PM

I may be wrong, however it is my understanding that the routing number to deposit money into an account is not the same number as that which would withdraw money. They aren't even similar. If that is so, I don't understand the panic. Someone depositing into your account is no problem.

Posted by Jim J. | August 7, 2011 2:45 AM