Get SF Weekly Newsletters
Pin It

$hort Circuit 

The downside of electronic fund transfers

Wednesday, Apr 3 1996
Like many who work in the city, Melanie Hermann is a desk jockey: The 31-year-old legal secretary spends her days in a downtown firm shuffling paperwork, taking phone calls, and pounding on a keyboard. Hermann enjoys the work, but her body doesn't. So last December, when she decided to get fit, she joined the 24-Hour Nautilus Fitness Center near her Russian Hill apartment.

The gym, like many, prefers to collect its $24 monthly dues via automatic transfer from its members' checking or savings accounts. This makes bookkeeping easier for the club as well as cheaper: The transaction costs are $2 less than processing a check. Also, automatic transfer helps clubs increase revenues: People are less likely to interrupt their membership if they don't have to write a monthly check to cover their dues.

But Hermann said no to the arrangement, refusing to sign the "EFT" (banker's lingo for "electronic fund transfer") authorization section of the contract.

"I don't like anybody taking money out of my account but me," Hermann says. "I'm old-fashioned. I don't like the pay-point at the gas station or the electronic transfers."

Hermann wrote a personal check for her initial fees, so it came as quite a surprise to her when her January Wells Fargo Bank checking account statement arrived. It listed a $24 direct withdrawal by 24-Hour Nautilus.

"I was furious," Hermann remembers.
She called Wells Fargo and got even more steamed.
"Their whole reaction is that this is between you and 24-Hour Nautilus," Hermann says. "I've been banking with my bank for a long time. I expect them to protect my money."

"It just fell through the cracks," says Vinnie Farrell, manager of the club's Sutter Street branch. "It wasn't supposed to be set up, and it inadvertently got set up. We've taken care of it." Indeed, the gym made restitution for what amounts to an accounting error after Hermann complained.

Contrary to what Wells Fargo told Hermann, the bank is not a third party to the transaction. But it is up to the customer to prove fraud. (Wells Fargo declined comment on the matter.)

Hermann's hassle illustrates the downside of electronic banking. It may be convenient to settle insurance bills, cover the mortgage, and keep the newspaper arriving on the front porch every morning without writing a check. But there are costs -- and risks -- to authorizing strangers to handle your money.

And automatic withdrawal is only one road into your bank accounts. There are also the debit machines at the gas station and the grocery store, point-of-sale and point-of-service machines, and the ATM machine. While the system promises recourse in the case of fraud or bank error, it offers consumers little in the way of protection or prevention.

In Hermann's case, the snafu appears to have been the result of a clerical error. But there are examples of premeditated theft. In March, the Federal Trade Commission filed charges against magazine telemarketers in Oklahoma, Georgia, and New Jersey who made unauthorized debits from account numbers given by unwitting consumers. In this case, customers were asked by telemarketers to give their checking account number for identification. And the banks allowed the withdrawals to be made.

Regulation, it would seem, hasn't exactly kept pace with technology. The California State Banking Department is not going to jump in and sort out your problems -- the Banking Department's job is to ensure the solvency of financial institutions. The federal Comptroller of the Currency will investigate a complaint, but if there's a dispute with the bank, you basically have to go to court to get your money back.

There is no legal requirement that a bank have your signed authorization on file before allowing a third party to withdraw money from your account. The only reliable watchdog over your finances is you.

Businesses join an electronic transfer system through their banks, and something called the Automatic Clearing House. The Clearing House is not the big, mysterious warehouse its name implies. It's a computer system, mostly inside the Federal Reserve, that receives debits and passes them on to the specific financial institution that houses the customer's account. The whole thing works similar to the way that checks move, only without the paper.

The health club, for example, sets up payment with its bank, which tells your bank that you've authorized this automatic withdrawal. Your bank, in turn, transfers the money out of your account. The role of the business' bank is to verify that the business is legitimate when the bank sets up an electronic funds transfer. But because banks don't scrutinize every request for transfer, sometimes money moves without authorization.

The friendly banker who knows you and knows your account is history: The Lucy Show's Mr. Mooney lives on only in reruns. Banking transactions are simply numbers that run through a computer.

"The bank is not going to look at every transaction one by one by one," explains Diana Weston, vice president of marketing and public relations for Western Payments Alliance, a trade association that sets up rules for electronic transfer. "It takes individual awareness and responsibility," Weston says. "The protections are there, but you have to know what they are and you have to keep an eye on things."

Electronic transfers come under a fairly formidable set of rules collectively known as Regulation E of the Federal Reserve System. Regulation E states, among other things, that if you tell the bank you did not authorize the withdrawal within 60 days of receiving a statement with the transaction on it, the bank must credit your account after the first $50.

The same need for vigilance applies to ATM transactions and debit-card payments. Your ATM account number is the key that opens the door to your money. At the same time, those account numbers are ever more widely used for money transactions, from the bakery to the grocery story to the gas station.

Armed with that account number, it's not difficult for savvy crooks to get to your money -- proven recently by a Business Software Alliance study that showed that banks' encryption standards are increasingly vulnerable.

Last year, when the Federal Reserve Board changed its requirements for receipts from ATM and debit-card transactions, it encouraged banks and retailers not to print the entire account number on receipts for purchase or ATM transactions. "Shoulder surfing" thieves can read your PIN number over your shoulder and use the account number from your discarded transaction receipt to crack your account. Unfortunately, the Fed stopped short of prohibiting the printing of account numbers on receipts. And retailers are slow to change their costly machines.

Further complicating matters is the profusion of private businesses in the money-flow chart. Not all ATMs are owned by banks, especially those in airports, hotel lobbies, and convenience stores. Those machines may be owned and operated by an "independent sales organization" that's not even in the financial business. And there is no security requirement that they be equipped with video cameras or other safety measures. If the crooks get ahold of your numbers, they can drain your account before you know what's happened, leaving you with virtually no way of proving to your bank that it wasn't you who depleted the account.

A similar scenario exists with the point-of-service machine that allows you to pay for purchases -- like gasoline -- with your bank card. Any number of employees may have a look at your receipt and the numbers you're punching in the machine.

"[Non-financial businesses] absolutely opened it wider to fraud," says Ron Reed, chief operating officer of Visa's electronic linking network, the PLUS system.

"Typically, with the ATM environments, there are safeguards built in and there's an investment already there. In the point-of-service business, you've got a third party involved and you don't know who they are."

Banking experts advise that you use cash machines that are sponsored by a known financial institution. They also warn never to throw away your receipts and always read your bank statement carefully.

Hermann was lucky. By paying close attention to her bank statement, she caught the error. The health club acted professionally by extending her membership and accommodating her wish to pay by check in the future. But the whole fiasco made her even more wary of electronic banking.

"It's great that you can do all these things through the bank and the computers, but there's hackers out there and it's scary," she says.

About The Author

Lisa Davis


Subscribe to this thread:

Add a comment


Popular Stories

  1. Most Popular Stories
  2. Stories You Missed