Schneier on Security

Peter A. • January 8, 2013 3:54 AM

The American practice of checks with no signature is absurd. It destroys the original idea and purpose of checks entirely. The signature used to be (and still is almost everywhere else) an essential element of a check.

A few notes about account numbers, withdrawals and direct debit in Poland, for those interested:

All you can do knowing someone’s account number is to send him money. There are various ways: postal order, cash deposit at a bank’s branch, wire transfer from your account (all transfers are wire today), various online payment processors etc. To withdraw funds you need some kind of authentication tied to the account’s owner: ID card and signature for in-person withdrawal at bank desk, a debit card and PIN (at desk or at an ATM), user ID plus password plus some other authentication method for online operations etc. The details are up to the bank (some minimal requirements are set in the law, but I don’t remember the details). I don’t know of any bank that uses only user/password for any online withdrawal or similar operations (“read-only” operations after logging in with user/pass are usually allowed). The second authentication method varies: a digital signature using a key stored locally by the user, a TAN from a separately mailed paper list or a scratch-off card, a TAN sent to an owner’s mobile phone, a code from a time-based physical token, a code from a challenge-response physical token etc. Many banks allow to choose from several options, some of them involving extra fee.

Direct debit works this way: first you have to grant authorization for direct debit by filling a paper form in two copies, sign them, then send them via mail to your creditor (usually some phone or utility company). The company fills in it’s details including some customer ID on one copy and sends it to the bank. The bank authorizes the signature and creates an entry in its system for this particular instance of direct debit authorization. From now on, the company may debit your account. This is done electronically via inter-bank wire transfer system.

You may cancel any direct debit transaction within 56 calendar days (individual) or 5 working days (company). You may revoke the direct debit authorization completely at any time by sending a paper form to your bank. You may also temporary suspend the authorization and restore it later (online or otherwise).

Lately it has been made possible to authorize direct debit online at your bank’s site. Some banks support that, but not all.

You may be charged by your bank for using direct debit and/or for each transaction and/or for cancelling a transaction, but many do not charge at all (at least in some plans) and practically all the rest of them charge less than for a regular wire transfer.