Online Bill Pay Security: Push or Pull?

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills
User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 8:01 am

I've been doing online bill pay for some 15 years now (before my bank had ebill pay I was using mycheckfree.com). I've gone paperless as soon as possible with every bank/brokerage/credit-card ASAP along the way.
I have some credit cards whereby I go to the credit card site and "pull" payment for my bank. My bank information is stored on their site.
I have other credit cards and various utilities where why I "push" payment from my banks epay system. My credit-card and/or utility information is stored on my bank's site.
I am wondering if anyone knows definitively which is better from a security perspective?
My thoughts:
1) If I "push" from my bank to ALL my credit cards - the info from all my credit cards is stored in a single place. This is a single place whereby if someone was able to gain access they would have all my cards (IF I "pushed" all). In other words - I am trusting my bank to safeguard my private credit card information.
2) If I "pull" payment into a credit card - I am trusting the credit card bank to safeguard my bank's data.

Neither seems full-proof nor does one necessarily seem more or less secure than the other so I've continued with a blended approach. Thoughts?

Broken Man 1999
Posts: 750
Joined: Wed Apr 08, 2015 11:31 am

Re: Online Bill Pay Security: Push or Pull?

Post by Broken Man 1999 » Tue Sep 19, 2017 9:14 am

I pay all credit cards and various other bills via a "pull" from my account. Never had any issue.

Years ago my thoughts were that any (or many) issues that might arise from a bill not being paid on time would reside at the biller's end, not mine. So long as I kept enough funds in my account, everything would be OK.

Even today I am more concerned about my bills getting paid on time than I am about my accounts being hacked.

Sadly, despite all the care WE might take, so-called trusted :mad: partners who aren't even directly associated with our bill paying activities have let us down.

Honestly, in today's environment, I'm not sure which payment (push or pull) is the most secure. I would think push might be more secure, but I really don't know what info is received at the billing end of an electronic payment.

Broken Man 1999
“If I cannot drink Bourbon and smoke cigars in Heaven than I shall not go. " -Mark Twain

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 9:19 am

Broken Man 1999 wrote:
Tue Sep 19, 2017 9:14 am
I pay all credit cards and various other bills via a "pull" from my account. Never had any issue.

Years ago my thoughts were that any (or many) issues that might arise from a bill not being paid on time would reside at the biller's end, not mine. So long as I kept enough funds in my account, everything would be OK.

Even today I am more concerned about my bills getting paid on time than I am about my accounts being hacked.

Sadly, despite all the care WE might take, so-called trusted :mad: partners who aren't even directly associated with our bill paying activities have let us down.

Honestly, in today's environment, I'm not sure which payment (push or pull) is the most secure. I would think push might be more secure, but I really don't know what info is received at the billing end of an electronic payment.

Broken Man 1999
Thanks for the feedback. I agree the "pull" has a better feel of the bill getting paid. For a credit card where I do a "pull" my credit card shows paid immediately and my bank account shows the deduction a day later; For a credit card where I do a "push" my bank shows the debit right away but the credit card doesn't show the payment until the next day. The former definitely has a better feeling that the account is being paid - although if I consolidate down to the latter (all bill-pay pushed from the bank) I would only need to log into one place to pay all bills.

Broken Man 1999
Posts: 750
Joined: Wed Apr 08, 2015 11:31 am

Re: Online Bill Pay Security: Push or Pull?

Post by Broken Man 1999 » Tue Sep 19, 2017 9:35 am

Well, I'm lazy, so I also have my credit cards (as well as every other bill that I can) set on auto-pay. I receive an e-mail when my online statement is ready, another a few days before the pull is scheduled, and finally one when the payment is made.

The only time I don't pay a credit card bill 100% is when zero interest for a period of time is offered. Then I turn off auto-pay and schedule payments to take advantage of the offer.

Earlier this year I was recovering from an accident, and for two months wife just watched my emails to make sure everything was being paid. The only bills she had to address were the medical bills, and all of them were placed on credit cards for payment. Easy as could be.

Broken Man 1999
“If I cannot drink Bourbon and smoke cigars in Heaven than I shall not go. " -Mark Twain

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 9:39 am

Broken Man 1999 wrote:
Tue Sep 19, 2017 9:35 am
Well, I'm lazy, so I also have my credit cards (as well as every other bill that I can) set on auto-pay. I receive an e-mail when my online statement is ready, another a few days before the pull is scheduled, and finally one when the payment is made.

The only time I don't pay a credit card bill 100% is when zero interest for a period of time is offered. Then I turn off auto-pay and schedule payments to take advantage of the offer.

Earlier this year I was recovering from an accident, and for two months wife just watched my emails to make sure everything was being paid. The only bills she had to address were the medical bills, and all of them were placed on credit cards for payment. Easy as could be.

Broken Man 1999
Got it - thanks for the additional input - much appreciated. I have auto-pay for some utilities but not yet for credit-cards (or all utilities). I probably should go to this step (for years I've liked the "being forced to review before paying" step - I see your point about having time to review before the pull - as well as the convenience of things continuing to move if out of commission for a period of time.).

niceguy7376
Posts: 1784
Joined: Wed Jul 10, 2013 2:59 pm
Location: Metro ATL

Re: Online Bill Pay Security: Push or Pull?

Post by niceguy7376 » Tue Sep 19, 2017 9:55 am

I have any cards that send out e-Bills on Autopay in my Bofa.

issue is that Chase stopped sending e-bills and there are other companies (from my experience - Macys CC; Old Navy CC) that dont send e-bills. So for those, I need to rely on emails i receive when they close the statements to go into Bofa and set up the payments.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 10:04 am

niceguy7376 wrote:
Tue Sep 19, 2017 9:55 am
I have any cards that send out e-Bills on Autopay in my Bofa.

issue is that Chase stopped sending e-bills and there are other companies (from my experience - Macys CC; Old Navy CC) that dont send e-bills. So for those, I need to rely on emails i receive when they close the statements to go into Bofa and set up the payments.
Thanks for the feedback -
In the case of Chase - is there a reason why you don't just set up online bill pay with automated payments from their website? They appear to have the option.

User avatar
flamesabers
Posts: 1350
Joined: Fri Mar 03, 2017 12:05 pm
Location: Rochester, MN

Re: Online Bill Pay Security: Push or Pull?

Post by flamesabers » Tue Sep 19, 2017 10:12 am

DaftInvestor wrote:
Tue Sep 19, 2017 8:01 am
Neither seems full-proof nor does one necessarily seem more or less secure than the other so I've continued with a blended approach. Thoughts?
I prefer using the "pull" method to pay my credit cards.

I don't have any hard evidence as to which method is more secure. However, between the two methods, I think credit card companies have a much more vested interest with safeguarding your bank's information. It's probably much easier for credit card companies to process ACH payments then having to process a ton of paper checks that get mailed in. There is probably less chance of a screw-up with an ACH then with a paper check that might have illegible handwriting or a paper check accidentally getting misapplied to the wrong account. In contrast, with the "push" method the bank is losing your money. While banks don't want to intentionally anger their customers, if the "push" goes wrong they could always put the blame on the receiving end.

Another consideration is which method leaves me in a better position should there be an error with the payment process. If an error occurs with the "pull" method, the worse thing that could happen is I have to resubmit an ACH as my checking account won't get debited unless the "pull" is successful. With the "push" method I would worry about my checking account getting debited from the get-go before I know whether or not the payment has been sent successfully to my credit card company.
Last edited by flamesabers on Tue Sep 19, 2017 10:14 am, edited 1 time in total.

open_circuit
Posts: 65
Joined: Thu Mar 30, 2017 9:20 am

Re: Online Bill Pay Security: Push or Pull?

Post by open_circuit » Tue Sep 19, 2017 10:13 am

Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.

123
Posts: 2408
Joined: Fri Oct 12, 2012 3:55 pm

Re: Online Bill Pay Security: Push or Pull?

Post by 123 » Tue Sep 19, 2017 10:16 am

We use automated bill pay (pull). All the automated payment stuff goes through a separate account that we keep funded with a few thousand to cover expected disbursements, we fund it every month or two as we monitor the statement. As convenient as it might be to would fund bill pay transactions directly from a large investment account we don't do that. We want to be able to isolate and contain any problem or issue that develops.

Utility payments are on automated bill pay. Credit cards get reviewed before we push payment out, usually on a check.
The closest helping hand is at the end of your own arm.

User avatar
CAsage
Posts: 623
Joined: Sun Mar 27, 2016 6:25 pm

Re: Online Bill Pay Security: Push or Pull?

Post by CAsage » Tue Sep 19, 2017 10:20 am

I don't think there is a security difference in push vs pull between two existing accounts. I personally prefer to review my credit cards and pay the correct amount on the day I get paid. I have found that the credit card companies are better at crediting you when you initiate a pull from their website, seems to credit on the designated day and debit in my checking a day later. All my utilities (smaller) are set to autopay from checking.
For security... around which everything now revolves .. I set up alerts in all my credit cards for card-not-present or international or over $$ value. I'm not nearly so worried about fraudulent charges which the credit card companies have a good track record of detecting (that purse on Alibaba!) and instantly shutting down the account and reissuing cards. My fear is my savings and checking, and I'm setting up the best I can there.
Salvia Clevelandii "Winifred Gilman" my favorite. YMMV; not a professional advisor.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 10:26 am

open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 10:33 am

flamesabers wrote:
Tue Sep 19, 2017 10:12 am
DaftInvestor wrote:
Tue Sep 19, 2017 8:01 am
Neither seems full-proof nor does one necessarily seem more or less secure than the other so I've continued with a blended approach. Thoughts?
I prefer using the "pull" method to pay my credit cards.

I don't have any hard evidence as to which method is more secure. However, between the two methods, I think credit card companies have a much more vested interest with safeguarding your bank's information. It's probably much easier for credit card companies to process ACH payments then having to process a ton of paper checks that get mailed in. There is probably less chance of a screw-up with an ACH then with a paper check that might have illegible handwriting or a paper check accidentally getting misapplied to the wrong account. In contrast, with the "push" method the bank is losing your money. While banks don't want to intentionally anger their customers, if the "push" goes wrong they could always put the blame on the receiving end.

Another consideration is which method leaves me in a better position should there be an error with the payment process. If an error occurs with the "pull" method, the worse thing that could happen is I have to resubmit an ACH as my checking account won't get debited unless the "pull" is successful. With the "push" method I would worry about my checking account getting debited from the get-go before I know whether or not the payment has been sent successfully to my credit card company.
To be clear - I don't use paper checks for anything. Whether its a push or a pull its an ACH (or ACH-type) electronic transfer. I do understand that my bank's epay system will use a papercheck IF it can't do the ACH transfer - but it notifies me if this is going to be the case (in which case I can choose not to go this route and do a pull instead).
In any case - I really appreciate your feedback. After the equifax debacle I was really wondering if one method was more secure than another. It seems most of us fall back to whatever is more convenient (perhaps because security is a wash in both cases). As a side-note - after more than a decade of e-bill payments I've never seen a bill NOT go through in any push/pull situation. I only had a SINGLE problem and it was with a pull (I initiated a bill payment from a credit card website and they pulled out the payment TWO times. They gave me the credit twice but it caused an issue with my bank account balance. This was years ago - may have been a browser issue or something - never had that problem a second time).

open_circuit
Posts: 65
Joined: Thu Mar 30, 2017 9:20 am

Re: Online Bill Pay Security: Push or Pull?

Post by open_circuit » Tue Sep 19, 2017 10:36 am

DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am
open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
There's probably very little difference. With a pull payment, the payee stores my ACH information (check account number, routing number). With a push, my bank stores my payee account number and payee address. It seems like someone getting my ACH information is slightly higher risk to my cashflow than them getting my utility account number. However, I recognize ACH information is on every check I write, so it isn't exactly secret or secure to begin with. I just prefer to keep it out of most electronic databases to prevent both intentional and accidental drafts from my accounts that I do not intend to happen.

Also, another reason I don't auto-pay most push transactions is that payee addresses can change. In the last year, one of my utility payment addresses and HOA dues address have changed, with the only notice being a blurb in the statements both send to me. If I had not read the statements and trusted automatic push payments, both of these would have failed when the prior payment address was no longer active.

User avatar
KlingKlang
Posts: 442
Joined: Wed Oct 16, 2013 3:26 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlingKlang » Tue Sep 19, 2017 10:40 am

I'm 100% 'push' from my bank checking account because I don't want anyone 'pulling' money out of it without me authorizing the specific transaction and amount. Three credit cards and one utility bill a month is not too much work using the bank's on line payment system. I'm more concerned about billing errors than security.

DetroitRick
Posts: 414
Joined: Wed Mar 23, 2016 9:28 am

Re: Online Bill Pay Security: Push or Pull?

Post by DetroitRick » Tue Sep 19, 2017 10:40 am

I agree, neither is fool-proof, so security-wise it's not something that determines my choice of the two. I've used both "push and pull", but now I use entirely "pull" for reasons relating only to work-flow. Plus, for nearly all bills, I'm paying by credit card anyway (only a few exceptions where I have no choice) so my security concerns are even less and my liability would be zero anyway. And when I pay credit cards themselves, mostly to big companies (including my own bank), I'm not inclined to be too worried. I'm monitoring all activity daily anyway (Quicken downloads) and can stop errors and theft pretty quick if they arise (has yet to ever happen to me, knock on wood).

But when I first started pushing payments from my bank, it seemed like adding another small step in the process. So I eventually stopped and went back to "pull". Specifically, before paying a bill, I do want to check the bill online (that current charges are okay, last payment posted), and download the pdf. So I'm going to each vendor website anyway. Plus, to avoid errors (my own, as well as the vendor), when I schedule a payment (all my payments are future scheduled) I want to verify that I input correct date and amount, and that they recorded correct date and amount. Two seconds of verification, but otherwise an extra step (with a time delay) if I'm pushing out the payment from my bank.

sport
Posts: 5969
Joined: Tue Feb 27, 2007 3:26 pm
Location: Cleveland, OH

Re: Online Bill Pay Security: Push or Pull?

Post by sport » Tue Sep 19, 2017 10:53 am

KlingKlang wrote:
Tue Sep 19, 2017 10:40 am
I'm 100% 'push' from my bank checking account because I don't want anyone 'pulling' money out of it without me authorizing the specific transaction and amount.
I am also 100% push. I don't trust anyone other than DW and myself to have direct access to our checking account.

niceguy7376
Posts: 1784
Joined: Wed Jul 10, 2013 2:59 pm
Location: Metro ATL

Re: Online Bill Pay Security: Push or Pull?

Post by niceguy7376 » Tue Sep 19, 2017 11:08 am

DaftInvestor wrote:
Tue Sep 19, 2017 10:04 am
niceguy7376 wrote:
Tue Sep 19, 2017 9:55 am
I have any cards that send out e-Bills on Autopay in my Bofa.

issue is that Chase stopped sending e-bills and there are other companies (from my experience - Macys CC; Old Navy CC) that dont send e-bills. So for those, I need to rely on emails i receive when they close the statements to go into Bofa and set up the payments.
Thanks for the feedback -
In the case of Chase - is there a reason why you don't just set up online bill pay with automated payments from their website? They appear to have the option.
I can do that but I am moving away from Chase as my CC because of this inconvenience.

livesoft
Posts: 56381
Joined: Thu Mar 01, 2007 8:00 pm

Re: Online Bill Pay Security: Push or Pull?

Post by livesoft » Tue Sep 19, 2017 11:21 am

I push because Credit Card companies are set up to give you a new credit card [account] pretty much instantly if you or they suspect fraud. I think banks seem to be quite a bit less accommodating in this regard.
This signature message sponsored by sscritic: Learn to fish.

sport
Posts: 5969
Joined: Tue Feb 27, 2007 3:26 pm
Location: Cleveland, OH

Re: Online Bill Pay Security: Push or Pull?

Post by sport » Tue Sep 19, 2017 12:32 pm

livesoft wrote:
Tue Sep 19, 2017 11:21 am
I push because Credit Card companies are set up to give you a new credit card [account] pretty much instantly if you or they suspect fraud. I think banks seem to be quite a bit less accommodating in this regard.
In addition, if there is an erroneous charge on a credit card, you can just dispute it. If there is an erroneous withdrawal from your bank account, you may be overdrawn, have checks bounce, or have to argue with the bank to get your money refunded and the fees cancelled.

JohnFiscal
Posts: 437
Joined: Mon Jan 06, 2014 4:28 pm
Location: USA

Re: Online Bill Pay Security: Push or Pull?

Post by JohnFiscal » Tue Sep 19, 2017 1:46 pm

I've used "push" a few times when transferring money around. It makes me feel a bit edgy as I may not be entirely positively confident that it's going to get pushed into the right place. So when I transfer my own cash around between my own accounts I use "pull" as much as I can. Sometimes it has not been possible, or possible in a desired time frame, or for a desired amount of money...some places put caps per day/week.

I have used "auto payments" for regular bills (credit cards, mortgage, utilities, insurance, etc) beginning around 30 years ago and have never ever had a problem.

As one person put it, "Even today I am more concerned about my bills getting paid on time than I am about my accounts being hacked." Ditto.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 1:57 pm

JohnFiscal wrote:
Tue Sep 19, 2017 1:46 pm
I've used "push" a few times when transferring money around. It makes me feel a bit edgy as I may not be entirely positively confident that it's going to get pushed into the right place. So when I transfer my own cash around between my own accounts I use "pull" as much as I can. Sometimes it has not been possible, or possible in a desired time frame, or for a desired amount of money...some places put caps per day/week.

I have used "auto payments" for regular bills (credit cards, mortgage, utilities, insurance, etc) beginning around 30 years ago and have never ever had a problem.

As one person put it, "Even today I am more concerned about my bills getting paid on time than I am about my accounts being hacked." Ditto.
Thanks for the feedback. I didn't know autopay existed 30 years ago - back then it was all paper statements and checks I thought.

User avatar
AAA
Posts: 817
Joined: Sat Jan 12, 2008 8:56 am

Re: Online Bill Pay Security: Push or Pull?

Post by AAA » Tue Sep 19, 2017 2:00 pm

I've given various entities (credit card company, Vanguard, etc.) my bank numbers and they take the money out when I go on their website and "pay bill" or do a "buy" of a fund. Others, such as the utility company, do it automatically without my intervention.

It's occurred to me that I never gave my bank explicit permission to do these transactions so I've wondered about the potential for fraud. What's to stop anyone from using the routing and account numbers (on every check I write) to do a withdrawal from my bank? How does the bank know it's a legitimate withdrawal if they never asked me?

open_circuit
Posts: 65
Joined: Thu Mar 30, 2017 9:20 am

Re: Online Bill Pay Security: Push or Pull?

Post by open_circuit » Tue Sep 19, 2017 2:04 pm

AAA wrote:
Tue Sep 19, 2017 2:00 pm
I've given various entities (credit card company, Vanguard, etc.) my bank numbers and they take the money out when I go on their website and "pay bill" or do a "buy" of a fund. Others, such as the utility company, do it automatically without my intervention.

It's occurred to me that I never gave my bank explicit permission to do these transactions so I've wondered about the potential for fraud. What's to stop anyone from using the routing and account numbers (on every check I write) to do a withdrawal from my bank? How does the bank know it's a legitimate withdrawal if they never asked me?
They don't know. That's why I (and many previous posters) do not prefer to allow automatic pull transactions from most companies. Fraudulent automatic charges to credit cards are a much easier problem to solve than fraudulent (or simply mistaken) pulls from your bank account.

Dottie57
Posts: 2107
Joined: Thu May 19, 2016 5:43 pm

Re: Online Bill Pay Security: Push or Pull?

Post by Dottie57 » Tue Sep 19, 2017 2:10 pm

DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am
open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
A co-worker was glad he didn't have pull from his account for his electric bill. They erroneously billed him (and everyone else in the town). The amount was 1000 times the actual amount due. Caused some consternation.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 2:24 pm

Dottie57 wrote:
Tue Sep 19, 2017 2:10 pm
DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am
open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
A co-worker was glad he didn't have pull from his account for his electric bill. They erroneously billed him (and everyone else in the town). The amount was 1000 times the actual amount due. Caused some consternation.
Pull doesn't (necessarily) mean automatic. I review all my bills before I pay them. If you set up auto-payment for billed amounts you could have a problem regardless of whether it is a pull or a push if you aren't paying attention.

User avatar
AAA
Posts: 817
Joined: Sat Jan 12, 2008 8:56 am

Re: Online Bill Pay Security: Push or Pull?

Post by AAA » Tue Sep 19, 2017 2:34 pm

open_circuit wrote:
Tue Sep 19, 2017 2:04 pm
AAA wrote:
Tue Sep 19, 2017 2:00 pm
It's occurred to me that I never gave my bank explicit permission to do these transactions so I've wondered about the potential for fraud. What's to stop anyone from using the routing and account numbers (on every check I write) to do a withdrawal from my bank? How does the bank know it's a legitimate withdrawal if they never asked me?
They don't know. That's why I (and many previous posters) do not prefer to allow automatic pull transactions from most companies. Fraudulent automatic charges to credit cards are a much easier problem to solve than fraudulent (or simply mistaken) pulls from your bank account.
You say you don't prefer to allow automatic pull transactions from most companies. If it's not automatic, i.e., you go on the credit card website and do a "pay bill," does the credit card company show the bank some sort of documentation that you initiated the transfer of funds? If not, how is that different from an automatic pull?

goingup
Posts: 2705
Joined: Tue Jan 26, 2010 1:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by goingup » Tue Sep 19, 2017 2:38 pm

I only push. Not willing to give any payee access to our checking accounts.

KlangFool
Posts: 6732
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool » Tue Sep 19, 2017 2:45 pm

DaftInvestor wrote:
Tue Sep 19, 2017 2:24 pm
Dottie57 wrote:
Tue Sep 19, 2017 2:10 pm
DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am
open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
A co-worker was glad he didn't have pull from his account for his electric bill. They erroneously billed him (and everyone else in the town). The amount was 1000 times the actual amount due. Caused some consternation.
Pull doesn't (necessarily) mean automatic. I review all my bills before I pay them. If you set up auto-payment for billed amounts you could have a problem regardless of whether it is a pull or a push if you aren't paying attention.
DaftInvestor,

By keeping your bank account information in so many places, all it takes is for one of them to be hacked and your bank information is available for someone else.

<< I review all my bills before I pay them. >>

As soon as someone has your bank account information, they could take money out of your bank account. They do not need your permission. It is up to you to chase the money back after it is gone.

KlangFool

open_circuit
Posts: 65
Joined: Thu Mar 30, 2017 9:20 am

Re: Online Bill Pay Security: Push or Pull?

Post by open_circuit » Tue Sep 19, 2017 2:47 pm

AAA wrote:
Tue Sep 19, 2017 2:34 pm
open_circuit wrote:
Tue Sep 19, 2017 2:04 pm
AAA wrote:
Tue Sep 19, 2017 2:00 pm
It's occurred to me that I never gave my bank explicit permission to do these transactions so I've wondered about the potential for fraud. What's to stop anyone from using the routing and account numbers (on every check I write) to do a withdrawal from my bank? How does the bank know it's a legitimate withdrawal if they never asked me?
They don't know. That's why I (and many previous posters) do not prefer to allow automatic pull transactions from most companies. Fraudulent automatic charges to credit cards are a much easier problem to solve than fraudulent (or simply mistaken) pulls from your bank account.
You say you don't prefer to allow automatic pull transactions from most companies. If it's not automatic, i.e., you go on the credit card website and do a "pay bill," does the credit card company show the bank some sort of documentation that you initiated the transfer of funds? If not, how is that different from an automatic pull?
Only different in that I am specifying an amount and transaction date. Fully automated pulls will be for whatever amount the payee decides to pull. This should be the billed amount. I want to avoid the situation Dottie57 described, of an incorrect amount billed and then subsequently pulled. Of course there could still be an error with a "manual" pull request, though that seems less likely than a general billing error.

I'd prefer to give no one electronic access via ACH to my accounts, but that is not always a practical solution. I choose to minimize the number of places where that happens as an imperfect compromise.

KlangFool
Posts: 6732
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool » Tue Sep 19, 2017 2:50 pm

AAA wrote:
Tue Sep 19, 2017 2:34 pm
open_circuit wrote:
Tue Sep 19, 2017 2:04 pm
AAA wrote:
Tue Sep 19, 2017 2:00 pm
It's occurred to me that I never gave my bank explicit permission to do these transactions so I've wondered about the potential for fraud. What's to stop anyone from using the routing and account numbers (on every check I write) to do a withdrawal from my bank? How does the bank know it's a legitimate withdrawal if they never asked me?
They don't know. That's why I (and many previous posters) do not prefer to allow automatic pull transactions from most companies. Fraudulent automatic charges to credit cards are a much easier problem to solve than fraudulent (or simply mistaken) pulls from your bank account.
You say you don't prefer to allow automatic pull transactions from most companies. If it's not automatic, i.e., you go on the credit card website and do a "pay bill," does the credit card company show the bank some sort of documentation that you initiated the transfer of funds? If not, how is that different from an automatic pull?
AAA,

1) I initiate the payment from the bank online bill payment system to pay the credit card. It is a "push" from the bank system. I do not go to the credit card website.

2) For bills that allowed credit card payment, I allow the bill to pull the payment from the credit card. I do not go to the credit card website either.

KlangFool

User avatar
AAA
Posts: 817
Joined: Sat Jan 12, 2008 8:56 am

Re: Online Bill Pay Security: Push or Pull?

Post by AAA » Tue Sep 19, 2017 2:53 pm

open_circuit wrote:
Tue Sep 19, 2017 2:47 pm
I'd prefer to give no one electronic access via ACH to my accounts, but that is not always a practical solution. I choose to minimize the number of places where that happens as an imperfect compromise.
I see, but I'm back to my original question. What's to stop anyone from using the information printed on someone's check to do an ACH withdrawal from their account, if ACH withdrawals by companies (whether automatic or not) are done without the bank getting our explicit permission to do the withdrawal?

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 3:36 pm

AAA wrote:
Tue Sep 19, 2017 2:53 pm
open_circuit wrote:
Tue Sep 19, 2017 2:47 pm
I'd prefer to give no one electronic access via ACH to my accounts, but that is not always a practical solution. I choose to minimize the number of places where that happens as an imperfect compromise.
I see, but I'm back to my original question. What's to stop anyone from using the information printed on someone's check to do an ACH withdrawal from their account, if ACH withdrawals by companies (whether automatic or not) are done without the bank getting our explicit permission to do the withdrawal?
I've always wondered this too. With folks that right a lot of paper checks (think of the older women holding up the line at the grocery store) passing through so many hands there seems like a lot of risk of that happening - certainly more so than the fact that Chase-bank might have my bank information on their secure site. I do know that with "certain" transfers names need to match otherwise more information might be requested. Otherwise - I suppose fraud can be difficult because there is an easy money-trail to follow.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 3:42 pm

KlangFool wrote:
Tue Sep 19, 2017 2:45 pm
DaftInvestor wrote:
Tue Sep 19, 2017 2:24 pm
Dottie57 wrote:
Tue Sep 19, 2017 2:10 pm
DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am
open_circuit wrote:
Tue Sep 19, 2017 10:13 am
Combination of both for me. I pay utility bills, mortgage, and a few others with push from my checking account. I pay credit cards with a pull from a checking account. I only automatically pay my mortgage. Credit cards, utilities, and others only get paid after I review the bill and/or reconcile the statements. I prefer push payments for security, but pulls on the credit card payments are a compromise I've made so I can be sure payments are applied on the day I specify.
When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
A co-worker was glad he didn't have pull from his account for his electric bill. They erroneously billed him (and everyone else in the town). The amount was 1000 times the actual amount due. Caused some consternation.
Pull doesn't (necessarily) mean automatic. I review all my bills before I pay them. If you set up auto-payment for billed amounts you could have a problem regardless of whether it is a pull or a push if you aren't paying attention.
DaftInvestor,

By keeping your bank account information in so many places, all it takes is for one of them to be hacked and your bank information is available for someone else.

<< I review all my bills before I pay them. >>

As soon as someone has your bank account information, they could take money out of your bank account. They do not need your permission. It is up to you to chase the money back after it is gone.

KlangFool
Thanks KlangFool - this is a good point. Regarding the pull and having my bank info with some credit-card company systems - I worry of the opposite too though - if ALL my credit cards are stored at my bank - it would only take one hack to have all my credit cards data - then I wouldn't have a single one left to use (thinking of if I am traveling internationally or something) - thus my hybrid approach. Yes - the credit cards are easier to dispute and replace than tracking down bank fraud - but I don't like the idea of having all my accounts grabbed all at the same time.

There is one vendor whereby my wife still writes a paper-check - I don't like that since that papercheck might sit on the person's desk in an open environment where anyone can grab our Account Number and Name. I've also written checks to someone like a plumber that comes for a weekend emergency - same fear of account number there.

KlangFool
Posts: 6732
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool » Tue Sep 19, 2017 4:11 pm

DaftInvestor wrote:
Tue Sep 19, 2017 3:42 pm
KlangFool wrote:
Tue Sep 19, 2017 2:45 pm
DaftInvestor wrote:
Tue Sep 19, 2017 2:24 pm
Dottie57 wrote:
Tue Sep 19, 2017 2:10 pm
DaftInvestor wrote:
Tue Sep 19, 2017 10:26 am

When you say "I prefer push payments for security" what do you mean by this? Sounds like you are inferring a push is more secure?
A co-worker was glad he didn't have pull from his account for his electric bill. They erroneously billed him (and everyone else in the town). The amount was 1000 times the actual amount due. Caused some consternation.
Pull doesn't (necessarily) mean automatic. I review all my bills before I pay them. If you set up auto-payment for billed amounts you could have a problem regardless of whether it is a pull or a push if you aren't paying attention.
DaftInvestor,

By keeping your bank account information in so many places, all it takes is for one of them to be hacked and your bank information is available for someone else.

<< I review all my bills before I pay them. >>

As soon as someone has your bank account information, they could take money out of your bank account. They do not need your permission. It is up to you to chase the money back after it is gone.

KlangFool
Thanks KlangFool - this is a good point. Regarding the pull and having my bank info with some credit-card company systems - I worry of the opposite too though - if ALL my credit cards are stored at my bank - it would only take one hack to have all my credit cards data - then I wouldn't have a single one left to use (thinking of if I am traveling internationally or something) - thus my hybrid approach. Yes - the credit cards are easier to dispute and replace than tracking down bank fraud - but I don't like the idea of having all my accounts grabbed all at the same time.

There is one vendor whereby my wife still writes a paper-check - I don't like that since that papercheck might sit on the person's desk in an open environment where anyone can grab our Account Number and Name. I've also written checks to someone like a plumber that comes for a weekend emergency - same fear of account number there.
DaftInvestor,

<<Regarding the pull and having my bank info with some credit-card company systems - I worry of the opposite too though - if ALL my credit cards are stored at my bank - it would only take one hack to have all my credit cards data - >>

I do not worry about that. I have to change my credit card about 3 to 4 times last year. There are more places for your credit card information to be abused. Any time that you use your credit card, someone could steal that information.

I use one credit card (A) for all my recurring bills. Then, I use another card (B) for all other purchases. I have to change card (B) about 3 to 4 times last year.

KlangFool

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 4:16 pm

KlangFool wrote:
Tue Sep 19, 2017 4:11 pm

I use one credit card (A) for all my recurring bills. Then, I use another card (B) for all other purchases. I have to change card (B) about 3 to 4 times last year.

KlangFool
3 to 4 times per year seems excessive. I only have a card get compromised once every 3 or 4 years (and I charge everything I can and do a lot of on-line shopping).

If you have your card (A) and your card (B) and a perhaps third card (C) that is a back-up card that you don't normally use, and have them ALL stored within your banks ebill-pay system - you aren't concerned that they might all be stolen at once (from the bank) while you are traveling abroad and need at least one of them to work?

KlangFool
Posts: 6732
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool » Tue Sep 19, 2017 4:22 pm

DaftInvestor wrote:
Tue Sep 19, 2017 4:16 pm
KlangFool wrote:
Tue Sep 19, 2017 4:11 pm

I use one credit card (A) for all my recurring bills. Then, I use another card (B) for all other purchases. I have to change card (B) about 3 to 4 times last year.

KlangFool
3 to 4 times per year seems excessive. I only have a card get compromised once every 3 or 4 years (and I charge everything I can and do a lot of on-line shopping).

If you have your card (A) and your card (B) and a perhaps third card (C) that is a back-up card that you don't normally use, and have them ALL stored within your banks ebill-pay system - you aren't concerned that they might all be stolen at once (from the bank) while you are traveling abroad and need at least one of them to work?
DaftInvestor,

1) Why would people hacked into the bank system when they have an easier target like the retailers?

2) As per all the cybersecurity studies that I had seen, the financial companies have better security than most other companies.

<< you aren't concerned that they might all be stolen at once (from the bank) while you are traveling abroad and need at least one of them to work?>>

3) It is not a concern for me. If it comes down to this, I will contact my friend and family in that country.

KlangFool

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 4:53 pm

KlangFool wrote:
Tue Sep 19, 2017 4:22 pm
DaftInvestor wrote:
Tue Sep 19, 2017 4:16 pm
KlangFool wrote:
Tue Sep 19, 2017 4:11 pm

I use one credit card (A) for all my recurring bills. Then, I use another card (B) for all other purchases. I have to change card (B) about 3 to 4 times last year.

KlangFool
3 to 4 times per year seems excessive. I only have a card get compromised once every 3 or 4 years (and I charge everything I can and do a lot of on-line shopping).

If you have your card (A) and your card (B) and a perhaps third card (C) that is a back-up card that you don't normally use, and have them ALL stored within your banks ebill-pay system - you aren't concerned that they might all be stolen at once (from the bank) while you are traveling abroad and need at least one of them to work?
DaftInvestor,

1) Why would people hacked into the bank system when they have an easier target like the retailers?

2) As per all the cybersecurity studies that I had seen, the financial companies have better security than most other companies.

<< you aren't concerned that they might all be stolen at once (from the bank) while you are traveling abroad and need at least one of them to work?>>

3) It is not a concern for me. If it comes down to this, I will contact my friend and family in that country.

KlangFool
Makes sense - much appreciated.

DrGoogle2017
Posts: 292
Joined: Mon Aug 14, 2017 12:31 pm

Re: Online Bill Pay Security: Push or Pull?

Post by DrGoogle2017 » Tue Sep 19, 2017 5:56 pm

I only push. This way I control when and who gets paid. Plus I can see outgoing vs my bank balance. Security problem, banks have to deal with it.

downshiftme
Posts: 954
Joined: Sun Mar 11, 2007 6:11 pm

Re: Online Bill Pay Security: Push or Pull?

Post by downshiftme » Tue Sep 19, 2017 6:31 pm

I'm 100% 'push' from my bank checking account because I don't want anyone 'pulling' money out of it without me authorizing the specific transaction and amount.
I only do PUSH as well. If something goes wrong, a bill may not get credited in time or I may owe an outstanding balance. These are minor inconveniences.

When I allow a pull, if something goes wrong, they have my money, my account may be overdrawn, other bill pay may fail due to insufficient funds in the account. These could be much larger problems. In cases of dispute, they will keep pulling, which can also be a problem.

With my 100% push approach, I have only one place to go to setup additional bill pay, and only one place to go to edit or stop payments. I don't need separate accounts at every credit card or other bill I might want to pay. Also all the records are in one convenient place. If I order a bill paid and the payment isn't credited, I have strong evidence in bank records that it was paid. If there really was a problem, the bank bill pay department will help investigate and resolve any discrepancy. In some cases, they will even compensate for late fees. If a pull fails to get credited, all the bank can say is that someone took the money. The pulling company seems a lot less concerned about finding out what went wrong and a lot more inclined to just argue that I have to pay them now.

gkaplan
Posts: 7034
Joined: Sat Mar 03, 2007 8:34 pm
Location: Portland, Oregon

Re: Online Bill Pay Security: Push or Pull?

Post by gkaplan » Tue Sep 19, 2017 6:32 pm

I only push, so I am in control. Vonage does require a pull. I cannot think of another payee that does.
Gordon

MnD
Posts: 3055
Joined: Mon Jan 14, 2008 12:41 pm

Re: Online Bill Pay Security: Push or Pull?

Post by MnD » Tue Sep 19, 2017 7:42 pm

For everything possible, autopay in full pull charge to one of 4 credit cards to maximize points/cash back.
Then funnel those four credit card payments (from blue-chip CC issuing banks) as Autopay in full statement balance on the due date pull from checking. All due dates set/adjusted to the same date as much as possible. Makes a nice clean monthly financial close.
Only payment that doesn't take credit cards is gas/electric utility which is the 5th pull from checking.

Not worried about having an illusion of "control" with push approach.
Been doing this for as long as it's been offered and never a problem.
The CC issuing banks I use are as trustworthy/reliable as my bank - probably a bit more.
And their software is certainly more reliable/accurate than me pushing bills every month.

User avatar
DaftInvestor
Posts: 2947
Joined: Wed Feb 19, 2014 10:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by DaftInvestor » Tue Sep 19, 2017 7:54 pm

MnD wrote:
Tue Sep 19, 2017 7:42 pm
For everything possible, autopay in full pull charge to one of 4 credit cards to maximize points/cash back.
Then funnel those four credit card payments (from blue-chip CC issuing banks) as Autopay in full statement balance on the due date pull from checking. All due dates set/adjusted to the same date as much as possible. Makes a nice clean monthly financial close.
Only payment that doesn't take credit cards is gas/electric utility which is the 5th pull from checking.

Not worried about having an illusion of "control" with push approach.
Been doing this for as long as it's been offered and never a problem.
The CC issuing banks I use are as trustworthy/reliable as my bank - probably a bit more.
And their software is certainly more reliable/accurate than me pushing bills every month.
Thanks Mnd for the feedback. I have always pushed to the utilities - I don't trust their security (even though they likely outsource Bill collection), at least not as much as my CCs. While you've never had a problem with them to date, until a couple of weeks ago we never had a problem with the CRAs either ;) in any case - the feedback is much appreciated. It's been interesting to me the nearly equally respondents of those that push and those that pull.

User avatar
tfb
Posts: 7707
Joined: Mon Feb 19, 2007 5:46 pm
Contact:

Re: Online Bill Pay Security: Push or Pull?

Post by tfb » Tue Sep 19, 2017 8:08 pm

Pull is more secure.

In the ACH system, whoever initiates, whether push or pull, takes the responsibility. When you set up as pull, the biller is responsible. If the amount is wrong or an unauthorized party pulled from you, you can always dispute it. Even if thieves steal your bank account information and perform a pull, you can still dispute it (assuming you have a consumer bank account, not a business bank account). In contrast, if you push, you take the responsibility. If you push to the wrong account, the bank is not obligated to get your money back.
Harry Sit, taking a break from the forums.

sport
Posts: 5969
Joined: Tue Feb 27, 2007 3:26 pm
Location: Cleveland, OH

Re: Online Bill Pay Security: Push or Pull?

Post by sport » Tue Sep 19, 2017 8:43 pm

Due to a mixup, I once received a water bill for more than $3000. This is a huge error, considering the low water rates we have being next to Lake Erie. It took the water dept. about a year to get things straightened out. I would not want to have that kind of bill pulled from my account and try to get it corrected.

JBTX
Posts: 1269
Joined: Wed Jul 26, 2017 12:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by JBTX » Tue Sep 19, 2017 9:01 pm

I am pretty much 100% pull. I have most set up on credit cards. Obviously the credit cards pull from bank. I've been doing this at least 20 years and never had a problem.

Eurookat
Posts: 230
Joined: Sat Nov 29, 2014 1:44 pm

Re: Online Bill Pay Security: Push or Pull?

Post by Eurookat » Tue Sep 19, 2017 9:20 pm

I do a push for everything except for our credit cards. I want to make sure they have the payment on record and I save the transaction id just in case.

I also don't do auto pay as a pull. I don't trust any merchant to take out the correct amount. AIG screwed me over once by deducting more than a months worth of payment for my life insurance. Never again.

Eurookat
Posts: 230
Joined: Sat Nov 29, 2014 1:44 pm

Re: Online Bill Pay Security: Push or Pull?

Post by Eurookat » Tue Sep 19, 2017 9:22 pm

sport wrote:
Tue Sep 19, 2017 8:43 pm
Due to a mixup, I once received a water bill for more than $3000. This is a huge error, considering the low water rates we have being next to Lake Erie. It took the water dept. about a year to get things straightened out. I would not want to have that kind of bill pulled from my account and try to get it corrected.
This. There was an error on AIG's part where they took out multiple payments to cover previous months. Luckily I had enough money to cover the amount but from then on, I never let any merchant do an auto-debit unless I get a kick back like a lower interest rate.

KlangFool
Posts: 6732
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool » Tue Sep 19, 2017 9:26 pm

Eurookat wrote:
Tue Sep 19, 2017 9:20 pm
I do a push for everything except for our credit cards. I want to make sure they have the payment on record and I save the transaction id just in case.

I also don't do auto pay as a pull. I don't trust any merchant to take out the correct amount. AIG screwed me over once by deducting more than a months worth of payment for my life insurance. Never again.
Eurookat,

I do "push" on my credit card too. I automatically push a small amount every month to meet the minimum payment. Then, I did a manual "push" for the remaining amount.

KlangFool

Marylander1
Posts: 84
Joined: Sat Jan 04, 2014 3:18 pm
Location: Baltimore & DC

Re: Online Bill Pay Security: Push or Pull?

Post by Marylander1 » Tue Sep 19, 2017 9:44 pm

The only bill I allow to pull is at an entity where I know the CFO. If there were a problem, I'm confident I could visit him within hours to sort it out.

I push for all others. I once received a water bill exceeding $18,000. More than once my credit card bill has included large bogus charges. I don't want those to automatically pull arbitrary amounts from my bank account, as that could cause other payments to fail and suddenly I'd be on the hook for fees to other creditors and payment mayhem could spread far and fast. I haven't missed a payment in years, and would rather run the risk of a single payment failing than a slew of them failing as I try to claw back thousands of dollars erroneously pulled from my account.

Finally, when I had to resolve a relative's estate, recurring auto-payments kept failing after my relative died but before I had legal ability to control the account. Cleaning up thousands of dollars in fees from PNC Bank that accrued after death was a royal mess and required repeated escalation with a lawyer's help. Push would have provided a single location to stop the problem from getting worse, rather than the whack-a-mole having to track down each account that could conceivably tap into the checking account.

-Marylander1

Post Reply