Online Bill Pay Security: Push or Pull?

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills.
User avatar
Frugal Al
Posts: 1736
Joined: Fri May 28, 2010 10:09 am

Re: Online Bill Pay Security: Push or Pull?

Post by Frugal Al »

I only push using my bank's online bill pay. Pushing though the ACH system is much safer than allowing pulls or writing a checks: https://wallethub.com/edu/ach-payment/11932/
ddurrett896
Posts: 1712
Joined: Wed Nov 05, 2014 2:23 pm

Re: Online Bill Pay Security: Push or Pull?

Post by ddurrett896 »

When it comes to online payment, I'm pretty tight.

I keep bill pay checking account at $0 and turned off the ability to default to another account if an overdraft happens. When I go to pay bills, I move only the money needed and then pay.
User avatar
JPH
Posts: 1427
Joined: Mon Jun 27, 2011 8:56 pm

Re: Online Bill Pay Security: Push or Pull?

Post by JPH »

I think I use what is being called "Push," but it seems like there are two different methods to do it, which really involve them "Pulling" money from my account. With my electric bill, I log into their site and authorize them to "Pull" money from my account using the bank routing number that they have on file for me. With my water bill, they will not store my routing number on their system, and I must enter it with my account number each month. Then they "Pull" money from my account. This has the apparent advantage on not storing the information but forces me to transmit that information multiple times, which is another sort of risk. The third alternative is to have the utility company store my information and "Pull" the correct amount from my account without my intervention. I don't use this method because I like to approve the amount. However, after reading this thread I'm pretty confused. I'm losing my grip on what it means to truly "Push."
While the moments do summersaults into eternity | Cling to their coattails and beg them to stay - Townes Van Zandt
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

JPH wrote: Wed Sep 20, 2017 7:26 am I think I use what is being called "Push," but it seems like there are two different methods to do it, which really involve them "Pulling" money from my account. With my electric bill, I log into their site and authorize them to "Pull" money from my account using the bank routing number that they have on file for me. With my water bill, they will not store my routing number on their system, and I must enter it with my account number each month. Then they "Pull" money from my account. This has the apparent advantage on not storing the information but forces me to transmit that information multiple times, which is another sort of risk. The third alternative is to have the utility company store my information and "Pull" the correct amount from my account without my intervention. I don't use this method because I like to approve the amount. However, after reading this thread I'm pretty confused. I'm losing my grip on what it means to truly "Push."
If you log into your bank they likely have an "ebill/epay" section. This is where you go to truly "push" transactions. You don't do ANYTHING on your utilities website. Most utilities support ebill which means that from your banks site - you can enter your account number and the bill is literally pulled into your banks epay (they may call it something different at your bank) portal. From your banks site you see the bill and you pay it - this is what we are referring to as a push (versus "pulling" it from the other side - the utility side). If you bank isn't able to pull the ebill form the utility you can still push a payment by logging into your utility web-site - seeing what the amount due is - and then returning to your banks website to "push" the payment over. This way you are never providing your utility payment web site with your routing number and bank account.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

DaftInvestor wrote:I worry of the opposite too though - if ALL my credit cards are stored at my bank - it would only take one hack to have all my credit cards data - then I wouldn't have a single one left to use (thinking of if I am traveling internationally or something) - thus my hybrid approach. Yes - the credit cards are easier to dispute and replace than tracking down bank fraud - but I don't like the idea of having all my accounts grabbed all at the same time.
I don't think hackers in your bank account would be able to steal enough info for your credit cards to do any damage. The only info I give to my bank ebill system for pushes is credit card numbers and addresses for payments. Thieves would also need expiration dates and 3/4-digit codes on credit cards to make use of them.

On the other hand, stealing your bank info from some company is apparently enough info to withdraw money from your account (after all, the company itself does it). And as others said, credit cards provide explicit protections for fraud charges; much more so than banks. So I would not want my bank account numbers to be stored anywhere. (And I don't use checks for the most part either.)
Last edited by learning_head on Wed Sep 20, 2017 8:36 am, edited 2 times in total.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

tfb wrote: Tue Sep 19, 2017 8:08 pmIn the ACH system, whoever initiates, whether push or pull, takes the responsibility. When you set up as pull, the biller is responsible. If the amount is wrong or an unauthorized party pulled from you, you can always dispute it. Even if thieves steal your bank account information and perform a pull, you can still dispute it (assuming you have a consumer bank account, not a business bank account).
tfb, do you happen to know what, if anything, prevents if a thief from pulling from your bank account via ACH if they know your routing and acct number?

How do you go about disputing this with some bank you never heard of?
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

Frugal Al wrote: Wed Sep 20, 2017 6:56 am I only push using my bank's online bill pay. Pushing though the ACH system is much safer than allowing pulls or writing a checks: https://wallethub.com/edu/ach-payment/11932/
Thanks for providing this link! Very good overview.
JohnFiscal
Posts: 1113
Joined: Mon Jan 06, 2014 3:28 pm
Location: US citizen now retired in Canada. Subject to income tax in both.

Re: Online Bill Pay Security: Push or Pull?

Post by JohnFiscal »

I already replied but let me add that I really want the convenience of "automatic payment". I don't know if that is part of the whole push/pull systems. The "auto pay" thing started before there was a commercial internet. Now with the commercial internet there is the thing of logging in and pushing or pulling your payments. But I really don't want to have to log in to pay the freakin' things. I want it to be automatic. And I will keep track of it all in my Excel spreadsheet.

I was about the last person in my office to go to "direct deposit" of my paycheck around 1988. But when I discovered the convenience I went in whole hog and have appreciated "automatic" ever since, and have not had any problems.
User avatar
flamesabers
Posts: 1848
Joined: Fri Mar 03, 2017 11:05 am
Location: Rochester, MN

Re: Online Bill Pay Security: Push or Pull?

Post by flamesabers »

sport wrote: Tue Sep 19, 2017 8:43 pm Due to a mixup, I once received a water bill for more than $3000. This is a huge error, considering the low water rates we have being next to Lake Erie. It took the water dept. about a year to get things straightened out. I would not want to have that kind of bill pulled from my account and try to get it corrected.
With the exception of rent, (which I pay with a pull that I initiate manually) I pay all of my bills with my credit card. With my utility bill I get an email beforehand that states the amount of my monthly bill.
KlangFool wrote: Tue Sep 19, 2017 2:45 pm As soon as someone has your bank account information, they could take money out of your bank account. They do not need your permission. It is up to you to chase the money back after it is gone.
Regardless of how you pay your bills, I think this is a very good reason to not keep large sums of cash in your checking account any longer then necessary.
User avatar
tfb
Posts: 8397
Joined: Mon Feb 19, 2007 4:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by tfb »

learning_head wrote: Wed Sep 20, 2017 8:09 am tfb, do you happen to know what, if anything, prevents if a thief from pulling from your bank account via ACH if they know your routing and acct number?

How do you go about disputing this with some bank you never heard of?
In a 4-party system, you, your bank, they, their bank, when they initiate the pull, their bank is responsible. So banks are very careful in initiating ACH pulls on behalf of unproven businesses. The security is not placed in the routing number and account number themselves. It's in who can do something with those numbers.

You dispute unauthorized debits with your own bank. Your bank disputes it with the thieves' bank. The thieves' bank has to eat it if they don't have enough of a reserve from the thieves.
Harry Sit has left the forums.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

JohnFiscal wrote: Wed Sep 20, 2017 9:06 am I already replied but let me add that I really want the convenience of "automatic payment". I don't know if that is part of the whole push/pull systems. The "auto pay" thing started before there was a commercial internet. Now with the commercial internet there is the thing of logging in and pushing or pulling your payments. But I really don't want to have to log in to pay the freakin' things. I want it to be automatic. And I will keep track of it all in my Excel spreadsheet.

I was about the last person in my office to go to "direct deposit" of my paycheck around 1988. But when I discovered the convenience I went in whole hog and have appreciated "automatic" ever since, and have not had any problems.
Thanks John for contributing to the thread. To me the question of whether or not to use "auto-pay" is almost a separate topic since you can set it up on either side in many (but not all) cases. For my utility bills I can pull ebills into my bank and have my bank auto-pay them; or I can log into the utilities websites and provide my account/routing info and have the utilities auto-pay themselves with a pull. In cases where the utilities take a Credit-Card without a large "processing fee" it seems a no-brainer to allow them to pull from a Credit Card - but in cases of most of my utilities - this isn't the case.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

tfb wrote: Wed Sep 20, 2017 9:25 am
learning_head wrote: Wed Sep 20, 2017 8:09 am tfb, do you happen to know what, if anything, prevents if a thief from pulling from your bank account via ACH if they know your routing and acct number?

How do you go about disputing this with some bank you never heard of?
In a 4-party system, you, your bank, they, their bank, when they initiate the pull, their bank is responsible. So banks are very careful in initiating ACH pulls on behalf of unproven businesses. The security is not placed in the routing number and account number themselves. It's in who can do something with those numbers.

You dispute unauthorized debits with your own bank. Your bank disputes it with the thieves' bank. The thieves' bank has to eat it if they don't have enough of a reserve from the thieves.
Thanks tfb for jumping in and participating in this thread (especially since you have the alternative view from many others - that a pull is better).
In the one case that I had a problem many years ago, my Credit Card pulled a payment twice. I called the Credit Card and they said it appeared I put in two requests (it could have been a browser issue) and their was nothing they could do to resolve it (e.g. they couldn't put the money back in my bank account). I called my bank and they said their was nothing they could do to pull the money back once it was transfered. At the end of the day - I just left it alone (let the credit sit there and go towards next months bill). In your experience/knowledge - should my bank have been able to undo this charge? Its a little different than the "thief" case in that it was something I had authorized (although only once).
User avatar
tfb
Posts: 8397
Joined: Mon Feb 19, 2007 4:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by tfb »

DaftInvestor wrote: Wed Sep 20, 2017 9:42 am In the one case that I had a problem many years ago, my Credit Card pulled a payment twice. I called the Credit Card and they said it appeared I put in two requests (it could have been a browser issue) and their was nothing they could do to resolve it (e.g. they couldn't put the money back in my bank account). I called my bank and they said their was nothing they could do to pull the money back once it was transfered. At the end of the day - I just left it alone (let the credit sit there and go towards next months bill). In your experience/knowledge - should my bank have been able to undo this charge? Its a little different than the "thief" case in that it was something I had authorized (although only once).
Yes if you dispute it the duplicate as an unauthorized debit. A customer service rep at a call center may have given you the bad information. If you talk to a branch manager or use the right terminology you will have it reversed.
Harry Sit has left the forums.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

tfb wrote: Wed Sep 20, 2017 9:25 am
learning_head wrote: Wed Sep 20, 2017 8:09 am tfb, do you happen to know what, if anything, prevents if a thief from pulling from your bank account via ACH if they know your routing and acct number?

How do you go about disputing this with some bank you never heard of?
In a 4-party system, you, your bank, they, their bank, when they initiate the pull, their bank is responsible. So banks are very careful in initiating ACH pulls on behalf of unproven businesses. The security is not placed in the routing number and account number themselves. It's in who can do something with those numbers.

You dispute unauthorized debits with your own bank. Your bank disputes it with the thieves' bank. The thieves' bank has to eat it if they don't have enough of a reserve from the thieves.
I am afraid your own bank will just say as far as they are concerned you allowed unauthorized debits from the other bank and I should take it up with them (esp, if I did not notice this withdrawal within N days). Is that not the case?

If thieves have my bank accounts info, my main concern would be if they also have my identity (e.g. via Equifax), setup bank account in my name online and ACH out funds from my accounts. Seems like it might be hard to prove it was not me.
KlangFool
Posts: 31427
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool »

flamesabers wrote: Wed Sep 20, 2017 9:07 am
sport wrote: Tue Sep 19, 2017 8:43 pm Due to a mixup, I once received a water bill for more than $3000. This is a huge error, considering the low water rates we have being next to Lake Erie. It took the water dept. about a year to get things straightened out. I would not want to have that kind of bill pulled from my account and try to get it corrected.
With the exception of rent, (which I pay with a pull that I initiate manually) I pay all of my bills with my credit card. With my utility bill I get an email beforehand that states the amount of my monthly bill.
flamesabers,

May I ask why do you pay with a pull? You could push your payment every month. Your rent payment should be a fixed amount at a fixed date every month.

KlangFool
30% VWENX | 16% VFWAX/VTIAX | 14.5% VTSAX | 19.5% VBTLX | 10% VSIAX/VTMSX/VSMAX | 10% VSIGX| 30% Wellington 50% 3-funds 20% Mini-Larry
User avatar
tfb
Posts: 8397
Joined: Mon Feb 19, 2007 4:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by tfb »

learning_head wrote: Wed Sep 20, 2017 10:01 am I am afraid your own bank will just say as far as they are concerned you allowed unauthorized debits from the other bank and I should take it up with them (esp, if I did not notice this withdrawal within N days). Is that not the case?

If thieves have my bank accounts info, my main concern would be if they also have my identity (e.g. via Equifax), setup bank account in my name online and ACH out funds from my accounts. Seems like it might be hard to prove it was not me.
Bank regulations make it so the banks can't just say what they want. The burden of proof is on the bank that initiated the pull. You have 60 days from the date of the statement to dispute unauthorized debits. This is why banks that initiate pulls do random deposits to prove that you have access to the other end. If they just initiate pulls out of the blue they take the risk of having to cough up the money when the other side disputes. It's also why some smaller credit unions don't offer ACH initiated by them or they set a very small daily limit.

P.S. Here's an ACH dispute form from a random credit union found online. Every bank has this.

https://www.figfcu.com/documents/ACH-Dispute-Form
Harry Sit has left the forums.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

tfb wrote: Wed Sep 20, 2017 10:13 am
learning_head wrote: Wed Sep 20, 2017 10:01 am I am afraid your own bank will just say as far as they are concerned you allowed unauthorized debits from the other bank and I should take it up with them (esp, if I did not notice this withdrawal within N days). Is that not the case?

If thieves have my bank accounts info, my main concern would be if they also have my identity (e.g. via Equifax), setup bank account in my name online and ACH out funds from my accounts. Seems like it might be hard to prove it was not me.
Bank regulations make it so the banks can't just say what they want. The burden of proof is on the bank that initiated the pull. You have 60 days from the date of the statement to dispute unauthorized debits. This is why banks that initiate pulls do random deposits to prove that you have access to the other end. If they just initiate pulls out of the blue they take the risk of having to cough up the money when the other side disputes. It's also why some smaller credit unions don't offer ACH initiated by them or they set a very small daily limit.

P.S. Here's an ACH dispute form from a random credit union found online. Every bank has this.

https://www.figfcu.com/documents/ACH-Dispute-Form
> You have 60 days from the date of the statement to dispute unauthorized debits.

And you are on the hook for $500 in that case too (according to very nice link posted earlier). After 60 days, too bad I guess - at least there is no obligation to return your money... ?

> The burden of proof is on the bank that initiated the pull.

That's why I suspect you may end up having to deal with some unknown bank you never heard of (e.g. US branch of some Ukranian bank); not your bank.

> This is why banks that initiate pulls do random deposits to prove that you have access to the other end.

A few times I opened new accounts, they allowed me to fund it right away by supplying ACH info; without first doing initial deposits.

P.S. I imagine govt should require banks to allow customers establish an ACH debit block / thaw for consumer accounts (already available for business ones!), similar to credit freeze / thaw.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

tfb, learning_head,
I really appreciate the debate you two are having as it exposes exactly the conundrum I was having. The link to the article from 2015 is interesting - but it just scratches the surface - and - in this day and age - I question anything more than a year old. Before I posted the question and started this thread I did a bunch of google searches. What I found were many very old articles and then a few conflicting articles - thus the question. The varying responses I've been getting seem to mirror my own thoughts and indecision of what methods to take. Thank you both for contributing to this discussion/debate.
KlangFool
Posts: 31427
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool »

learning_head wrote: Wed Sep 20, 2017 10:34 am
tfb wrote: Wed Sep 20, 2017 10:13 am
learning_head wrote: Wed Sep 20, 2017 10:01 am I am afraid your own bank will just say as far as they are concerned you allowed unauthorized debits from the other bank and I should take it up with them (esp, if I did not notice this withdrawal within N days). Is that not the case?

If thieves have my bank accounts info, my main concern would be if they also have my identity (e.g. via Equifax), setup bank account in my name online and ACH out funds from my accounts. Seems like it might be hard to prove it was not me.
Bank regulations make it so the banks can't just say what they want. The burden of proof is on the bank that initiated the pull. You have 60 days from the date of the statement to dispute unauthorized debits. This is why banks that initiate pulls do random deposits to prove that you have access to the other end. If they just initiate pulls out of the blue they take the risk of having to cough up the money when the other side disputes. It's also why some smaller credit unions don't offer ACH initiated by them or they set a very small daily limit.

P.S. Here's an ACH dispute form from a random credit union found online. Every bank has this.

https://www.figfcu.com/documents/ACH-Dispute-Form
> You have 60 days from the date of the statement to dispute unauthorized debits.

And you are on the hook for $500 in that case too (according to very nice link posted earlier). After 60 days, too bad I guess - at least there is no obligation to return your money... ?

> The burden of proof is on the bank that initiated the pull.

That's why I suspect you may end up having to deal with some unknown bank you never heard of (e.g. US branch of some Ukranian bank); not your bank.

> This is why banks that initiate pulls do random deposits to prove that you have access to the other end.

A few times I opened new accounts, they allowed me to fund it right away by supplying ACH info; without first doing initial deposits.

P.S. I imagine govt should require banks to allow customers establish an ACH debit block / thaw for consumer accounts (already available for business ones!), similar to credit freeze / thaw.
learning_head,

What happened if the party doing a pull is not a bank? For example, the rental office or utility?

KlangFool
30% VWENX | 16% VFWAX/VTIAX | 14.5% VTSAX | 19.5% VBTLX | 10% VSIAX/VTMSX/VSMAX | 10% VSIGX| 30% Wellington 50% 3-funds 20% Mini-Larry
User avatar
tfb
Posts: 8397
Joined: Mon Feb 19, 2007 4:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by tfb »

learning_head wrote: Wed Sep 20, 2017 10:34 am And you are on the hook for $500 in that case too (according to very nice link posted earlier). After 60 days, too bad I guess - at least there is no obligation to return your money... ?
The $500 limit applies to losing a debit card, not unauthorized ACH debits. Here's more official information from FDIC. It's not as pleasingly laid out to the eyes but it's more accurate.

https://www.fdic.gov/regulations/laws/r ... 0-580.html
learning_head wrote: Wed Sep 20, 2017 10:34 am That's why I suspect you may end up having to deal with some unknown bank you never heard of (e.g. US branch of some Ukranian bank); not your bank.
Suspicion doesn't make it true. You deal with your bank. Your bank deals with the other bank. Your bank has the right to pull the money back from the other bank. Your bank has no incentive to fight you. They just pull the money back.
learning_head wrote: Wed Sep 20, 2017 10:34 am A few times I opened new accounts, they allowed me to fund it right away by supplying ACH info; without first doing initial deposits.
That bank took the calculated risk. If they get a dispute they just invalidate your CD (or whatever account they opened for you). They feel confident they won't be left holding the bag because they don't allow you to exit right away.
Harry Sit has left the forums.
User avatar
Toons
Posts: 14459
Joined: Fri Nov 21, 2008 9:20 am
Location: Hills of Tennessee

Re: Online Bill Pay Security: Push or Pull?

Post by Toons »

All Pull.
Let Them Do The Work :happy
Gives me more time for Spanish Lessons :happy
"One does not accumulate but eliminate. It is not daily increase but daily decrease. The height of cultivation always runs to simplicity" –Bruce Lee
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

Toons wrote: Wed Sep 20, 2017 11:24 am All Pull.
Let Them Do The Work :happy
Gives me more time for Spanish Lessons :happy
I have found Push saves me more time for places that support eBill delivery. I only log into one place (my banks epay portal) and see several bills sitting there and then can pay them all through a single interface. With Pull - I would have to log into my Electric-Company, Gas-Company, etc. all separately to look at the bills and then initiate payment (unless I put them ALL on auto-pay - perhaps that's what you've done).
User avatar
Toons
Posts: 14459
Joined: Fri Nov 21, 2008 9:20 am
Location: Hills of Tennessee

Re: Online Bill Pay Security: Push or Pull?

Post by Toons »

DaftInvestor wrote: Wed Sep 20, 2017 11:35 am
Toons wrote: Wed Sep 20, 2017 11:24 am All Pull.
Let Them Do The Work :happy
Gives me more time for Spanish Lessons :happy
I have found Push saves me more time for places that support eBill delivery. I only log into one place (my banks epay portal) and see several bills sitting there and then can pay them all through a single interface. With Pull - I would have to log into my Electric-Company, Gas-Company, etc. all separately to look at the bills and then initiate payment (unless I put them ALL on auto-pay - perhaps that's what you've done).
Comcast
Utiltities
Home insurance monthly
Geico Auto Insurance 6 months
Medicare Supplemental/Prescription Plan
Cell phones
Netflix
Amazon Prime yearly
Pandora monthly
Quarterly Taxes
Those are "auto debited"
Nothing to push myself.
No paper.

I manage my credit card online periodically during the month
:happy
Last edited by Toons on Wed Sep 20, 2017 11:52 am, edited 1 time in total.
"One does not accumulate but eliminate. It is not daily increase but daily decrease. The height of cultivation always runs to simplicity" –Bruce Lee
KlangFool
Posts: 31427
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool »

DaftInvestor wrote: Wed Sep 20, 2017 11:35 am
Toons wrote: Wed Sep 20, 2017 11:24 am All Pull.
Let Them Do The Work :happy
Gives me more time for Spanish Lessons :happy
I have found Push saves me more time for places that support eBill delivery. I only log into one place (my banks epay portal) and see several bills sitting there and then can pay them all through a single interface. With Pull - I would have to log into my Electric-Company, Gas-Company, etc. all separately to look at the bills and then initiate payment (unless I put them ALL on auto-pay - perhaps that's what you've done).
DaftInvestor,

I do not look at my ebill. I pre-pay a fixed amount every month. Then, when I received my paper bill, the bill will show up with extra credit and no payment required. I just look at my paper bill. This saves me time. If the auto-payment system of my bank messes up, I have 30 days to manually push a payment.

I am paranoid. I assume that the system will mess up sometimes.

KlangFool
30% VWENX | 16% VFWAX/VTIAX | 14.5% VTSAX | 19.5% VBTLX | 10% VSIAX/VTMSX/VSMAX | 10% VSIGX| 30% Wellington 50% 3-funds 20% Mini-Larry
User avatar
flamesabers
Posts: 1848
Joined: Fri Mar 03, 2017 11:05 am
Location: Rochester, MN

Re: Online Bill Pay Security: Push or Pull?

Post by flamesabers »

KlangFool wrote: Wed Sep 20, 2017 10:10 am
flamesabers wrote: Wed Sep 20, 2017 9:07 am
sport wrote: Tue Sep 19, 2017 8:43 pm Due to a mixup, I once received a water bill for more than $3000. This is a huge error, considering the low water rates we have being next to Lake Erie. It took the water dept. about a year to get things straightened out. I would not want to have that kind of bill pulled from my account and try to get it corrected.
With the exception of rent, (which I pay with a pull that I initiate manually) I pay all of my bills with my credit card. With my utility bill I get an email beforehand that states the amount of my monthly bill.
flamesabers,

May I ask why do you pay with a pull? You could push your payment every month. Your rent payment should be a fixed amount at a fixed date every month.

KlangFool
The rent amount for my apartment is fixed, however, the water utilities which is included in my monthly rent payment varies every month. Since I have to log onto an online portal to find out what the water bill amount is, I figure I might as well initiate a payment for the full amount at that time.

Before my landlord had an online payment portal (and before I had to pay for a variable water utility bill), I did use bill-pay with my bank. However, a check was always mailed to my landlord and my checking account was debited right away (as opposed to when the check was cashed). I also didn't like not being able to track whether my landlord actually received the check in the mail or not.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

KlangFool wrote: Wed Sep 20, 2017 11:51 am
DaftInvestor wrote: Wed Sep 20, 2017 11:35 am
Toons wrote: Wed Sep 20, 2017 11:24 am All Pull.
Let Them Do The Work :happy
Gives me more time for Spanish Lessons :happy
I have found Push saves me more time for places that support eBill delivery. I only log into one place (my banks epay portal) and see several bills sitting there and then can pay them all through a single interface. With Pull - I would have to log into my Electric-Company, Gas-Company, etc. all separately to look at the bills and then initiate payment (unless I put them ALL on auto-pay - perhaps that's what you've done).
DaftInvestor,

I do not look at my ebill. I pre-pay a fixed amount every month. Then, when I received my paper bill, the bill will show up with extra credit and no payment required. I just look at my paper bill. This saves me time. If the auto-payment system of my bank messes up, I have 30 days to manually push a payment.

I am paranoid. I assume that the system will mess up sometimes.

KlangFool
I see and I think I understand how this works for you. In my case I don't get any paper bills. My mail service is unreliable (I get my neighbors mail and they get mine) so I don't trust paper bills and I personally find dealing with paper/US-mail to be cumbersome and time consuming (need to go through/sort/etc.). Due to weather and the way I utilize utilities - my natural-gas bill is higher in the winter and much low in the summer while my electric bill is the exact opposite (gas-based heat, electric-based AC). It is far easier for me to just pay exactly what I owe (and I don't like the payment plans these utilities offer). I simply log in - look at all the ebills - then can hit "pay-all". For me it seems faster and more reliable than worrying about US-Mail. Yes - IT systems can have problems too with ebill delivery - but I've never NOT received an ebill (while I've had problems in the past with US-Mail) - and if I did - I would notice it missing for the month.
KlangFool
Posts: 31427
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool »

DaftInvestor wrote: Wed Sep 20, 2017 11:59 am
I see and I think I understand how this works for you. In my case I don't get any paper bills. My mail service is unreliable (I get my neighbors mail and they get mine) so I don't trust paper bills and I personally find dealing with paper/US-mail to be cumbersome and time consuming (need to go through/sort/etc.). Due to weather and the way I utilize utilities - my natural-gas bill is higher in the winter and much low in the summer while my electric bill is the exact opposite (gas-based heat, electric-based AC). It is far easier for me to just pay exactly what I owe (and I don't like the payment plans these utilities offer). I simply log in - look at all the ebills - then can hit "pay-all". For me it seems faster and more reliable than worrying about US-Mail. Yes - IT systems can have problems too with ebill delivery - but I've never NOT received an ebill (while I've had problems in the past with US-Mail) - and if I did - I would notice it missing for the month.
DaftInvestor,

I have a similar usage pattern. But, after 2 years, I can figure out the fixed amount to make this work.

<< but I've never NOT received an ebill (while I've had problems in the past with US-Mail) - and if I did - I would notice it missing for the month.>>

I missed a credit card payment because they did not email me an alert. So, from now on, I pre-pay a fixed minimum amount every month.

KlangFool
30% VWENX | 16% VFWAX/VTIAX | 14.5% VTSAX | 19.5% VBTLX | 10% VSIAX/VTMSX/VSMAX | 10% VSIGX| 30% Wellington 50% 3-funds 20% Mini-Larry
Nowizard
Posts: 4827
Joined: Tue Oct 23, 2007 5:33 pm

Re: Online Bill Pay Security: Push or Pull?

Post by Nowizard »

We remain dinosaurs in the sense that we do not use debit cards or automatic withdrawals from our bank account but continue to pay bills by check if we cannot use a credit card. This is, admittedly, partially due to our being from an earlier generation, but it feels safer. Also, if your account is compromised, you will have to contact all companies making automatic withdrawals with your new bank account data.

Tim
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

Nowizard wrote: Wed Sep 20, 2017 12:09 pm We remain dinosaurs in the sense that we do not use debit cards or automatic withdrawals from our bank account but continue to pay bills by check if we cannot use a credit card. This is, admittedly, partially due to our being from an earlier generation, but it feels safer. Also, if your account is compromised, you will have to contact all companies making automatic withdrawals with your new bank account data.

Tim
According to a few articles I've read (including the one that someone provided a link to above) writing paper checks is the LEAST secure thing to do. You account number, routing number, and name/address are on every single check you send out. These checks eventually end up in an electronic system anyway but they also pass through many hands before doing so - many more people can steal your information since the paper check has all your bank data on it. So while it might "feel" safer - it actually isn't.
trueblueky
Posts: 2365
Joined: Tue May 27, 2014 3:50 pm

Re: Online Bill Pay Security: Push or Pull?

Post by trueblueky »

I autopay recurring bills from the credit union website. I have the telephone and electricity bills set to an amount greater than it normally is, because both fluctuate. I change them in the credit union site before they're paid each month, but am comforted that even if the bill doesn't come or I'm in a coma, they'll still be paid

I pay the credit cards at their websites. I pay the water bill with credit card; the limit is set at $50, which is more than double any month we've had. Unfortunately it fluctuates because the city bills on four-week of five-week months (last Friday).

I had one problem with a push from CU when they sent a check that wasn't received. Three months later, the CU automatically credited the money back. There is no way for me to see whether a check pushed by them thru autopsy has been cashed.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

tfb wrote: Wed Sep 20, 2017 11:17 am
learning_head wrote: Wed Sep 20, 2017 10:34 am And you are on the hook for $500 in that case too (according to very nice link posted earlier). After 60 days, too bad I guess - at least there is no obligation to return your money... ?
The $500 limit applies to losing a debit card, not unauthorized ACH debits. Here's more official information from FDIC. It's not as pleasingly laid out to the eyes but it's more accurate.

https://www.fdic.gov/regulations/laws/r ... 0-580.html
learning_head wrote: Wed Sep 20, 2017 10:34 am That's why I suspect you may end up having to deal with some unknown bank you never heard of (e.g. US branch of some Ukranian bank); not your bank.
Suspicion doesn't make it true. You deal with your bank. Your bank deals with the other bank. Your bank has the right to pull the money back from the other bank.
Is this based on the link you mentioned above? Or how do you know they won't just send me to the other bank?
tfb wrote: Your bank has no incentive to fight you.
Well, they have no incentive to fight for me really. Not much, anyway. They don't want to be in the middle of this. If they know it's on the other bank and they are not on the hook, they are likely NOT want to be the middle man between me and the other bank, unless you know of some law requiring them to be the middle man.
tfb wrote: They just pull the money back.
I am sure money would be long gone in the scenario described. There would be nothing to pull back. Once a thief pulled fake ACH money into their account, they send it away pretty fast.
User avatar
tfb
Posts: 8397
Joined: Mon Feb 19, 2007 4:46 pm

Re: Online Bill Pay Security: Push or Pull?

Post by tfb »

learning_head wrote: Wed Sep 20, 2017 1:00 pm Is this based on the link you mentioned above? Or how do you know they won't just send me to the other bank?
Yes it is in the FDIC link. The regulations dictate what your bank must do. It's not optional. Whether your bank wants to get in the middle or not, they have no choice. The thieves may be gone but the other bank is still there. By initiating the ACH on behalf of thieves they put themselves in the position of being responsible for reversals coming from your bank. The thieves' bank will have to take the loss if they took on a bad customer who ran away.
Harry Sit has left the forums.
ccieemeritus
Posts: 706
Joined: Thu Mar 06, 2014 9:43 pm

Re: Online Bill Pay Security: Push or Pull?

Post by ccieemeritus »

I prefer push from the bank. I sign up for e-bills and have some of them paid automatically by the bank. But I avoid giving vendors authorization to pull money from my bank account. In a few cases the vendors dont give me a convenient choice (UCSD for example). In the UCSD case I unlick the box where they offer to save my bank account information.

Aside: Physical checks have bank account information. How is that secure? That always bugged me.

In a similar vein I avoid giving my credit card to too many online vendors. I do most of my online shopping from amazon. That way my credit card information is not in too many hands.

I want to control the horizontal. I want to control the vertical. I can cut off payments in my bank ebill site. I don't want my bank account or credit card info saved in dozens of ecommerce sites.
trueblueky
Posts: 2365
Joined: Tue May 27, 2014 3:50 pm

Re: Online Bill Pay Security: Push or Pull?

Post by trueblueky »

ccieemeritus wrote: Wed Sep 20, 2017 4:56 pm I prefer push from the bank. I sign up for e-bills and have some of them paid automatically by the bank. But I avoid giving vendors authorization to pull money from my bank account. In a few cases the vendors dont give me a convenient choice (UCSD for example). In the UCSD case I unlick the box where they offer to save my bank account information.

Aside: Physical checks have bank account information. How is that secure? That always bugged me.

In a similar vein I avoid giving my credit card to too many online vendors. I do most of my online shopping from amazon. That way my credit card information is not in too many hands.

I want to control the horizontal. I want to control the vertical. I can cut off payments in my bank ebill site. I don't want my bank account or credit card info saved in dozens of ecommerce sites.
When we lived in Germany, there was a form similar to a check that the doctor would give you. It had the doctor's bank information on it. I took the form to my bank to transfer the money to him. It was really the opposite of a check since the form came with his deposit info on it, not mine, and my info never left the bank.

After I saw that, I believed it made much more sense. Take a pile of the forms to your sparkasse or bank and have them transfer money to other banks and accounts. Or do it online.
Northern Flicker
Posts: 15289
Joined: Fri Apr 10, 2015 12:29 am

Re: Online Bill Pay Security: Push or Pull?

Post by Northern Flicker »

I think you want to push from online billpay to keep all of the bill pay jobs in one place so you can administer them properly. you may want to have one credit card in a file cabinet that you never use to have it available as an emergency card.
SpideyIndexer
Posts: 850
Joined: Thu Apr 02, 2015 10:13 pm

Re: Online Bill Pay Security: Push or Pull?

Post by SpideyIndexer »

I'm generally in the push camp, though have a few pulls for historical reasons. I feel more in control pushing my funds. Adding a new payee is always a bit nerve-racking however.

I would like things to be more automated, which probably implies changing to pulls. I also want maximum security, which could imply having just enough money in the account to cover the pulls...which isn't so automatic.

A previous poster mentioned that pulls are nice in that the institution doing the pull is responsible. But I expect that is only true if there are sufficient funds in one's account. If one makes a mistake, or if fraudulent pulls occur, the problems multiply.

Will probably keep on pushing (mostly) for a good number of years. Perhaps as I age, I will be worry less about keeping my "funding" account balance as low as possible.

I worry a lot about credit card fraud so check CC bills ASAP. I think there is still of lot of it occurring.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

ccieemeritus wrote: Wed Sep 20, 2017 4:56 pm
Aside: Physical checks have bank account information. How is that secure? That always bugged me.
Physical checks aren't secure. A few articles I've read (including one that someone posted a link to above) state that this is the least secure way to pay your bills.
Thanks for your other input. I appreciate all the responses I've gotten to this question.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

SpideyIndexer wrote: Thu Sep 21, 2017 1:52 am I worry a lot about credit card fraud so check CC bills ASAP. I think there is still of lot of it occurring.
I also worry about credit card fraud so have trouble waiting for my bill before looking. I find myself logging in to my CC website or App and checking transactions every couple of days (used to use mint to keep an eye on things but stopped using it).
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

DaftInvestor wrote: Thu Sep 21, 2017 9:32 am I find myself logging in to my CC website or App and checking transactions every couple of days
At least some credit cards will just send you text alerts whenever there is a charge (if you sign up for these alerts). No need to login then... Also, you can use custom-generated credit card numbers for all your online transactions. Many Mastercard and Visa cards have the app for it (Amex does not last time I checked).

Having said that, I'd be much more worried about bank accounts than credit card charges. Checking your account balances (or again, rather using bank alerts) at the bank is more important IMO. Drained bank accounts are much harder to deal with and there are less protections in place (e.g. you have to let them know within 60 days). Credit card fraud is both, easier to deal with, and you'd have $0 responsibility for fraudulent charges.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

learning_head wrote: Thu Sep 21, 2017 12:18 pm
DaftInvestor wrote: Thu Sep 21, 2017 9:32 am I find myself logging in to my CC website or App and checking transactions every couple of days
At least some credit cards will just send you text alerts whenever there is a charge (if you sign up for these alerts). No need to login then... Also, you can use custom-generated credit card numbers for all your online transactions. Many Mastercard and Visa cards have the app for it (Amex does not last time I checked).

Having said that, I'd be much more worried about bank accounts than credit card charges. Checking your account balances (or again, rather using bank alerts) at the bank is more important IMO. Drained bank accounts are much harder to deal with and there are less protections in place (e.g. you have to let them know within 60 days). Credit card fraud is both, easier to deal with, and you'd have $0 responsibility for fraudulent charges.
Thanks for this info - in my case my wife shops too much for me to get text alerts every time there is a charge :) If there was a text for something over a certain threshold or for a place/item you don't usually purchase it might be more useful but I believe that is the kind of thing the fraud departments look for anyway.
I've also had at least one of my cards offer me the "one-time" account numbers. As you state - with $0 in responsibility - it hardly seems worthwhile.
learning_head
Posts: 844
Joined: Sat Apr 10, 2010 6:02 pm

Re: Online Bill Pay Security: Push or Pull?

Post by learning_head »

DaftInvestor wrote: Thu Sep 21, 2017 1:27 pm Thanks for this info - in my case my wife shops too much for me to get text alerts every time there is a charge :) If there was a text for something over a certain threshold or for a place/item you don't usually purchase it might be more useful but I believe that is the kind of thing the fraud departments look for anyway.
I've also had at least one of my cards offer me the "one-time" account numbers. As you state - with $0 in responsibility - it hardly seems worthwhile.
On my card, I setup exactly this kind of alert: text me about any charges over amount I specified.

I like providing generated credit card numbers because
- a generated number will only be allowed to be used by the first user of that number. So, even if it's ever stolen, say from the vendor I give it to, others won't be able to put a charge through
- when generating those numbers, I limit both expiration date and available amount. This puts me in control of how much I allow the vendor to charge me and soon enough they won't be able to charge me at all afterwards
- my real card payment info is in much less circulation or stored on fewer payment databases (in fact almost none); so even though I would not be responsible for fraud in the end, this protects me from card fraud to begin with.
Nowizard
Posts: 4827
Joined: Tue Oct 23, 2007 5:33 pm

Re: Online Bill Pay Security: Push or Pull?

Post by Nowizard »

Someone may have mentioned this, but the IRS instructs you to write your social security number on any checks for payment. I assume few do that or only use a few numbers. Others have mentioned that checks are thought by some to be the least secure way to pay bills, but recent events reflect that there is no truly secure way.

Tim
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

Nowizard wrote: Mon Sep 25, 2017 10:02 am Someone may have mentioned this, but the IRS instructs you to write your social security number on any checks for payment. I assume few do that or only use a few numbers. Others have mentioned that checks are thought by some to be the least secure way to pay bills, but recent events reflect that there is no truly secure way.

Tim
Thanks for the thoughts nowizard - putting SSN on checks - are you talking about for a tax payment?
I don't think any one asserted there was a truly secure way to pay bills - simply that writing paper checks was the least secure. The reason for this assertion is that the information on a paper check eventually ends up submitted electronically anyway (similar to online payment) but before this happens it passes through many more hands providing more opportunities for the information to be compromised.
wrongfunds
Posts: 3187
Joined: Tue Dec 21, 2010 2:55 pm

Re: Online Bill Pay Security: Push or Pull?

Post by wrongfunds »

When I worry about my bank being hacked, the last thing I worry about stealing my credit card info! Somebody hacking the bank is probably interested in grabbing all the money from the bank and NOT my credit card numbers!
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

wrongfunds wrote: Mon Sep 25, 2017 1:08 pm When I worry about my bank being hacked, the last thing I worry about stealing my credit card info! Somebody hacking the bank is probably interested in grabbing all the money from the bank and NOT my credit card numbers!
Why wouldn't they grab both if they could (your money and your CCs)? Then you would have nothing left in your bank account in addition to not having any un-compromised CC #s (thus my question).
wrongfunds
Posts: 3187
Joined: Tue Dec 21, 2010 2:55 pm

Re: Online Bill Pay Security: Push or Pull?

Post by wrongfunds »

We had this discussion about pull vs push ACH few months ago. Frankly, if you don't mind being guest of federal prison system, it would be trivial to pay your kid's semester tuition on some unsuspecting very rich parents if you had ever received a check from them! All the colleges that I had to pay for my kids involved giving them bank routing number and the account number and dollar amount to be pulled out. There really is NO security apart from the normal fear of getting caught and spending some time behind the bar. If you are fearless, you could pay bunch of your bills using other peoples money until you get caught.
User avatar
Topic Author
SmileyFace
Posts: 9081
Joined: Wed Feb 19, 2014 9:11 am

Re: Online Bill Pay Security: Push or Pull?

Post by SmileyFace »

wrongfunds wrote: Mon Sep 25, 2017 1:27 pm We had this discussion about pull vs push ACH few months ago. Frankly, if you don't mind being guest of federal prison system, it would be trivial to pay your kid's semester tuition on some unsuspecting very rich parents if you had ever received a check from them! All the colleges that I had to pay for my kids involved giving them bank routing number and the account number and dollar amount to be pulled out. There really is NO security apart from the normal fear of getting caught and spending some time behind the bar. If you are fearless, you could pay bunch of your bills using other peoples money until you get caught.
I did do a couple of searches before posting and wasn't able to find anything recent regarding push/pulls - I apologize if this is redundant topic.
I've actually heard of folks going to prison for check-fraud so I don't want to rely on criminal prosecution fear alone for protection - I don't recall the statistics on criminal prosecutions but I'd rather not be one of the victims.
With many things we do there are more and less secure ways of doing things - I was simply asking whether anyone knew definitively if this applies to Pushes/pulls.
wrongfunds
Posts: 3187
Joined: Tue Dec 21, 2010 2:55 pm

Re: Online Bill Pay Security: Push or Pull?

Post by wrongfunds »

Personally, I prefer push but many institutions require "effective pull" e.g. IRS, Universities, Town Collectors etc. I feel push model has better security because pull model has zero security. Technically, there are no safeguards for money being pulled out fraudulently except the fear of getting caught. I defy anybody to prove me wrong by showing technical safeguards that are in place for pull model. For crying out loud, if you entered the account number wrong but if it just happened to be a good account one with sufficient balance in it, your bill *will* be paid by some unsuspecting sucker until she notices and raises fraud alarm.
KlangFool
Posts: 31427
Joined: Sat Oct 11, 2008 12:35 pm

Re: Online Bill Pay Security: Push or Pull?

Post by KlangFool »

wrongfunds wrote: Mon Sep 25, 2017 2:18 pm Personally, I prefer push but many institutions require "effective pull" e.g. IRS, Universities, Town Collectors etc. I feel push model has better security because pull model has zero security. Technically, there are no safeguards for money being pulled out fraudulently except the fear of getting caught. I defy anybody to prove me wrong by showing technical safeguards that are in place for pull model. For crying out loud, if you entered the account number wrong but if it just happened to be a good account one with sufficient balance in it, your bill *will* be paid by some unsuspecting sucker until she notices and raises fraud alarm.
wrongfunds,

As part of the "effective pull", you have to put in the name of the owner of the account in addition to routing number and account #. If it is an honest mistake, you would put your name into that "effective pull" with wrong A/C #. If it is fraudulent, you will put someone's else name into that "effective pull" with wrong A/C #. Am I wrong in my thinking?

KlangFool
Last edited by KlangFool on Mon Sep 25, 2017 3:23 pm, edited 1 time in total.
30% VWENX | 16% VFWAX/VTIAX | 14.5% VTSAX | 19.5% VBTLX | 10% VSIAX/VTMSX/VSMAX | 10% VSIGX| 30% Wellington 50% 3-funds 20% Mini-Larry
wrongfunds
Posts: 3187
Joined: Tue Dec 21, 2010 2:55 pm

Re: Online Bill Pay Security: Push or Pull?

Post by wrongfunds »

I am not 100% sure that the name is required or actually matched by the clearing software. I suspect it is similar to the check clearing where the automated software most likely does not "read" or "parse" the textual amount or your signature. To the best of my recollection, I don't think when I was paying for my son's tuition, I had to put name of the bank account holder while making the payment. There were enough verbiage on that page to warn me of the dire consequences of trying to be cute but the real input was bank routing and account number and NOT the name on the account. As they say, memory is the second thing to go and I don't recall what was the 1st thing :-)
Post Reply