So, any ‘legitimate’ business could claim that they had a series of attacks, in which random numbers were submitted to them by ‘prospective customers’. Bonus: once the attack succeeds, they can demand information about the victims (name, address, copy of id; purely to prove who they are and facilitate correspondence, of course) provide a full refund (makes the victim happy… for now) and move on.

Credit cards have several different factors: name, number, expiration date, ccv code. They multiply the difficulty of a brute-force attack. Easy fix for demand draft: multi-factor authorization. Call the merchant, make the order, the merchant proposes a draft to the bank. Call the bank, verify the draft, bank transfers the funds. This can still be compromised by someone capable of impersonating the user, but renders the brute-force attack useless.

Essentially, they just print out a check with your routing & account numbers on it, print “Signature on file” for the signature line, and give it to their bank. The bank then has your bank debit your account and put the money into theirs. These days it’s usually done electronically rather than by “printing” anything.

Since I originally made this post, it’s gotten a little harder, as the bank issuing the draft is now liable for fraud, rather than the bank paying it. You still have the fundamental problem that the money is already gone and you have to get it back, but at least banks are putting more effort into preventing the fraud as they’ve started to lose their own money to it. There’s a statement from the FTC here that tells a bit more about how it works.

It’s a fraud that requires some setup time — i.e. you need to set up a fake business, get some bank accounts, process some legitimate drafts, and then commit the fraud. You can’t (anymore!) just go to a web site, enter somebody’s account number, and take all the money out. Checking account numbers are, however, still much riskier to give out than credit card numbers, and it’s still a much bigger pain to get the money back.

Source: http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm

Using a credit card online is incredibly safe.

I beg to differ. They may not be able to be washed as well as back in the day, but they can still certainly be washed. Back in 2000-2002 I worked as a teller and service manager for Wells Fargo. We would get washed checks all the time. Some we’d catch, others not–and we’d find out about them in our fraud reports. And since most tellers are really just kids in their first or second jobs who don’t have much experience, it wasn’t difficult to fool some of them when cashing–they just wouldn’t notice the fade, especially on a Friday with a high check cashing volume from non-bank holders cashing “on-us” checks. But when we did notice the fade, we’d call the cops. I had at least 2 arrests made during my stint at the bank.

Checks can’t be “washed” since 1960′s. Try it some time. All of them have chemical protection against this sort of thing.

Even large corporate checks are printed on tamper proof paper. Try washing those some time. The larger the corporation the more tightly controlled the check stock, and the higher the quality. Even el-cheapo Quicken checks have enough protection to defeat washing and lifting.

Lifting laser printing is also fiction. You can’t really do this and not have it immediately detectable to the naked eye.

Physical reproduction with high quality copiers is a greater risk. Some of these are good enough to reproduce currency. But all of those that ARE good enough embed identifying information into every printed image.

Mountain. Mole-Hill.

I can’t really speak to the security of noca.com, since they state that they “undertake an appropriate level of identity verification” but don’t actually say what that is. That’s where the security, if any, would need to come from — the whole problem with checks as a payment system is the fact that demand drafts normally come with no identity verification.

While credit cards have their issues (high transaction fees, etc.), they’re still amazingly secure from the customer’s perspective due to the fact that you can contest charges before the money’s gone. Checks and debit cards don’t offer that luxury — instead, you have to try to get the money back.

Alfonzo: There are a variety of ways. One is to just use a demand-draft system that doesn’t require identity verification — qchex.com used to let anyone do this online, but they seem to have shut down after the FTC sued them for enabling millions of dollars in fraud. There may still be similar systems on the Net in other countries. Lacking a public system, someone with a merchant account at a bank could do it, too (they’d just need to go to the trouble of setting up a fake merchant account, which obviously would require some effort since banks do verify the identity of their account holders.)

Alternately, a thief could simply order checks online with your routing number and account number, then buy stuff with them. The checks are “real”, so electronic verification systems will pass them, and they’ll get processed and the money sent. Of course, you can dispute the transactions later, and the signatures probably won’t match, so you’ll eventually win your case and get your money back from the bank. However, you’ll still have had to go through the hassle of doing it — probably with an empty checking account all the while — and the thief will already have gotten away with whatever he bought with the check.