Essentially, they just print out a check with your routing & account numbers on it, print “Signature on file” for the signature line, and give it to their bank. The bank then has your bank debit your account and put the money into theirs. These days it’s usually done electronically rather than by “printing” anything.

Since I originally made this post, it’s gotten a little harder, as the bank issuing the draft is now liable for fraud, rather than the bank paying it. You still have the fundamental problem that the money is already gone and you have to get it back, but at least banks are putting more effort into preventing the fraud as they’ve started to lose their own money to it. There’s a statement from the FTC here that tells a bit more about how it works.

It’s a fraud that requires some setup time — i.e. you need to set up a fake business, get some bank accounts, process some legitimate drafts, and then commit the fraud. You can’t (anymore!) just go to a web site, enter somebody’s account number, and take all the money out. Checking account numbers are, however, still much riskier to give out than credit card numbers, and it’s still a much bigger pain to get the money back.

On the other hand, if you mean attacks not against IE but against SSL itself, such as Moxie’s SSLSniff, they’re hard to detect. One thing that helps is actually opening and verifying the certificate — just because the padlock icon is there doesn’t mean you’re communicating with what you think you’re communicating with. Most of the time attackers don’t forge an entire certificate, just the domain name, so everything else may look wrong (or the certificate may be for * rather than a specific domain.) Once again, use a current, fully-patched browser, as this protects you from null-byte certificates (which actually may look perfect if you inspect them.) And most importantly of all, don’t use insecure wireless networks. Attacks like SSLSniff rely on being a man-in-the-middle — that is, an attacker must be able not just to read your communication but also to modify it. This means either he has to control a router between you and the website you’re talking to, or he has to be on a wireless network with you. The only safe thing to do on an insecure (open or WEP) wireless network is to VPN to a secure network. Anything else is vulnerable.

The torrent of choice must always be the one with the most seeds, not with the most leechers.

he might even report bad quality etc, pointing out the waste of time, problem is, people dont really read before downloading, automating the verifcation could help.

–Peter
peter@tunecore.com

Source: http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm

Using a credit card online is incredibly safe.

I beg to differ. They may not be able to be washed as well as back in the day, but they can still certainly be washed. Back in 2000-2002 I worked as a teller and service manager for Wells Fargo. We would get washed checks all the time. Some we’d catch, others not–and we’d find out about them in our fraud reports. And since most tellers are really just kids in their first or second jobs who don’t have much experience, it wasn’t difficult to fool some of them when cashing–they just wouldn’t notice the fade, especially on a Friday with a high check cashing volume from non-bank holders cashing “on-us” checks. But when we did notice the fade, we’d call the cops. I had at least 2 arrests made during my stint at the bank.

As of now, I’m not sure what side effects I’ll encounter. Disabling this service may also impact COM Automation and the Win32 API components for sending and receiving HTTP requests from applications. Actually, I might like this since I really don’t like apps accessing the web without my control. My browser still works … that’s good! Well see.

By the way, with Wireshark I now see a lot of different activity on initialization of my internet connection. I need to look into this….

Checks can’t be “washed” since 1960’s. Try it some time. All of them have chemical protection against this sort of thing.

Even large corporate checks are printed on tamper proof paper. Try washing those some time. The larger the corporation the more tightly controlled the check stock, and the higher the quality. Even el-cheapo Quicken checks have enough protection to defeat washing and lifting.

Lifting laser printing is also fiction. You can’t really do this and not have it immediately detectable to the naked eye.

Physical reproduction with high quality copiers is a greater risk. Some of these are good enough to reproduce currency. But all of those that ARE good enough embed identifying information into every printed image.

Mountain. Mole-Hill.