Q: Recently I looked at my online statement from Huntington Bank. Imagine my surprise when I found that Comcast, a company with which I have never dealt and which does not offer service in 44121, my business Zip Code, had extracted over $500 from my account.
After I filled out all of the necessary paperwork with Huntington, I was issued a credit.
When I asked Huntington how such a thing could happen, I was told that someone made an incorrect key stroke and I was the lucky one.
My accountant would have no idea whether Comcast was my internet provider and, if I had not checked, it would have been written off as a business expense.
R.H., Hudson
A: You have discovered a dirty little secret about electronic withdrawals from bank accounts.
In order for someone to make a withdrawal from your bank account or mine, they need only the bank's routing number and your account number. Or any account number, for that matter.
They don't need your name or address or ZIP code or anything else.
So if someone wants to pay for something online or by phone with an ACH (which stands for Automated Clearing House) withdrawal, he or she could pick a bank and find its routing number, which is easy. And then pick an account number with the correct number of digits. Gold! It might be your account.
Are you mortified yet?
Huntington spokesman Bill Eiler said, "ACH transactions are highly regulated and require all institutions to follow a specific ACH format. A valid routing and account number are part of mandatory field requirements for transactions with any institution."
Transactions by ACH are overseen by NACHA -- The Electronic Payments Association. NACHA spokeswoman Kendra Beasley didn't say why ACH transactions don't require someone to provide the account holder's name before money can be withdrawn from his account.
"The combination of a routing number and an account number is used in many payments systems to accurately process transactions, including wire transfers, checks, and ACH. Other information such as name and address is not used in processing payments," she said.
Individuals -- you and I -- can't do anything to prevent erroneous transactions if someone uses our bank routing number and account number. However, many banks allow business account holders to block ACH transactions unless they're pre-approved, Beasley said.
Erroneous withdrawals aren't a new problem. Bank accounts have long been vulnerable for these kinds of errors or, even worse, outright fraud. This is one of the reasons I have long told people not to volunteer where they bank (whether it's Huntington or Key or PNC or wherever) and to be selective about whom they give personal checks. If a student comes to your door selling cookie dough for some school fundraiser, pay cash. Paying a contractor you don't know well? Pay him from a checking account that's not your primary checking account. (Yes, it's a good idea to have two, even if you keep hardly any money in your secondary account. With mobile deposit, you can easily put money in from your other account to cover a check you write.)
Yes, banks are pretty good about resolving these problems easily. But as a consumer, you still have to pay attention to your account activity and make a phone call if there's something wrong. This is annoying at best. At worst, a mistake or fraud could cause legitimate transactions to bounce. Good luck getting the bank to refund all of those overdraft fees. It can be done, but it usually takes some strong-arming.
Huntington wasn't able to offer any advice on how someone could prevent this from happening. The bank just urges consumers to "contact your financial institution immediately if something does not look right on your account," Eiler said.
Q: I am writing to you to see if you have experienced or heard from other Plain Dealer readers regarding delayed refunds from the IRS. I was contacted by the IRS to verify my identity. I answered three very obscure questions regarding my personal finances online. Afterwards, I called the IRS to see what the next step would be. I was told that the IRS would contact me in the mail and that there was a fraudulent return in my name.
I have not received any correspondence from the IRS at this point after about three months of waiting. I have tried to call the same IRS phone numbers that I originally contacted. But I end up in phone recorded-message hell.
My refund is substantial, and I would like to know what the delay is with the IRS. I understand that fraud is a huge deal for the IRS and they need to be careful. And that they have a lot of American taxpayers. But my patience is wearing thin. Some correspondence would be helpful.
Please let me know if I should seek legal help. Or this will eventually work itself through the bureaucracy in a little more time. The lesson learned is don't loan Uncle Sam any money, you may never see it again.
J.M., Cleveland
A: First, you didn't say how you were contacted by the IRS. If it was by mail, that was probably legitimate. If it was by email, you may have other problems. The IRS never, ever, ever contacts people by email and asks them to provide financial information, or any kind of information to verify identity. Never. Ever. The same goes for banks, credit cards, investment companies, etc.
Beyond that, IRS spokeswoman Jennifer Jenkins declined to comment on your specific case for obvious reasons, but offered general advice for taxpayers:
"Not all tax return processing and tax refund delays are due to identity theft," she said, adding that the Taxpayer Advocate Service offers some helpful information and guidance about tax refund delays at https://www.youtube.com/watch?v=cyF_mwPTsjY&feature=youtu.be.
"The IRS understands how burdensome identity theft can be to victims, because ID theft-related tax fraud can be among the most challenging cases for us to resolve," Jenkins said.
"Through focused efforts emphasizing assistance to ID theft victims, we've whittled the average case resolution time down from the six or more months . . . as recently as a few years ago. Today, the typical ID theft-related case currently takes us about 120 days to resolve. But we are working hard to further streamline our internal process in order to further reduce that time period."
Taxpayers with any kind of question, like the status of a refund after identity theft, are encouraged to call the IRS hotline at 1-800-829-1040. It's open Monday through Friday from 7 a.m. until 7 p.m. local time. Call volumes vary from day to day, hour to hour. For those living in the Eastern Time Zone, though, it may be best to call within the first couple of hours - early morning - to get a jump on callers from time zones further west.
For people like you, with a problem with identity theft, if you previously contacted the IRS and did not have a resolution, contact the Identity Protection Specialized Unit at 1-800-908-4490.
It's also important for taxpayers who are aware that a thief has used their information to file a fraudulent tax return to complete and submit IRS Form 14039, the Identity Theft Affidavit, she said.
Also, anyone who has been told by the IRS that a fraudulent return was filed in his name should report it to the police, Jenkins said. You should file a police report and report it to the Federal Trade Commission at ftc.gov/complaint. Learn more about what to do at identitytheft.gov.
In addition, you should consider contacting the three major credit bureaus to put a fraud alert on your credit files.
- Equifax, www.Equifax.com, 1-800-525-6285
- Experian, www.Experian.com, 1-888-397-3742
- TransUnion, www.TransUnion.com, 1-800-680-7289
Finally, you should contact your financial institutions and see whether there's anything amiss. Consider putting a security password on your account (different than your ATM PIN) and set up email or text alerts to be notified of any withdrawals above a certain amount (maybe $100 or $300).
Murray is The Plain Dealer's personal finance writer. Because of the volume of requests, she cannot help everyone who contacts her.
To reach her: moneymatters@plaind.com
On Facebook: MurrayMoneyMatters
On Twitter: @teresamurray
Previous columns online: cleveland.com/moneymatters