Safe Deposit Boxes Aren't Safe

https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html

by rafaelc • 7 years ago

234 143 7 years ago

What have people been using for Yubikeys as an alternative? Installing safes onsite and self monitoring?

viraptor3• 7 years ago

Why would you want to store yubikeys securely, as opposed to recovery codes which you can print out in multiple copies? Store it in multiple semi-secure places. Unless you're running infra for an international corp, government, bank, or are likely to be physically targeted for some reason, you can likely store it in a folder on a shelf.

(And if you actually need to worry about things like that, then you've got (or should have) people who think of things like that for you)

jdnenej• 7 years ago

You can check to see the key is still there but you can't check to see if anyone has copied the codes. The key is meant to be not possible to duplicate.

Thorrez5• 7 years ago

It depends on your threat model. If you're worried about sophisticated attackers physically breaking in to your place to steal a Yubikey to steal your accounts, you should also worry about them physically tampering with your computer to install malware, and thus need monitoring for that as well.

If you can't do the monitoring, and you face very advanced attackers like this, it's probably best to only use a laptop that you physically keep with you at all times, and then you can keep your Yubikey with you at all times too.

If you just want to protect against an attacker sophisticated enough to steal a Yubikey but not enough to install malware, then maybe instead of a second Yubikey in the safe deposit box, you could have an encrypted recovery code in the safe deposit box, and either memorize the password, or store the password on your computer.

I've never heard of attackers stealing a Yubikey though. More likely is the attacker will social engineer the website's support into giving over your account.

michaelt• 7 years ago

I’ve heard safe deposit boxes as an answer to the question “what if my house burns down with my yubikey/recovery code sheet in it, and none of my friends or family are as security-conscious as me so I can’t leave the spare with them”

TomK32• 7 years ago

From the article is sounds like most of those cases are banks drilling open the boxes and putting the contents into storage. A better and stricter inventory system with strict and punitive regulation is what is needed, not some technical gadget.

ghaff7• 7 years ago

Furthermore, electronics fail. If there’s some records including 2FA codes that you want to store in a safety deposit box, fire box, etc. I absolutely want at least paper backups whether or not I also have a Yubikey, SD card, etc. eg if I have a home inventory I absolutely want prints even if it’s also in the cloud someplace.

Latty3• 7 years ago

I think the parent post was asking where someone would securely store a hardware device like a yubikey that, for example, contains the only copy of a root key—as opposed to using such a hardware device as part of a security system.

Spooky232• 7 years ago

Yes. Paper is best though.

It is also sometimes in your interest to get things in the custody of an individual, ideally your attorney. If the owner of a deposit box becomes aware of your death, they will seal it until a court order is obtained.

jdeibele2• 7 years ago

At least in California, the bank opened it for me (as personal representative) so that a bank employee and I could inventory the contents.

My aunt was a hoarder. At that point, I was actually relieved that the box was empty and I wouldn't have to go through the process of claiming the contents.

My aunt was also somebody who bought gold and silver, something that was promoted heavily to people in conservative Orange County California when Obama became president and end times were near. Chase made it very clear that I was basically storing things at my own risk. I could deposit US coins from the 1880s at face value of $20 and get FDIC insurance. Instead, since they were about $1200 each at the time, I put them in the safe deposit box.

Before that, in Oregon, my dad died but I was on the list of people allowed to use the box so I had access. That might be an option if there's somebody you really trust.

The banks do charge about $100 to drill the lock if you lose the keys. It's possible that you could have somebody authorized to use the box but not give them a key.

79523• 7 years ago

Whilst the security lapses are infuriating, I think this is really a domain for independent insurance cover.

Thorrez5• 7 years ago

I would want to buy that insurance from the bank. If I buy the insurance from somewhere else, then the bank doesn't really have a financial incentive to keep my stuff safe.

H8crilA• 7 years ago

Meaning the insurance premium will be higher? I mean if X keeps it, Y insures it, then X loses it, Y still has to pay up, so you're covered. The only difference between X=Y or X!=Y could be in the premium that Y commands.

dredmorbius2• 7 years ago

I don't think you do.

You want the risk (bank malfeasance) and risk manager (insurance company) widely separated (agency risk, moral & morale hazard, conflicts of interest, etc.).

The insurer should demand and receive rights to collect damages from the bank.

The bank itself can insure that risk independently.

kurthr2• 7 years ago

Exactly, otherwise the insurer makes more profit at higher risks. As long as all the bank deposits are equally unsafe a group of private insurers can all charge a %... why wouldn't they improve long term returns by just subsidizing thieves learning cracking skills as long as the effects are evenly distributed?

Remember all those stero install places in the 80s-90s that also installed alarms? What other job were the installers trained for if they quit?

Bluecobra• 7 years ago

I recently rented a self storage unit and they required that I have insurance (theirs or my homeowners). I don’t see much difference between a safe deposit box is and a self storage unit. I’m surprised the banks don’t require this—it would be less hassle for them and the customer.

That being said, it should be obvious to the customer that insurance is needed. Actually reading the lease agreement should provide enough information on determining your insurance requirements. If Wells Fargo only caps their liability at $500, then you should have a policy to cover the rest. The laughable $500 liability really goes to show you they don’t care and don’t stand behind their product.

kd5bjo2• 7 years ago

At one point, I tried to rent a vehicle space at a self-storage facility (in the US). The lease had a clause that I would not store anything worth more than $1000; had I gone through with the rental and left my car as I had planned, I would have been in instant violation of the lease agreement.

city41• 7 years ago

Insurance is best when covering replaceable things: cars, houses, etc. Had this guy had insurance, he’d likely have been compensated (for sure better than nothing), but would still be without his watches.

otterley2• 7 years ago

In this particular instance, the victim was collecting these items not for their sentimental value, but for their monetary value, as he was planning to fund his retirement with them.

So here, I suspect the victim would have been compensated fairly -- and reasonably satisfied to receive payment -- in cash, as opposed to replacement of the lost items.

belorn• 7 years ago

Here in Sweden it has been very clear for the last 20 years that banks consider anything non-digital to be legacy and aspects of banking that should be closed down to reduce costs. They know where the profits are and where it scales.

wesammikhail• 7 years ago

As far as I know, only a handful of banks in Stockholm still have safe deposit boxes. I even tried to start a safety deposit box business as a private non-bank related thing. I can´t even begin to describe to you what type of regulatory hurdles and red-tape I was faced with when trying to get that up and running. It´s pretty clear at this point that the entire system here is trying its hardest to reject everything of a non-digitalized and traceable nature.

For the longest time I used to believe that it is because Sweden is first to embrace new "technology". I have now come to understand now that it is something completely different and it will come back to bite this country in the ass in the not too distant future. I would be surprised if our economy even survives another decade without some serious restructuring.

kartan• 7 years ago

I can´t even begin to describe to you what type of regulatory hurdles and red-tape I was faced with when trying to get that up and running.

I can imagine how harder it is than in the USA. From the article: "The combination of lax regulations and customers not paying attention to the fine print of their box-leasing agreements allows many banks to deflect responsibility when valuables are damaged or go missing."

Consumer protection is usually is a hassle for business. But, it is needed if you expect companies to behave even close to what is the public expectation. I understand that for business the lax regulation in the USA and the complete lack of rights of consumers make easier to get profits, even if it's at the cost of your own customers.

I have now come to understand now that it is something completely different ... I would be surprised if our economy even survives another decade without some serious restructuring.

These are very strong statements at the same time that quite vague. Did I miss something? Can you explain what do you mean?

cantrevealname2• 7 years ago

I even tried to start a safety deposit box business as a private non-bank related thing. I can´t even begin to describe to you what type of regulatory hurdles and red-tape I was faced with

I imagine that the self-storage business in the USA is a very low regulation business, much less than opening a restaurant for example. How is the regulation for a (non-bank) "safety deposit box" business in Sweden any different than a self-storage business?

According to Wikipedia[1], the USA has ~52,000 self-storage businesses whereas Sweden has only 112. So the USA has wildly more self-storage than Sweden on a per capita basis: one storage place for 6000 people vs 92000 in Sweden. Are regulations worse in Sweden because self-storage is not a thing?

[1] https://en.wikipedia.org/wiki/Self_storage

charlesdm• 7 years ago

They're first to embrace technology, because digital money is money that can be tracked. So the tax "take" will be higher with digital money than with cash. High tax countries have all the incentives to go digital as soon as possible.

marvin• 7 years ago

I have now come to understand now that it is something completely different and it will come back to bite this country in the ass in the not too distant future.

Do you have some additional thoughts on what this "something completely different" is? I'm a Norwegian and follow the political developments in Sweden with great interest, and sometimes a degree of morbid fascination.

I get the impression that, among other things, there is a push towards greater surveillance and tracking of everybody's spending behaviors, coupled with a political correctness craze that seems to divert the attention from more central issues. Would be curious if you had any thoughts on the powers that drive these developments, or whether there is anything related that's not too obvious.

gniv• 7 years ago

As a European living in the US, I fully appreciate the loose regulatory system here. Lots of businesses start by breaking some sort of existing norm, or even law. As you hinted in your comment, it's not enough for the government to want to embrace technology. France is another example that has been talking about this forever, but I don't see much come of it (maybe it made the govt itself more efficient?). They really have to internalize that rules need to be broken with impunity for innovation to happen.

maxerickson2• 7 years ago

Did you consider starting a self storage business that happened to have excellent security?

benj1113• 7 years ago

I can't help thinking this is short sighted of them.

In the days when banks needed branch networks and physical money the barriers to entry were high. We're now getting to the point where new entrants can, and increasingly are entering the marketplace.

I suppose you could argue that these new entrants are going to enter the online only marketplace anyway, but then how are the established banks going to differentiate themselves? What advantages do they have? Apart from a legacy Cobol codebase.

zvrba5• 7 years ago

In Norway I used to have a deposit box to safe-guard important papers, like birth certificate, "statsborgerbrevet" (confirmation of citizenship), old passport (as proof of previous citizenship), etc. Then the bank shut down the operations, they said it was decided so by the government which was worried about fortunes (and "other (unspecified) stuff") being stored, untraceable and untaxable.

I also used to have a safe in my previous apartment (with less valuable papers), had a break-in and they didn't bother opening it there, they took the whole thing weighing 40-ish kg.

So where am I supposed to store such kind of valuables now?

F*ing stupid government.

distances4• 7 years ago

birth certificate, "statsborgerbrevet" (confirmation of citizenship), old passport (as proof of previous citizenship), etc.

Aren't these kinds of documents just representations of the fact in Norway? That is, the document itself isn't important and you can just request a new one when needed?

bobowzki• 7 years ago

Safes need to be bolted to the floor/wall as you discovered.

0xDEFC0DE• 7 years ago

So where am I supposed to store such kind of valuables now?

If all the banks are dropping this service, there's probably other companies that will start doing it.

Could you drive to Sweden and store them there if you don't need them that often?

tzs2• 7 years ago

I also used to have a safe in my previous apartment (with less valuable papers), had a break-in and they didn't bother opening it there, they took the whole thing weighing 40-ish kg

Do you think they would have taken it had they known what was in it?

I have some papers, and some data discs, that would be of no use to a burglar but that I would rather not lose. I keep them in a small safe (14 kg, 10 liter). I keep it out in the open and unlocked. The hope is that if it draws a burglar's attention, they will see that the contents are useless and either ignore it, or if they decide they like the safe itself dump the content and just take the safe.

If it were locked they might imagine all kinds of valuable, untraceable things I could be keeping.

So why even have a safe if I don't lock it? Because it is rated to keep papers and CD/DVD discs safe for one hour in a 1700℉ (930℃) fire.

benj1113• 7 years ago

Matt Levine covered this a few days ago.

https://www.bloomberg.com/opinion/articles/2019-07-22/don-t-...

jraby3• 7 years ago

He actually repeatedly sites and quotes The NY Times article.

benj1113• 7 years ago

Yes? I find Matt Levine normally has an interesting and insightful way of looking at things, so I put it here.

stevekemp• 7 years ago

For the future it is "cites" rather than "sites".

mnm1• 7 years ago

What? Banks stealing from their customers? Why never. But seriously, who is surprised? That's what banks do. They steal. They steal small amounts in wrong fees. They steal huge amounts in bailouts. They steal medium amounts in between. And of course there is no regulation so there's no recourse. How surprising that an unregulated industry steals and fucks over its customers to the largest extent possible. Not. It's the American way. For people that have no morals and don't care about fucking over and hurting others, making money is easy especially in the US. I sometimes wish I fell into that category. I'd make millions as do all these entities and people with no conscience. The corporation is the perfect vehicle for such actions. But unlike the people running these banks, the people regulating them, and the people advocating against regulation, I have a conscience that doesn't allow me to get rich in this way. Expecting banks to behave in such a way is madness, however.

anticensor3• 7 years ago

North American banks are regulated too, just in a very different (and more archaic way) from Eurasian system.

kinleyd• 7 years ago

"Wells Fargo had apparently tried to evict another customer for not keeping up with payments, and bank employees had mistakenly removed his box instead."

Wow. The incompetence is truly amazing.

hannob2• 7 years ago

I don't know how people who have jewelry worth millions usually act.

But honestly... it strikes me as a bit odd that you'd put objects worth many millions in a box that costs a $246 fee per year and then expect high safety standards.

cantrevealname2• 7 years ago

What would you do if you had jewelry worth millions? At first blush, a safe deposit box seems utterly logical. Even after reading the article, I can't think of any alternative other than avoiding Wells Fargo.

perlgeek• 7 years ago

Buy a safe in your own house, and then get insurance?

Or rent a safe box and get separate insurance?

fencepost2• 7 years ago

I would not be surprised if some jewelers offered secure storage of this sort as a service once you hit a certain level. There may also be a significant difference in the services offered in "consumer" banking and "private banking for high net worth individuals."

close042• 7 years ago

They're not putting millions in a $246 box, they're putting millions in a bank. The same way you might put all your savings in a bank account that not only costs you nothing, the bank actually pays you for it (via interest). So if tomorrow your life savings disappear would the "what did you expect from a service you were paid to receive?" question seem reasonable?

Lobby and interest groups are strong enough that laws that actually look after the customer rather than the corporation are few and far between.

tialaramex4• 7 years ago

The money is different because you're actually lending it to the bank. The government guarantees you'll get it back (up to some limit) in most countries, but that's why they can afford to operate this business.

You are not loaning the valuables in a safe deposit box to the bank, they're just storing them, which is why it costs money. Maybe it should cost more money.

hannob2• 7 years ago

I don't own millions, but I guess if I did then no matter if I'd put money worth millions on the bank or jewelry worth millions I'd have someone with a legal degree reading the ToS for me to tell me if it's an appropriate offer for that amount of money.

methou2• 7 years ago

The only things that sit in my safe deposit are password protected GPG paper keys, revocation certificates, and, OTP recovery sheets.

There's a local bank near my workplace provides such a service, and I use them as a last resort of crypto id recovery. The downside is that they have a fingerprint system, but they do have a human agent to verify your identity.

JabavuAdams• 7 years ago

Those are some pretty important "only things". If you're concerned enough to have thought about and acted on this, why would you entrust these things to an inscrutable third-party?

methou2• 7 years ago

These are the 3rd parties that are held accountable by law and regulations.

Youden• 7 years ago

I live in Switzerland and even here you're usually not covered, despite the reputation for banking. You can buy separate insurance however and some non-bank safe deposit boxes come with insurance.

BlackFly• 7 years ago

Isn't this just covered by ordinary tort law? There is a duty of care, there is a lapse of said duty. The issue seems to be that people are putting valuable items into it and then signing a contract that says that the limit of liability is limited to much less than the value. If that isn't negotiable with the bank then the bank is just not willing to accept the risk. Then either you can find an insurer who is willing to accept the risk or you can find a different bank who is willing to accept the risk or you can build a safe yourself since all the risk is on you anyways.

There doesn't need to be special laws for everything.

onetimemanytime• 7 years ago

OK, but even if there was no limit in damages, what did you have in there? How do you go about proving it when it's only you putting and taking things out of there.

ghaff7• 7 years ago

The same way you do with house contents for an insurance policy? Photos and other documentation are useful.And no insurance policy is going to be unlimited. Specific very high value items will be enumerated.

derefr3• 7 years ago

That's the job of a notary, usually.

zxcvbn4038• 7 years ago

In the case of banks I think they have proven conclusively that they do need laws for everything and extensive oversight to ensure they are complying with those laws. They are always looking for loopholes and just the right wording to put their interests in front of yours. At least in the US, maybe banks are better behaved in the rest of the world. In the US we have three federal agencies and countless state agencies all dedicated to keeping the banks in line and they all stay busy.

jeffdavis• 7 years ago

As the article says, banks are trying to get out of this business. They are probably just there to avoid angering customers who already have one, and to appeal to the nostalgic sense of a bank being a physical thing.

Not sure what regulation will really accomplish other than giving them an excuse to exit the business faster.

beatgammit• 7 years ago

If we are to add a law here, I think it may make sense to require contracts to be easy to understand and as short as is reasonable. I think it's pretty reasonable for someone to skim over fine print especially for something that seems obvious.

Something like a safe deposit box should be a single page document with something like this:

- cost is $X/month and prices are revaluated every Y months and can increase by a maximum of $Z/month - may access the box X times/month without any additional fees - bank's liability is max $X or Y months of rent, whichever is higher/lower - if rent is not paid, X happens, and after Y months of non-payment, Z happens - policy/fee for lost keys

I haven't actually opened one, but I wouldn't be surprised if the contract was 10 pages long and the maximum liability was somewhere in the middle in fairly small print.

grepgeek• 7 years ago

I like the way Creative Commons licenses do it. First there is a simple bullet-point-wise summary for layman like this: https://creativecommons.org/licenses/by-sa/4.0/ . Then there is the entire legal code for lawyers: https://creativecommons.org/licenses/by-sa/4.0/legalcode .

I think all contracts should be written like this. If any clause of the legal code contradicts the summary for layman, then the summary for layman should take precedence during its interpretation in the court.

This practice is not unusual. Books often start with a preface or foreword. Very dense technical or research papers start with an abstract and introduction. But for some reason contracts do not follow this practice.

bzbarsky• 7 years ago

We could also take the mortgage approach, where the actual contract is in fact very long, but there is a required simple-to-understand cover sheet that summarizes all the pertinent details in a clear way.

ralphc• 7 years ago

How would that help with this - "Banks typically argue — and courts have in many cases agreed — that customers are bound by the bank’s most-current terms, even if they leased their box years or even decades earlier."

cascom2• 7 years ago

Quick google - Chase’s contract below, bold print middle of the first page.

https://www.chase.com/content/dam/chase-ux/documents/persona...

_bxg1• 7 years ago

I would say the law that's needed is advertising-based. There's a huge disconnect between what "safety deposit box" means to people and what those actually, legally, are in 2019 according to the fine print. That's the main issue.

Imagine if it were legal for companies to pass something off as a "bank account" when they weren't actually a bank. And it explains it all in the fine print, but as we all know nobody reads the fine print, especially when the offered product is so seemingly familiar. We'd have fly-by-night operations losing people's money left and right, and then legally washing their hands of it.

kube-system• 7 years ago

Imagine if it were legal for companies to pass something off as a "bank account" when they weren't actually a bank.

Robinhood’s attempt at checking accounts come to mind...

https://www.forbes.com/sites/jeffkauflin/2018/12/14/sipc-hea...

otterley2• 7 years ago

There is a duty of care

Attorney here! (Not legal advice -- consult a licensed attorney in your jurisdiction).

In order to prevail in a negligence case, you have to establish duty of care in your complaint. You can't simply declare it exists and expect a court to accept it without question.

That said, I generally agree with the rest of your comment. You can always tell how much entities are really looking out for your interest by reading their limitations-of-liability clauses. Wise consumers should purchase insurance to cover the gap.

tzs2• 7 years ago

Wouldn't it be more efficient to put the risk on the bank, so that it is the bank that seeks insurance to cover that risk?

As a consumer, I have no idea what the risks of a safe deposit box are, and so have no idea what I need in the way of insurance to cover those risks.

The bank, on the other hand, has real data about the safety of their safe deposit boxes, and the value of loses when those boxes are compromised.

nullc2• 7 years ago

Wouldn't it be more efficient to put the risk on the bank, so that it is the bank that seeks insurance to cover that risk?

No, because the value stored in the boxes differs by orders of magnitude and the bank doesn't even know the value.

$200/yr is just not a reasonable amount of payment to take on a 10s of millions of dollars liability, and most box customers wouldn't pay whatever price would make that liability reasonable.

(Based on the 500x annual cap mentioned in the article you could imagine that the bank would want $20k/yr for a $10m liability)

tacostakohashi• 7 years ago

As soon as there were multiple boxes with the same number in a single vault, this course of events was pretty much inevitable.

If the bank is not competent enough to assign unique numbers to each box in the first place, of course they aren't going to be competent enough to only ever empty the correct one of several boxes numbered #105, or to handle to contents safely.

It's difficult to comprehend how the bank thought having non-unique numbers would be workable. If non-unique deposit box numbers seems ok, why not non-unique bank account numbers? Or why even go up to #105, just number them all #1?

I'm always fascinated when people find a way to undermine a simple, workable system and end up with something worse than no system, or the state of affairs before the system existed.

amichal• 7 years ago

I learned the hard way several years ago that a bank I used to have will happily cash two checks with the same check number the same amount and the the same recipient (on the same day even).

Apparently check numbers are for my convenience not for any sort of auditing on their part.

muzika• 7 years ago

I had this happen once too, and was shocked that bank allowed same check to be deposited twice.

dreamcompiler• 7 years ago

Likewise signatures.

https://news.ycombinator.com/item?id=4344941

clintonb• 7 years ago

This is correct. When you order checks you decide The start number. Check processing is quite interesting. Banks can either be very lax or very restrictive in what checks they will accept.

cascom2• 7 years ago

On the one hand, obviously the bank was incompetent. But shame on the guy in the article for not having his items insured. This is a pretty standard rider in most home owner’s insurance policies (or an easy separate policy). Typically the policy is incredibly cheap if the items are stored in a safe deposit box, and if you take them out you call the insurance company and tell them that, the items remain insured but at a higher daily rate, and you call the insurance company and tell them when the items go back in the box, and the rate goes back to the low rate.

jdlshore• 7 years ago

The article doesn't say the items weren't insured. Shame on you for victim-blaming.

It did talk about the sentimental value of a lifetime of collecting one-of-a-kind timepieces. That can't be replaced by an insurance payout.

Simulacra• 7 years ago

I think this goes to show that banks really don’t care about customers, and they don’t care if something goes wrong. They only care when they get caught and they have to pay for it.

segmondy• 7 years ago

s/banks/most businesses/

julienchastang• 7 years ago

The banking industry is rife with malfeasance and incompetence, Wells Fargo especially [1]. This is yet another example.

[1] https://www.thinkadvisor.com/2018/07/30/a-timeline-of-wells-...

mitchtbaum2• 7 years ago

Don't have access to a decommissioned mine? Nor, a deep underground military base?

Well, you're still in luck.

You can search how to bury your stuff, ie:

http://www.howtoburyyourstuff.com/

Really.

nullc2• 7 years ago

After looking at that site I expect that if I could find the author's full name and googled it, the results would be full of posts at metal detecting forums.

The whole site appears to be really bad advice-- instructing you to bury large metal containers of your valuable stuff on land that isn't yours. It is the stuff of detectorists fantasies.

mitchtbaum2• 7 years ago

~ land that is/isn't yours

You have that the other way around...

..if I could find.. ..would be full.. ..fantasies.

Would you want to bet on how these guesses will pan out and see how this approach looks after sincere efforts to analyze it (for wealth preservation or other uses)?

that site

There'rrr others worth looking at; probably others that contradict a good portion of it, or just have another point of view.

fencepost2• 7 years ago

It seems that one of the most important things to start with is a page right at the top of the box with "IF THIS BOX HAD TO BE OPENED" followed by notes about payment for the box, multiple contact methods including through several third parties (friends, family, employers), etc. with mailing addresses, phone numbers, email for each. Heck, include several pre-addressed letters or envelopes with (in the USA) "Forever" stamps already on them.

Work from a basis of "mistakes happen, how can I minimize the impact?"

Safe Deposit Boxes Aren't Safe

Related Stories