Info on Refpay and 3-person JV crews

[BktBallRef]

Originally Posted by mtn335

My biggest concern about RefPay is that I've heard Arbiter stores passwords in plaintext. That seems like a scary thing when related to anything to do with banking or money.

That's not true. It's no different than logging into the Arbiter. That password appears as ....... except for the last character keyed, visible for a few seconds.

Originally Posted by BillyMac

Four, of the seventy, high schools that we service have gone to RefPay. I'm sure that more will follow. I didn't bother me too much to give them my Social Security number, I've been doing that on W-9's (often left at the scorer's table, or on a desk in the coach's office) for years, but it did cause me to pause when they asked for my checking account number. Our assignment commissioner has allowed us to block out these four schools, but as more schools go to RefPay, I'm not sure that he'll be able to continue to allow us to do that.

It's pretty difficult to transfer your game fees to your bank account without having your account number. Giving them your account number is no different than making a purchase or paying a bill online.

But if you prefer, they will mail you a check or credit it to a ArbiterPay debit card, both for a fee.

________________________

3 man JV games - We've had 3 man crews in several leagues for around 15 years. The problem with most associations that are still working 2 man is they don't want to reduce their game fees at all in order to incorporate a 3rd official. That's what it's going to take in most areas to get 3 man added.

[Camron Rust]

Originally Posted by mtn335

My biggest concern about RefPay is that I've heard Arbiter stores passwords in plaintext. That seems like a scary thing when related to anything to do with banking or money.

Originally Posted by BktBallRef

That's not true. It's no different than logging into the Arbiter. That password appears as ....... except for the last character keyed, visible for a few seconds.

That isn't what he's talking about. He's referring to how passwords are stored in the system's database. There are good ways to do it with varying levels of security but storing them in plaintext is the absolute worst way.

I can't say for sure how they actually do it, but if a system can email you your password when you forget, then they might not be storing it in plaintext but are definitely not doing it the best way.

[Altor]

I sent an e-mail to them expressing my displeasure about the password thing. They replied with a link to a forum on their site discussing the matter. Their tech posted in that forum that they do not store the password in plain text in their database. It is encrypted, along with the social security numbers and taxpayer ID numbers, in a manner that allows it to be decrypted, which is how they are able to e-mail it to you when requested.

He claimed they are working on a one-way hash method for passwords so that it cannot be decrypted, but the SSN and TINs must remain in the encrypted format so they can be used in reports, etc.

3-person JV is pretty rare here, most schools don't have the money. There is one assignor who requires 3-person JV at the schools he assigns but that's about it.

[RefCT]

Originally Posted by Altor

but the SSN and TINs must remain in the encrypted format so they can be used in reports, etc.

AKA send you 1099's and report how much they pay you to the gov't. You are not getting paid by the schools/associations. They are funding their RefPay account and RefPay pays you, so if you get paid over $600 in ArbiterPay throughout the year, expect a 1099.

Also, in our area, the individual schools determine if/when they want 3-person, not the association. I have never seen a 3-person JV game.

[Mregor]

Originally Posted by RefCT

They are funding their RefPay account and RefPay pays you, so if you get paid over $600 in ArbiterPay throughout the year, expect a 1099.

I got a 1099 from one association when the total was $100. Arbiter will issue 1099 for every cent. Need to keep track of your expenses.

Only downfall is when schools don't pay you right away. Some don't have money in their account. I waited a full month to get paid for one goy/girl double header. Can be difficult to keep track of who pays when your schedule gets hectic mid-season. You have to request transfer but if you want automatic, they deduct a few dollars for each. No thanks, I'll request my own.

[#olderthanilook]

A couple of thoughts....

My assignor has been using it for a few years now. And, he's getting more and more high schools to utilize it in the greater urban area where I live.

Most of the outlying schools that are smaller class and use a different assignor(s), still issue checks on game day.

I actually prefer game checks on game day. Done deal. Some of the ADs I talk with prefer checks on game day too because they are done with the whole thing on the spot. Refs are paid and they move on to the next business at hand.

The thing I don't like about the Refpay situation is that schools that used to pay by check on game day now tend to wait a day or two after the game to deposit funds to my Refpay account. Then, it can take up to 2 or 3 days for the EFT to hit my bank account from Refpay. So, it's gone from getting a check on game day to getting funds up to 5 business days later.

Not a huge deal, but definitely something I had to get used to when balancing my officiating book.

[Altor]

Originally Posted by #olderthanilook

So, it's gone from getting a check on game day to getting funds up to 5 business days later.

And with mobile banking, I can deposit the check at half time by taking a couple pictures with my phone.

[mtn335]

Originally Posted by Altor

I sent an e-mail to them expressing my displeasure about the password thing. They replied with a link to a forum on their site discussing the matter. Their tech posted in that forum that they do not store the password in plain text in their database. It is encrypted, along with the social security numbers and taxpayer ID numbers, in a manner that allows it to be decrypted, which is how they are able to e-mail it to you when requested.

He claimed they are working on a one-way hash method for passwords so that it cannot be decrypted, but the SSN and TINs must remain in the encrypted format so they can be used in reports, etc.

I'm glad to hear this. It's still not as good as a hash - encryption can be and is compromised, as it more or less depends on keeping the host's internal network (and thus the key) secure - but it's better than plaintext. They still shouldn't be sending people passwords in the open, though. Much better a controlled-and-timed reset link.

[Camron Rust]

Originally Posted by mtn335

I'm glad to hear this. It's still not as good as a hash - encryption can be and is compromised, as it more or less depends on keeping the host's internal network (and thus the key) secure - but it's better than plaintext. They still shouldn't be sending people passwords in the open, though. Much better a controlled-and-timed reset link.

Agree...and I've done it that way for years. Flattering to be copied.

[BillyMac]

Originally Posted by BktBallRef

... they will mail you a check or credit it to a ArbiterPay debit card, both for a fee.

Yeah, that's what I want to do, pay to get paid.

[BillyMac]

Originally Posted by BktBallRef

Giving them your account number is no different than making a purchase ... online.

Isn't it easier to for me to "fix" a "drained" credit (not debit) card than a "drained" bank checking account?

[Eastshire]

Originally Posted by BillyMac

Isn't it easier to for me to "fix" a "drained" credit (not debit) card than a "drained" bank checking account?

Visa and Mastercard both require banks to offer the same protection to their debit cards as their credit cards when they bear the Visa or Mastercard logo.

That said, it can potentially cause legitimate payments to bounce in the couple of days it should take to straighten things out. If that bothers you, it is as easy as setting up a separate account to receive these payments into so if something bad happens it's not happening to your main bank account.

My bank has been incredibly proactive, shutting access to my refereeing account before a single unauthorized transaction occurred when my card was compromised when Official Sports International got hacked. Likewise when Target got hacked. YMMV.