This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from

This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$ It would actually be really interesting if they faxed in transfer forms or something.