I had a similar experience with a bug in a SaaS product that integrated with bank websites. They would send us the user ID and we would use that to determine wh

I had a similar experience with a bug in a SaaS product that integrated with bank websites. They would send us the user ID and we would use that to determine whose account to log them into on redirect (and create a new account for the user if we hadn't seen the ID before). At some point it became clear that they ignored leading zeroes during login on their end, but still included those leading zeroes when they sent it over to us, so we had a number of duplicate accounts. I purged the duplicate accounts (delete the newest, strip the leading 0s off the oldest) at the same time that they changed their code to send over the truncated number. All went perfectly, except apparently a few spouses were upset that they could no longer use their secondary account.