8 ms·
Citi Missed a Fat Finger
- bombcar 2y agohttps://archive.ph/9w0Ey https://archive.ph/9w0Ey
- Symmetry 2y agoI'm sure there have been more expensive UX failures (Three Mile Island?) but if there's ever a Wikipedia list of them I'm sure this will be on it.
- zerocrates 2y agoTherac-25 comes to mind...
- Aloha 2y agoTherac-25 was at least more deadly. Also much more complex than a UX failure.
- zerocrates 2y agoCertainly there were several intersecting issues there, but UX was a significant one.
- yummypaint 2y agoMy main takeaway from that was that software checks aren't an acceptable replacement for hardware interlocks... A lesson we seem to be collectively unlearning
- ThrowawayTestr 2y agoHawaii missile alert incident.
- dmckeon 2y agoThe comp.risks archive is at http://catless.ncl.ac.uk/Risks/ http://catless.ncl.ac.uk/Risks/
- sickofparadox 2y ago"You get 711 alerts, you only see 18 of them, you are like “ehh 18 alerts is pretty much the normal number,” you override them all without reading." I believe this is called an 'alert that cried wolf'.
- Arrath 2y agoAlarm Fatigue
- pjacotg 2y agoThere's a 99% visible episode [1] on this very issue. Worth a listen! [1] https://99percentinvisible.org/episode/sound-and-health-hospitals/ https://99percentinvisible.org/episode/sound-and-health-hosp...
- blackeyeblitzar 2y agoThis is a phenomenon in so many different jobs, and is called “alarm fatigue”. From https://www.nytimes.com/2010/08/01/weekinreview/01wald.html https://www.nytimes.com/2010/08/01/weekinreview/01wald.html: > On Tuesday, the National Transportation Safety Board said that a crash last year on the Washington subway system that killed nine people had happened partly because train dispatchers had been ignoring 9,000 alarms per week. Air traffic controllers, nuclear plant operators, nurses in intensive-care units and others do the same.
- mgkimsal 2y agoand... 'fixing' it can cause its own issues. I've been involved in some systems that routinely spit out dozens of warnings per day. After 'fixing' some of them - maybe getting a system down to a few per week, bug reports started coming in that the system was 'broken'. Because people noticed the boxes and messages they routinely ignored were gone, and this must be a problem. Lots of re-education may need to happen on a large scale to actually 'fix' alarm fatigue across the board.
- 2y ago
- deleted 2y ago[deleted]
- 1024core 2y agoDon't worry, AI and LLMs will save us.
- thatoneguy 2y agoWait I thought blockchain was going to save us?
- aidenn0 2y agoThe blockchain turned out to be too complicated for humans to understand, so AI will leverage the blockchain using NoSQL to save us.
- lupire 2y agoProbably. AI and LLM are pretty good at detecting extreme outliers and staying on the highly probable path.
- tedunangst 2y agoYou think the problem here is that the outlier wasn't detected?
- brookst 2y agoIf by "detected" we consider the E2E chain of humans and computers, then yes, that was the problem.
- deleted 2y ago[deleted]
- stalfosknight 2y agoYes, the solution to this problem has to be to shove AI into Citi's order management system somehow.
- tedunangst 2y agoAs for the second story, "I’m kind of with Revolut here, but on the other hand, if they’re so sure it’s a scam maybe they should just not allow the transfer? Even if the customer sends the selfie? Perhaps you want a hard block here." Do people want a block? Every story about a bank blocking a transfer draws tons of outrage. It's my money, I can send it where I want, no questions, you can't stop me, how dare you.
- aidenn0 2y agoIt's lose-lose. You get punished for the scams you stop and punished for the scams you don't stop.
- ptsneves 2y agoIn millennium bank Poland every time I need to move a bigger amount of money they ask me for my handwritten signature which always fails to validate. Of course the more I fail the more I get nervous about it and fail to draw my signature appropriately. If I need to move big amounts it is because I need to, like buying a house or something life changing. Several times I thought what am I going to do now? What is my appeal? The appeal is simple: ask to change the signature beforehand and the proceed with the operation. Damn stupid. It is like presenting my authentication token, failing and then escalating my privileges to obtain the higher order verification token required.
- dkarl 2y ago> However, as data from that external feed was unavailable, the price of the value of the Index instead defaulted to -1 To me, this reeks of a couple of bad experiences I had repeatedly as a back end developer coordinating with the front end: 1. Demanding that my services always returned correct-looking data, even if it wasn’t available, because they couldn’t (or wouldn’t) handle errors. The story always went like this: if a service returned a 4xx, it would trigger an exception in their front end code, and they didn’t want to tackle the complexity of handling potential errors from a bunch of different back end services. I’ve had this one get escalated to management before, who fortunately supported me. 2. Resisting efforts to ensure that potentially dangerous values were displayed in attention-getting ways. Anything that didn’t look aesthetically harmonious was liable to get “fixed” without any consideration for why it was presented in a visually jarring way in the first place. As a back end engineer I sometimes lost this battle, since it was outside of my jurisdiction, but when I could, I looped in users or a product manager to help stop the madness.
- ploxiln 2y agoMaybe not as bad, but similar ... I've had a frontend dev say they needed to see designs from the designer before they could add any kind of error message or indicator. The status-quo is just silence, the page just stops doing anything. This is not unusual for various SPAs I've seen around the web. It is unfortunately a typical experience to click something ... no response? click again? wait how long? refresh? hello? Have the designer design it, sure, but until that happens, you have to show something for auth expired (tab suspended for a long while), connection failed (flaky wifi), or 5xx from service - as much as I may try to make that never happen, it is possible (database failover for a few seconds?), and the design can't just be "there shall be no errors", you can't decide that.
- Muromec 2y agoThat's often a problem with designers -- they only make a happy flow and only the end of it. No in-between states, don't understand the latency and errors exist, don't dig into boundary conditions and edge cases. It's a typical no-my-job-svg response to boot the problem upwards so their manager will make them aware of those pesky things.
- z_zetetic_z 2y agoI've been in the room when it happened. In one memorable incident, a junior trader I sat opposite bought 100 bn Japanese Yen instead of 10 bn. His excuse? "I lost track of the zeros". We'd only hired the guy because he had a PhD and "PhD's are smart" - lol. In his defense the UI was awful. He left soon after...
- coldpie 2y agoJapanese uses different "groups" of powers of ten, maybe that tripped him up? 1; 10; 100; 1 x 1000; 10 x 1000 versus 1; 10; 100; 1000; 10000; 1 x 10000; 10 x 10000; 100 x 10000 https://en.wikipedia.org/wiki/Japanese_numerals#Large_numbers https://en.wikipedia.org/wiki/Japanese_numerals#Large_number...
- z_zetetic_z 2y agoNo, the gui input field das just 100000000000 vs 10000000000. Oops
- brookst 2y agoSo 2048 instead of 1024?
- z_zetetic_z 2y agoGood one!
- taskforcegemini 2y agowithout any dots? in that case "losing track of zeroes" seems a valid excuse
- reducesuffering 2y agoPhD's are usually smart. Your business was not, for allowing 100 billion Yen trades by manually entering 12 digit numbers with no punctuation.
- 2y ago
- heisenbit 2y agoReport with rationale for the fines: https://www.fca.org.uk/publication/final-notices/citigroup-global-markets-limited-2024.pdf https://www.fca.org.uk/publication/final-notices/citigroup-g...
- vlovich123 2y agoStupid question since I’m not in the fintech space. Why is a trader responsible for manually filling out an order to hedge against a sell order from a customer?
- JumpCrisscross 2y ago> Why is a trader responsible for manually filling out an order to hedge against a sell order from a customer? The only manual component is specifying the size. As to why the client isn't doing it, this order might have been placed over the phone. Or it may be part of a more-complicated strategy that required some finesse.
- hnbear 2y agoThese sorts of errors are frequent and pervasive in finance. Not just numbers. I worked on a ref dare system with minimal input validation. Copy/pastes would leave in white spaces, new lines, etc. This would then break trading which tried to execute them. Aged 17/18 at a summer work program at a fund (~2000) I was given Excel and Bloomberg and had to calculate risk across client portfolios. Messed up the manual input of one by a zero resulting in the whole portfolio getting rebalanced, then un-rebalanced. The same team passed off a trade via paper slip saying it’s yen. The person entering it didn’t recognize the yen currency symbol, assumed it was a 7 and traded the full number prefixed with 7 in yen instead. Many many stories of many many errors.
- tremorscript 2y agoI like github's solution to deleting a repository. A popup makes you type the repository name before confirming deletion. In this case, if the value is unusually high say greater than 100 billion, make the trader type 100 billion before proceeding. I confess that I also ignore popups and just click ok. This is where i appreciate github asking me to type the name of the repository, just to make sure that I know what I am doing.
- DANmode 2y agoHow long are these messages that your reading speed doesn't burn through it faster than it takes to click or tap the button...?
- tremorscript 2y agoPeter see OK button. Peter click OK button. Peter no read or have a thought.
- blitzar 2y agoI always just copy the thing it told me to write and paste into the relevant field - often without reading or comprehending what it says.
- hi-v-rocknroll 2y agoWhen entering and exchanging potentially very large money amounts, it behooves risk management of entered, encoded, and transmitted prices carefully like the following: NDC. N = Length of string D D = [0-9]+\.[0-9]+ C = 2 check digits using IBAN method against ND
- thombat 2y agoIt doesn't seem that this would have helped here: the trader entered exactly the number that they intended to, just that their intent was misconceived.
- hi-v-rocknroll 2y agoPerhaps and perhaps another compounding factor was error-prone UX such as not displaying total estimates prominently or the presence of options leading to order-of-magnitude differences. But the intent of what I suggested is to guard against many classes of errors including data entry, storage, transmission, and interpretation.
- csunbird 2y ago> When the trader checked the value of the inputted basket, they were presented with a figure of negative 58 million for the value of the basket (58 million multiplied by -1). The trader saw a ValAtBM of -58,000,000, which was the number they expected to see, and thus they clicked Execute to continue to the next check. It wouldn't help.