5 ms·

From an engineering point of view, the mere fact that these people were able to withdraw millions of dollars from five accounts in multiple locations simultaneo

From an engineering point of view, the mere fact that these people were able to withdraw millions of dollars from five accounts in multiple locations simultaneously is just absurd. Even if these guys had direct access to the database to be able to change the withdrawal limits and balances of the cards, any engineer with half a brain in charge of designing their back end would create a separate system that monitors transactions and does both security and reality checks. Same card being used within seconds at two locations 5 miles apart? Probably something funny going on. "Deposits" of millions of dollars on a single pre-paid card in a day? Might be unusual. These banks deserve to lose every dime they have to lose if they are this stupid, or are hiring such inept IT people.

rjbwork 14y ago
IT codes according to what the business wants. If the business folks don't want it after someone brings up such things because it would cost more money and take away resources from another project, it's not going to get done, and you'll see this kind of stuff.
mtowle 14y ago
Banks must hire among the most inept IT people of any industry. Every time I log into PNC, I literally switch tabs and try and "do something else" for at least a minute, because that's how long it takes their Virtual Wallet bullshit to load. At least, that's what the site says it's doing. Loading. Only they have "HTML5" emblazoned in huge letters on the page, for some unknown reason, which inevitably makes me wonder what the fuck is taking so long then. Let me guess, your SOAP requests are 3 miles long. Uphill. Through the snow.
- oldcigarette 14y ago
  I did an interview with them and it seems like they do hire the cheapest.
- hexonexxon 14y ago
  In my country theres a foreign worker scam that allows Indian companies to fly in the worst IT staff complete with fake resumes and pays them $6/hr for a year to screw up their website with dozens of SSL certs and slow security theatre that pretends to do something but is just a little flash to watch while you wait forever to load their junk software. major banks here all made at least a trillion in profit last year but couldnt be arsed to pay for legit IT staff. now we all suffer paying tax dollars to track down all these thieves who easily fraud their faces off with the terribad security and poor code quality
gnaffle 14y ago
I think you forget that the payment systems are designed to tolerate failure and still work. For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down. So it's possible to scam the system, but the banks probably figure that they would lose more money in lost transaction fees by implementing a 100% secure, ACID-compliant 2-phase commit payment protocol, than by keeping the current best effort authorization + batch processing system in place.
- downandout 14y ago
  >For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down. Actually, no. No approval code (which is obtained from the network), there is no purchase.
  - gnaffle 14y ago
    Well, at least where I live I've encountered this a few times. The payment terminal shows "connecting" for some time, and eventually prints out an extra receipt that I have to sign (whereas usually entering the PIN is sufficient). Can you tell me what goes on in that case?
    - daned 14y ago
      Sounds like debit failing and falling back to a CC transaction, but I am not a payments expert.
  - Swannie 14y ago
    Actually, yes. The transaction is stored, and fowarded later. It's a variant on the Card Number + Impression that used to be common place 20 years ago, and Card Number + CCV that is still common place in locations with intermittent/no connectivity. The prime example of this being done electronically is on planes, they have been accepting credit cards a large number of years before connectivity was possible.
    - 14y ago

rjbwork 14y ago

IT codes according to what the business wants. If the business folks don't want it after someone brings up such things because it would cost more money and take away resources from another project, it's not going to get done, and you'll see this kind of stuff.

mtowle 14y ago

Banks must hire among the most inept IT people of any industry. Every time I log into PNC, I literally switch tabs and try and "do something else" for at least a minute, because that's how long it takes their Virtual Wallet bullshit to load. At least, that's what the site says it's doing. Loading. Only they have "HTML5" emblazoned in huge letters on the page, for some unknown reason, which inevitably makes me wonder what the fuck is taking so long then. Let me guess, your SOAP requests are 3 miles long. Uphill. Through the snow.

oldcigarette 14y ago
I did an interview with them and it seems like they do hire the cheapest.
hexonexxon 14y ago
In my country theres a foreign worker scam that allows Indian companies to fly in the worst IT staff complete with fake resumes and pays them $6/hr for a year to screw up their website with dozens of SSL certs and slow security theatre that pretends to do something but is just a little flash to watch while you wait forever to load their junk software. major banks here all made at least a trillion in profit last year but couldnt be arsed to pay for legit IT staff. now we all suffer paying tax dollars to track down all these thieves who easily fraud their faces off with the terribad security and poor code quality

gnaffle 14y ago

I think you forget that the payment systems are designed to tolerate failure and still work. For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down. So it's possible to scam the system, but the banks probably figure that they would lose more money in lost transaction fees by implementing a 100% secure, ACID-compliant 2-phase commit payment protocol, than by keeping the current best effort authorization + batch processing system in place.

downandout 14y ago
>For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down. Actually, no. No approval code (which is obtained from the network), there is no purchase.
- gnaffle 14y ago
  Well, at least where I live I've encountered this a few times. The payment terminal shows "connecting" for some time, and eventually prints out an extra receipt that I have to sign (whereas usually entering the PIN is sufficient). Can you tell me what goes on in that case?
  - daned 14y ago
    Sounds like debit failing and falling back to a CC transaction, but I am not a payments expert.
- Swannie 14y ago
  Actually, yes. The transaction is stored, and fowarded later. It's a variant on the Card Number + Impression that used to be common place 20 years ago, and Card Number + CCV that is still common place in locations with intermittent/no connectivity. The prime example of this being done electronically is on planes, they have been accepting credit cards a large number of years before connectivity was possible.
  - 14y ago