Hacker News Reader

Comment by jedberg | Hacker News Reader

Banks use eventual consistency for your balance. You just don't notice because it's usually really quick.

The reason the ATM has a limit is because it's eventually consistent. It's possible you just went to another ATM and drained your account, but that hasn't reached the main office yet.

They are limiting their risk by allowing you to defraud them of up to $500 (or whatever your limit is).

View on HN

Do you know that, or is it your conjecture? There are a lot of other possible reasons to use $500 as a limit. For example, preventing people from structuring withdrawals at the ATM, preventing an accident from producing too much cash, limiting the frequency with which ATMs need to be serviced, and limiting the downside of unauthorized withdrawals.

It is true in some sense that the banking system is eventually consistent, because commands can be issued asynchronously. For example, you can issue a check, and expect it to be drawn in the future. However, that does not necessarily apply to the ledger itself, and given what I understand about banking technology, I'm somewhat surprised if it is truly as you describe.

If it is indeed a conjecture of yours, I urge you to make it more clear in your comments when you are speculating and when you are speaking with authority.

I know that. I've talked with people who work on banking systems who have confirmed it.

It's true there are other reasons for the limits, such as the ones you listed, but if you are with say Bank of America, your limit and my limit can be different. The more credit history you've built up with the bank, the higher the limit will be. This is mostly because they trust you more and therefore consider the risk for defrauding smaller.

It takes a fraction of a second to send the withdrawal to the main office - how would a scam based on this really work? A second card with another person at a different ATM? Even then, you'd think you could serialise per-account without affecting throughput at all.

I'm not sure but I've seen Visa terminals that behave as if they enter some kind of offline mode when their ancient GPRS connection in the middle of the woods time out. In this mode you can only do smaller purchases and they are then later sent to the bank once the store gets a connection. This is for Visa debit btw, not credit.

Sure, a fail-safe mode makes complete sense. I'm just doubtful that there's a need to be in this mode 100% of the time.

Here is a news article from 2013 about such a scam:

http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-...

There's not really enough detail here to support either point of view. There's hacking & skimming in addition to hitting withdrawal limits. It's arguable form the article's information that implicitly trusting up to the withdrawal limit was partly to blame. I'd prefer to see some evidence that it's necessary to put this trust in place at all.

> It takes a fraction of a second

99.999% of the time? It's impossible to guarantee that 100% of the time.

And it would still be acceptable to wait 0.001% of the time, would it not? Or degrade to limit mode in that situation?

It's worth noting that in general there's no "the banking system" (unless we're talking about particular single systems e.g. Fedwire), there's a mismash of many different, highly diverse systems used by different organizations having quite opposite properties - for example, in the context of the comment above, I happened to participate in a cards system migration some 15 (?) years ago where the old system did have the eventual consistency issue described above (mostly mitigated by limits, there were just a couple times where double-spending happened), and the new system ensured strong consistency. So it can be one way, and can be the other.

I have worked at a bank and they definitely didn’t use eventual consistency for transactions. Money could be in flight when it transitions inside the bank, but never to client due to fraudulent behaviors, regulations etc. However not all transactions were not dealt with electronically and they were treated differently and mostly outside the systems until effective.

I really do not think this statement is true. AFAIK the limits are in place to limit fraud (if someone has skimmed or stolen your card) and to prevent theft (someone mugging you as you withdraw a huge amount of cash).

If what you are saying is true it would be possible to go overdrawn at an ATM. This (again AFAIK) doesn’t happen as there is a call to check your balance.

The banking system is rather complicated. I think it would be possible to overdraw in some situations.

See also this article where hackers stole $45 million from ATMs:

http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-...

> If what you are saying is true it would be possible to go overdrawn at an ATM.

It is most definitely possible, it just rarely happens because the network doesn't fail often.

See here for more sources: https://www.google.com/search?q=eventual+consistency+atm

Reply on news.ycombinator.com