A few years ago, when I had taken a mortgage to buy a house, I had the exact amount of the mortgage transferred into my account instead of going to the seller or wherever it was supposed to go - maybe to the seller mortgage provider?
I returned the money but I'm no hedge fund.
Ms Venn’s bank, the Commonwealth Bank, was able to freeze $138,000 of the funds, but the hackers who entered the system via her conveyancer’s account made off with the remainder.
“The $110,000 is missing and it’s not recoverable,” she said."
https://www.smh.com.au/business/companies/masterchef-finalis...
https://www.9news.com.au/national/masterchef-contestant-dani...
They are, but I'm surprised that there seems to be no 4-eyes principle on such high transfers. Having two (or three) employees sign off on any transfer above ten million dollars seems like a cheap precaution against blunders of this scale.
There are ways to engineer automated processes to prevent things like this from ever happening, for example, all transactions over, say, $10m, could be required to be signed using PKI keys held only on smartcards physically held by those involved - and the big-fat-table that holds transactions in their IBM Z-series would be automatically audited to undo any transactions lacking the necessary signatures. And all of this should be evident in the printed hardcopy that the gov-level auditors would love to see.
...and that's just an idea off the top of my head right now at 5am (and a bottle of IPA) and I've never worked in fintech or banking.
Given that shady stuff happens at the highest-levels inside legacy banking institutions (e.g. HSBC and the South American drugs trade - or Deutsche Bank and sanctioned Russian entities... and the current White House occupant) - and because I know that these banks do hire great engineers for their internal systems - that "clerical errors" don't happen like this - something fishy is afoot and I guarantee that we'll never know the truth.
But regardless, at some point, this system still thinks the transaction has been authorized. I'm sure there's a huge audit log showing who/where/why the mistake was made.
But I've also seen end-of-period processing at a smaller financial institution where humans are involved and a few spreadsheets hairpin their ways through different systems with lots of manual intervention and QA. One step was literally very close to "audit 0.01% of payments before sending the CSV into the lockbox escrow processing system...
The same kinds of security and safety guarantees that stem from the overall system architecture can exist in banking systems - that’s my point.
So yes, until everyone switches to Haskell we will always have bugs - but the kinds of bugs can be limited - as can the scale of their impact - with good system design.
I'm scared to think what would have happened if it were me, the money sent to the seller, not suspecting any error at all and unable to return anything.