Bank of Ireland IT blunder allows customers who have no money get access to cash

I don't know how the system works in Ireland, but based on what I've read here, I believe the end result is this: Revolut's bank account got 500 euros from BoI, and the customer withdrew the 500 euros to end up with a second account with no money on it. It's now up to BoI to get the money to Revolut, since they authorised the transaction.

This means BoI's customers are now 500 euros in debt. Most likely, the accounts will be overdrawn, which usually comes with hefty fees if not paid back in time. BoI charges a 9.4% interest on overdraft accounts.

On their website (https://personalbanking.bankofireland.com/bank/current-accou...) bank of Ireland says:

  If your account is overdrawn, interest is charged on the full overdrawn balance, regardless of whether the overdraft is within an agreed overdraft limit or there is an unauthorised overdraft. Lending criteria, terms and conditions apply. Applicants must be over the age of 18 years old.

If the customers never bother to pay back the 500 euros they borrowed, the debt will probably be sold to debt collection agencies which can make the lives of the people that tried to steal money from their bank quite bad, especially if they send the more ruthless debt collectors. There's a good chance the loan will also end up on the Central Credit Register, potentially making future loans quite problematic.

I don't think Revolut did anything wrong here, BoI should never have authorised the withdrawal. The article mentions a history of technical issues so I can imagine that some API endpoint didn't check for a positive balance before sending money to Revolut.

If the transfer was never authorised by BoI and only provisionally approved, the fraudsters will probably have the same problems, but they'd owe the money to Revolut rather than BoI.

Either way, the bank is probably going to get their money back one way or another.

I believe Revolut is working as intended.

The root issue is that BOI have/had an issue trying to retrieve balances. At which point they have two options: prevent transactions if the balance cannot be verified (which would deny people access to their own money), or allow transactions if the balance cannot be verified (which enables people to go overdrawn).

SEPA transfers are near-instantaneous, this isn't access to funds that haven't cleared, it's access to funds which have already been transferred. None of this is really specific to Revolut, they're just the most common reason for "the man on the street" to have a second account to receive a transfer.

> obvious things like ATM withdrawals aren’t allowed

I don't know if it's still common to run things this way, but I've worked for a few banks where the core database stopped running all OLTP for a short period every day for tasks like settlement and interest calculations, etc.. During that time they'd still allow ATM withdrawals, and if you knew the schedule it was possible to go into an unapproved overdraft.