UK banking apps showing customers other users' transactions | Hacker News Reader

UK banking apps showing customers other users' transactions

bbc.co.uk

24 pointsdruml12 comments

Not to jump to conclusions but I wonder if this is in any way related to outsourcing/AI replacing traditional experienced UK tech workers. Never seen anything like this happen before.

Really weird, you'd think all API calls are tied to the user ID. Unless some hard-coded debugging ids crept out to prod. But again, code reviews? integration test?

Recently Lloyds Banking Group has upgraded their apps so that you can see details from all your accounts with them in every app (some functionality still needs the right brands app though).

There's obviously some magic to glue different accounts together without user input, so I can see my Scottish Widows pension and Halifax credit card balances in my Lloyds Bank app[1], even though I have separate logins for each brand's website and app. Possibly my National Insurance number and address I'd guess? But I can see it going badly wrong if they get the magic merging wrong...

[1] Clearly I need to open a Bank of Scotland account to get the full set.

Technically, not much magic, apart from Mortgage and Pension, OpenBanking is quite solid in the UK, and you can connect any bank account from any bank. This is now supported by many banks in the UK. You can connect all other bank accounts directly. There are apps for that, too, for a small fee.

But I suppose you mean connecting these directly based on the national insurance number, rather than relying on user consent to use OpenBanking to see them all together in one place.

Yes, this isn't OpenBanking, I'm sure the Lloyds app could do that at one point to link to my Halifax account (or others), but it was flaky IIRC (and seems to have disappeared from the app?), this is a separate automatic thing.

This is probably in response to the new App first banks like Monzo/Starling (I use Monzo) Where you can open an account, see savings, current account, business account, CC etc all in one.

My daughter opened an account using the app only (Scan passport, video clip to authenticate) got the card the next day and setup up savings, investing ISA's with a few clicks. Again incumbents not willing to innovate until someone disrupts, but probably too late.

You could see all your accounts with an individual brand in one website / app, and doing things like opening new accounts online or applying for credit cards isn't exactly new functionality either. I'm sure Monzo is slicker because it isn't talking to a bunch of COBOL in the backend, but traditional banks aren't behind so that basic functionality is missing.

The issue is that Lloyds Banking Group was basically bifurcated by brand, so that the Lloyds app and website only had your Lloyds current / savings / credit cards etc. whilst the Halifax website and app only had Halifax current / savings / credit cards. They're clearly trying to merge things so you only need one app / website.

I noticed my soon to be closed nearest Lloyds branch gained a "Halifax customers can use this bank." poster in the window, I'm not sure if that's just a reaction to the fact that physical bank branches are getting kinda rare, or if it's really taken them about 17 years to merge the Lloyds and Halifax backend systems to the point where branches are interchangable.

Yes the backend for Monzo is indeed very performant. I have a dev app connected using their api and can read all my accounts/transactions over an API. As soon as I make a transaction it appears in my web app within a few seconds. Compare that with older banks it can take a day for it to appear.

Maybe some session sharing issue? Wouldn't show up if you weren't testing multiple users at the same time.

Yes, hope they publish a post mortem of the cause, will be interesting to see how this could have happened.

A year ago, they announced that half of their engineers will be in India by 2026:

https://www.ft.com/content/a304cf5a-5d91-4d4d-a41f-16651b59e...

Well at least there Opex will be low enough to handle the outflows of customer as they close their accounts.

Reply on news.ycombinator.com