Hacker News Reader

Comment by downandout | Hacker News Reader

From an engineering point of view, the mere fact that these people were able to withdraw millions of dollars from five accounts in multiple locations simultaneously is just absurd. Even if these guys had direct access to the database to be able to change the withdrawal limits and balances of the cards, any engineer with half a brain in charge of designing their back end would create a separate system that monitors transactions and does both security and reality checks.

Same card being used within seconds at two locations 5 miles apart? Probably something funny going on. "Deposits" of millions of dollars on a single pre-paid card in a day? Might be unusual.

These banks deserve to lose every dime they have to lose if they are this stupid, or are hiring such inept IT people.

View on HN

I think you forget that the payment systems are designed to tolerate failure and still work. For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down.

So it's possible to scam the system, but the banks probably figure that they would lose more money in lost transaction fees by implementing a 100% secure, ACID-compliant 2-phase commit payment protocol, than by keeping the current best effort authorization + batch processing system in place.

>For instance, you may be able to use your credit card at a store even if their phone line or internet connection breaks down.

Actually, no. No approval code (which is obtained from the network), there is no purchase.

Well, at least where I live I've encountered this a few times. The payment terminal shows "connecting" for some time, and eventually prints out an extra receipt that I have to sign (whereas usually entering the PIN is sufficient). Can you tell me what goes on in that case?

Sounds like debit failing and falling back to a CC transaction, but I am not a payments expert.

Actually, yes.

The transaction is stored, and fowarded later. It's a variant on the Card Number + Impression that used to be common place 20 years ago, and Card Number + CCV that is still common place in locations with intermittent/no connectivity.

The prime example of this being done electronically is on planes, they have been accepting credit cards a large number of years before connectivity was possible.

Any merchant that would release goods or services without an approval code exposes themselves to a loss. Of course it's possible for a merchant to store the card information and post it later, but it's far from a good idea.

The ATMs can be configured for both cases. If the ATM is in a well-trafficked area, with a (normally!) low degree of crime, the bank may set it for high-availability vs. hard-transactional to avoid inconveniencing their customers.

Don't forget that the banks make their money from ATMs off the transaction fees, so if a foreign customer's bank is unreachable at that moment, they may still take a chance and give them their money (plus charge them the $4).

Well, I'm not talking about the merchant writing down the credit card number. This happens through the terminal.

Do you work in banking and know about this, or are you making assumptions about how payment terminals work?

Most larger chains have a limit up to which they'll accept that risk. For obvious reasons what those limits actually are is very closely held information.

IT codes according to what the business wants. If the business folks don't want it after someone brings up such things because it would cost more money and take away resources from another project, it's not going to get done, and you'll see this kind of stuff.

Banks must hire among the most inept IT people of any industry. Every time I log into PNC, I literally switch tabs and try and "do something else" for at least a minute, because that's how long it takes their Virtual Wallet bullshit to load. At least, that's what the site says it's doing. Loading. Only they have "HTML5" emblazoned in huge letters on the page, for some unknown reason, which inevitably makes me wonder what the fuck is taking so long then. Let me guess, your SOAP requests are 3 miles long. Uphill. Through the snow.

I did an interview with them and it seems like they do hire the cheapest.

In my country theres a foreign worker scam that allows Indian companies to fly in the worst IT staff complete with fake resumes and pays them $6/hr for a year to screw up their website with dozens of SSL certs and slow security theatre that pretends to do something but is just a little flash to watch while you wait forever to load their junk software.

major banks here all made at least a trillion in profit last year but couldnt be arsed to pay for legit IT staff. now we all suffer paying tax dollars to track down all these thieves who easily fraud their faces off with the terribad security and poor code quality

Reply on news.ycombinator.com