Citibank accidentally wired $500m back to lenders in user-interface super-gaffe – and judge says it can't be undone
- Reference: 1613725032
- News link: https://www.theregister.co.uk/2021/02/19/citibank_money_mistake/
- Source link:
The error occurred on August 11 last year, when Citibank was supposed to wire $7.8m (£5.6m) in interest payments to lenders who are propping up troubled cosmetics giant Revlon. But a worker at outsourcing mega-org Wipro accidentally checked the wrong combination of on-screen boxes, leading to the repayment of not only the interest but also the $894m (£640m) principal from the bank's funds.
[1]
Citibank has a "six-eyes" policy on massive money transfers of this type. In the Revlon fiasco, a Wipro worker in India configured the transfer using software called Flexcube, his local manager approved it, and Vincent Fratta – a Citibank senior manager based in Delaware, USA – gave the final OK for the transfer of funds, all believing the settings were correct.
Below is a screenshot of the transfer set up by the first Wipro worker. He should have ticked not just the principal field but also the front and fund fields, and set their values to the necessary clearing account number. By leaving those two boxes unchecked and values empty – and wrongly assuming putting the account number in the principal field was a correct move – the entire principal of the loan, which was set to mature in 2023, was handed back to 315 creditors.
[2]
[3]
Incomplete ... The Flexcube interface for the infamous transfer. Click to enlarge. Source: US courts system
It wasn't until the next day that staff noticed the error, and sent out emails asking for the funds be returned – and hundreds of millions of dollars were. However, a group of 10 creditors refused to hand back their share the cash, amounting to more than $500m, leading Citibank to sue them in New York to recover the dosh.
This week, the US federal district court judge presiding over that lawsuit sided with the lenders, saying
[4]PDF
they had reasonable grounds to think that the transfer was legitimate and that they had legal grounds to keep their money.Barclays Bank appeared to be using the Wayback Machine as a 'CDN' for some Javascript [5]READ MORE
"The non-returning lenders believed, and were justified in believing, that the payments were intentional," Judge Jesse Furman ruled.
"Indeed, to believe otherwise — to believe that Citibank, one of the most sophisticated financial institutions in the world, had made a mistake that had never happened before, to the tune of nearly $1bn — would have been borderline irrational."
Since the amount sent back repaid the loaned amounts to the cent and no more, the judge ruled Citibank had no right to reclaim the money.
"We are extremely pleased with Judge Furman's thoughtful, thorough and detailed decision," Benjamin Finestone, representing two lenders, Brigade and HPS Investment Partners, [6]told CNN.
[7]
That said, the saga isn't over yet. The disputed funds are going nowhere, and are held under a temporary restraining order, to give Citibank a chance to challenge the ruling. "We strongly disagree with this decision and intend to appeal," the mega bank said in a statement. "We believe we are entitled to the funds and will continue to pursue a complete recovery of them." ®
Get our [8]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YC@aSH0o77gNOxdO7QRCHQAAAEw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YC@aSH0o77gNOxdO7QRCHQAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[3] https://regmedia.co.uk/2021/02/19/ui.jpg
[4] https://regmedia.co.uk/2021/02/19/citibank.pdf
[5] https://www.theregister.com/2020/07/03/barclays_bank_javascript_wayback_machine/
[6] https://www.cnn.com/2021/02/16/business/citibank-revlon-lawsuit-ruling/index.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YC@aSH0o77gNOxdO7QRCHQAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://whitepapers.theregister.com/
WIPRO?
All makes sense now....
(Former WIPRO employee here)
I knew somebody who worked for a major bank in the 70's and inadvertently transferred c.£3M into one of her own accounts. It took place rather late in the day on a Friday, she was frazzled from a stressful work week and had plenty going on in her personal life as well. She said that she awoke, with alarming suddenness, sweating profusely, in the middle of a somewhat troubled Friday nights slumber and immediately alerted her manager to the error. Happily she retained her position with the bank, because she was good at her job.
UI Screw Up
The only people who should be blamed for this are CitiBank for having a system that has such an awful UI to as to allow payment of nearly $1bn to go to the wrong account(s).
Re: UI Screw Up
I actually think the people who should shoulder the blame are the PHBs who thought outsourcing to Wipro (of all companies) was a good idea, just so they could save a few pennies here and there.
Well, there you go.
I have no sympathy for them what-so-ever.
"six-eyes" policy
A fine example that more eyes don't necessarily mean better quality. Instead people tend to click through all those nasty work-items without really giving them a glance. We had this in production as well. If you put several check stations down the line, you just end up with the line workers getting sloppy, as they know someone downstream is still checking it, while the check guys get sloppy, because there is still a station behind them and the last one in the line sleeps away, because - hey, there have been already so many check before, right?
That said, that amount of money should have rang some bells. I really wonder how someone can get casual about transfers of hundred of millions of dollars. I am definitely in the wrong line of work, it seems.
Edit: And no, I don't think 3 persons checking such a transfer is excessive. Just that adding even more people probably wouldn't help.
Re: "six-eyes" policy
Wholly correct about staff growing sloppy Chairo. I worked for a bank which went from two approvals in Change Management to five and the quality dropped like a stone. I once accidentally submitted my template rather than the actual change and it went thru!
The old system was not perfect though. They had the most awful habit of sitting on change requests until they had expired, so no approval but no rejection either. This helped them hit some ill-defined performance SLA that made no sense to anyone.
Double keying already used in some banking applications
Some years ago major publishers digitised journal back-issues for HTML publication. They did not use OCR. They used double keying. I found this definition of double keying on the web (emphasis added).
The process used by operators when they enter the information twice or when two separate operators enter the data at separate times. The two entries are then compared with each other to ensure that they match. This process is used in military and BANKING APPLICATIONS to detect intended falsification of information.
https://www.yourdictionary.com/double-entry-or-double-keying
See also https://journals.openedition.org/jtei/739, from a Text Encoding Conference.
Interest
"The disputed funds ... are held under a temporary restraining order"
So if Citibank loses, do they pay any sort of interest or other penalty to redress the time loss of the money?
I'm surprised the lenders aren't suing Citibank for lost revenue from the interest they were going to be getting on the loans, unless the repayment also included some early repayment fees.
Isn't it the banks themselves....
...that state money transfers can't be undone and you should check carefully?
Hence the Western Union scams.
Bank error in your favour. Collect £200.
The dole que is this way...