Article View: comp.security.misc
Article #1019Re: Systems Control in Bank
From: Walter Roberson
Date: Sun, 06 Jun 1999 00:00
Date: Sun, 06 Jun 1999 00:00
44 lines
3348 bytes
3348 bytes
In article <375e1ba4.18513949@news.dynamite.com.au>, Alan Vidler <avidler@pcug.org.au> wrote: :>I have a question here, if two people with the same account (let's say a :>husband and a wife) and they submit their request at the same time i.e :Every (err, all 3) banking system I've worked on would serialise :access to the account. The first one in the queue, whether by a :millisecond or less, would get the loot. The other would bounce. About 3 years back, my bank was bought by another bank. Eventually the two account systems were merged, at which time they changed the "card-hold agreement" (the fine print that goes with the ATM card.) The new agreement contained a clause that allowed the bank to give out my SIN (Social Insurance Number, Canadian equivilent to the US SSN; a number that is only *intended* to be used for tax purposes) to third parties. Nominally only if the bank was running a credit check on me, but the wording allowed them to give it out at will. I pushed through the initial explanations (the bank doesn't need to run a credit check on me, I've never asked them for a loan, I have no credit cards, and I have a solid balance), and was eventually told this: Some of the ATM machines in the city, associated with some of the smaller financial institutions, are only on-line during the day, and at night process requests locally and transmit them to the bank in the morning. Also, sometimes the ATM machines that are usually online 24 hours lose contact with the bank, in which case they fall back to processing transactions locally and transmit them when the link becomes available again. In either case, the ATMs are (or were then) programmed to allow withdrawls of $C100 at a time, up to $C500 per night: they would assume that I had at least that much in the account. Now, because I could hypothetically run around from offline ATM to offline ATM withdrawing up to $C500 per machine, I could hypothetically empty out my account and more, in which case the bank would consider the overdrawl as a "loan". Because the bank could thus theoretically be loaning me money in this way, they wanted to be able to run credit checks on me when the situation came up, just as they would for other loans and lines of credit, and as their normal practice was to give out the SIN when running a credit check, that's why the clause was in the card-holder agreement. I refused the agreement and did without an ATM card.
Technical Details
Message-ID:
<7je6ro$mio$1@canopus.cc.umanitoba.ca>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<37548DB5.1E0F3944@yahoo.com> <375e1ba4.18513949@news.dynamite.com.au>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: ff723,a908dcbc7418ab7 X-Google-Attributes: gidff723,public X-Google-Thread: 101175,a908dcbc7418ab7 X-Google-Attributes: gid101175,public X-Google-Thread: f4bcb,a908dcbc7418ab7 X-Google-Attributes: gidf4bcb,public From: roberson@ibd.nrc.ca (Walter Roberson) Subject: Re: Systems Control in Bank Date: 1999/06/06 Message-ID: <7je6ro$mio$1@canopus.cc.umanitoba.ca> X-Deja-AN: 486348126 References: <37548DB5.1E0F3944@yahoo.com> <375e1ba4.18513949@news.dynamite.com.au> X-Complaints-To: Postmaster@cc.umanitoba.ca X-Trace: canopus.cc.umanitoba.ca 928685752 23128 192.70.172.132 (6 Jun 1999 16:15:52 GMT) Organization: National Research Council Canada NNTP-Posting-Date: 6 Jun 1999 16:15:52 GMT Newsgroups: comp.security.misc,alt.security,aus.net.policy