🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #1019

Re: Systems Control in Bank

#1019
From: Walter Roberson
Date: Sun, 06 Jun 1999 00:00
44 lines
3348 bytes
In article <375e1ba4.18513949@news.dynamite.com.au>,
Alan Vidler <avidler@pcug.org.au> wrote:
:>I have a question here, if two people with the same account (let's say a
:>husband and a wife) and they submit their request at the same time i.e

:Every (err, all 3) banking system I've worked on would serialise
:access to the account.  The first one in the queue, whether by a
:millisecond or less, would get the loot.  The other would bounce.

About 3 years back, my bank was bought by another bank. Eventually the
two account systems were merged, at which time they changed the
"card-hold agreement" (the fine print that goes with the ATM card.) The
new agreement contained a clause that allowed the bank to give out my
SIN (Social Insurance Number, Canadian equivilent to the US SSN; a
number that is only *intended* to be used for tax purposes) to third
parties. Nominally only if the bank was running a credit check on me,
but the wording allowed them to give it out at will. I pushed through
the initial explanations (the bank doesn't need to run a credit check
on me, I've never asked them for a loan, I have no credit cards, and I
have a solid balance), and was eventually told this:

  Some of the ATM machines in the city, associated with some of the
  smaller financial institutions, are only on-line during the day, and
  at night process requests locally and transmit them to the bank in
  the morning. Also, sometimes the ATM machines that are usually online
  24 hours lose contact with the bank, in which case they fall back to
  processing transactions locally and transmit them when the link
  becomes available again.

  In either case, the ATMs are (or were then) programmed to allow
  withdrawls of $C100 at a time, up to $C500 per night: they would
  assume that I had at least that much in the account. Now, because I
  could hypothetically run around from offline ATM to offline ATM
  withdrawing up to $C500 per machine, I could hypothetically empty out
  my account and more, in which case the bank would consider the
  overdrawl as a "loan". Because the bank could thus theoretically be
  loaning me money in this way, they wanted to be able to run credit
  checks on me when the situation came up, just as they would for other
  loans and lines of credit, and as their normal practice was to give
  out the SIN when running a credit check, that's why the clause was in
  the card-holder agreement.


I refused the agreement and did without an ATM card.
Technical Details
Message-ID: <7je6ro$mio$1@canopus.cc.umanitoba.ca>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <37548DB5.1E0F3944@yahoo.com> <375e1ba4.18513949@news.dynamite.com.au>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: ff723,a908dcbc7418ab7
X-Google-Attributes: gidff723,public
X-Google-Thread: 101175,a908dcbc7418ab7
X-Google-Attributes: gid101175,public
X-Google-Thread: f4bcb,a908dcbc7418ab7
X-Google-Attributes: gidf4bcb,public
From: roberson@ibd.nrc.ca (Walter Roberson)
Subject: Re: Systems Control in Bank
Date: 1999/06/06
Message-ID: <7je6ro$mio$1@canopus.cc.umanitoba.ca>
X-Deja-AN: 486348126
References: <37548DB5.1E0F3944@yahoo.com> <375e1ba4.18513949@news.dynamite.com.au>
X-Complaints-To: Postmaster@cc.umanitoba.ca
X-Trace: canopus.cc.umanitoba.ca 928685752 23128 192.70.172.132 (6 Jun 1999 16:15:52 GMT)
Organization: National Research Council Canada
NNTP-Posting-Date: 6 Jun 1999 16:15:52 GMT
Newsgroups: comp.security.misc,alt.security,aus.net.policy