As some of you will know, banking systems consist of a myriad of programs, some developed decades ago and they all need to "talk to each other".
The main software system for the division that I work in was updated a couple of years ago at great expense, in terms of money and staff time testing. It was purchased from a 3rd party supplier.
The software needs to communicate with various legacy bank systems and it does this by numerous different methods including the updating of databases that are read by both systems, via APIs and the quaintest way is my posting CSV files in to a system subdirectory that accumulate and are acted on by a batch process.
The latter has always been a concern and measures have been taken to make the directory inaccessible to staff and un-editable - save for the batch process deleting the files once they have been acted upon.
The CSV files are payment instructions. In the simplest form:
PAY AMOUNT FROM ACCOUNT 1 TO ACCOUNT 2 REFERENCE XYZ (in reality it's more complex than this but you get the gist).
The main system doesn't check to see that the payments have actually been processed, it assumes that they have been unless it is told otherwise by a CSV message back.
The double entry book keeping is managed my the main software and an API interface between that and the banks financial accounting system.
Between Christmas and the New Year, the IT team made some changes to folder permissions and some wag got access to the directory and entered their own CSV payment instructions.
A sizable chunk of money was transferred before someone came back in the New Year and noticed the books didn't balance!
It wasn't me honest! Someone has been suspended.
|
Bank IT Systems new
