Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

news.ycombinator.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#41

Post by saluki »

STOP, you're already done this on multiple accounts that is asking for trouble.

I wouldn't risk interacting with them further if they aren't interested in listening.

Document that you tried to contact them and report it so they can fix it.

But you're in the gray area where they could attack you feeling you were attacking their their system.

Forget it and move on.

Otherwise you're going to be tempted to: https://www.youtube.com/watch?v=GyB6ffmXsZo (Office Space Virus Scene) And we all know how that ends.

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#42

Post by smt88 »

alexleclair wrote: post #13
smt88 wrote: post #3

Document your attempts to alert the bank. You should have proof that you contacted them about it. Don't use the loophole obviously. Definitely switch banks.

Yep, good idea. I'm documenting everything I can think of. Tried the loophole three times - once inadvertently, a second time to try a different approach and a third time on a different account. Told the low-level techs all about that, they didn't seem too concerned about le ~0.32$ I created, but still being careful. I'm documenting everyone I talk to as well - there is never any case file # though. Are there any oth…

If it's possible for regular transactions to look like fraud due to this loophole, you should make sure all your legit transactions have a paper trail (receipts or whatever).

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#43

Post by alexleclair »

smt88 wrote: post #42
alexleclair wrote: post #13

Earlier quoted context omitted.

Yep, good idea. I'm documenting everything I can think of. Tried the loophole three times - once inadvertently, a second time to try a different approach and a third time on a different account. Told the low-level techs all about that, they didn't seem too concerned about le ~0.32$ I created, but still being careful. I'm documenting everyone I talk to as well - there is never any case file # though. Are there any oth…

If it's possible for regular transactions to look like fraud due to this loophole, you should make sure all your legit transactions have a paper trail (receipts or whatever).

Good idea, thanks!

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#44

Post by alexleclair »

piron_t wrote: post #37
brador wrote: post #24

Stop. You're risking your freedom to save a corporation. If you press ahead you will be dealing with people who lack knowledge and are scared of what you did affecting their career. They will rake you over coals. And you will have gained what? The minute pleasure of helping them save a few bucks? You have a desire to help people. That's great and noble and commendable. But that's not what you would be doing here. My…

I can't agree more with Brador, you're really risking your freedom and if they don't have a bug bounty, you might end up in court / being sued. Here is a google translate from a French article that you might find interesting : https://translate.google.com/translate?sl=fr&tl=en&js=y&prev...

Thanks for the link

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#45

Post by alexleclair »

brador wrote: post #24

Stop. You're risking your freedom to save a corporation. If you press ahead you will be dealing with people who lack knowledge and are scared of what you did affecting their career. They will rake you over coals. And you will have gained what? The minute pleasure of helping them save a few bucks? You have a desire to help people. That's great and noble and commendable. But that's not what you would be doing here. My…

Yeah, makes sense. I'll probably just forget about it (but switch banks beforehand!)

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#46

Post by [deleted] »

otterley wrote: post #18
sheraz wrote: post #8

I use LinkedIn when I have to penetrate a bureaucracy such as this. Nothing gets action faster when a VP or higher get a personal email / phone call regarding something like this. Step 1: Troll linkedin to find these people in positions of real power. Step 2: If they are easy to reach via email or on the platform, try that. Failing that, call their HQ and work the phones until you get to them. Step 3: Win.

I think you mean "trawl," not "troll." :-)

[deleted]

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#47

Post by ChuckSanders »

I am a developer who works with one of the largest US banks and I would love to speak with you about what you have found and pass it along to the head of security in my office.. Unfortunately like others have pointed out you will more than likely encounter low level employees who dismiss you OR, and this is the dangerous part.. you may bruise the ego of someone in a position who can and should listen to you.. possibly resulting in adverse actions being taken against you. Do you have an email address I could contact you at? I could conference you in to my department and see the exploit you found(MOST banks share the same backend software for their online services so this is alarming)

Re: Ask HN: Found a way to fraud my bank thru a loophole, how to disclose properly?

#48

Post by ChuckSanders »

alexleclair wrote: post #45
brador wrote: post #24

Stop. You're risking your freedom to save a corporation. If you press ahead you will be dealing with people who lack knowledge and are scared of what you did affecting their career. They will rake you over coals. And you will have gained what? The minute pleasure of helping them save a few bucks? You have a desire to help people. That's great and noble and commendable. But that's not what you would be doing here. My…

Yeah, makes sense. I'll probably just forget about it (but switch banks beforehand!)

Please see my other comment and contact me, this is my job and I can get you in touch with the right folks without any kind of risk or BS
Post reply on HN