Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK bank fined £49M over IT system meltdown

bbc.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: UK bank fined £49M over IT system meltdown

#61

Post by azalemeth »

PeterisP wrote: post #41
jbkkd wrote: post #35

Earlier quoted context omitted.

Honest question - why do you still have an account with them?

In general, banks compete on other attributes - a small difference in a mortgage interest rate is a lot of money and makes up for a HUGE difference in the quality of internet services; and whenever loan market becomes tight (and thus it's not attractive to refinance to another bank) people are pretty much locked in.

Exactly this. They're not great, but there's something about being a customer somewhere for a very long time that genuinely does (or did) seem to offer you a mortgage rate that was advantageous.

Re: UK bank fined £49M over IT system meltdown

#62

Post by [deleted] »

iechoz6H wrote: post #58
azalemeth wrote: post #16

I have a bank account with TSB and got compensation as a result of this mix-up. Some rather personal experiences of the fiasco: – Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, "dynamic" way. I still can't use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid…

"I could see someone else's account in detail but was too honest to do anything with that knowledge" Are you patting yourself on the back for not commiting fraud?

[deleted]

Re: UK bank fined £49M over IT system meltdown

#63

Post by dylan604 »

iechoz6H wrote: post #58
azalemeth wrote: post #16

I have a bank account with TSB and got compensation as a result of this mix-up. Some rather personal experiences of the fiasco: – Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, "dynamic" way. I still can't use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid…

"I could see someone else's account in detail but was too honest to do anything with that knowledge" Are you patting yourself on the back for not commiting fraud?

In today's world, that's no small feat. Not the patting on the back, but to be honest about it and not do anything untoward.

Re: UK bank fined £49M over IT system meltdown

#64

Post by antihero »

azalemeth wrote: post #16

I have a bank account with TSB and got compensation as a result of this mix-up. Some rather personal experiences of the fiasco: – Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, "dynamic" way. I still can't use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid…

> I still can't use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid extensions block.

So you have extensions that literally break normal browser behaviour and you are blaming them somehow? CORS is part of browser security and should be respected.

Not saying that TSB aren't clearly a shitshow but maybe just disable the extension for that site.

Re: UK bank fined £49M over IT system meltdown

#65

Post by Rastonbury »

azalemeth wrote: post #16

I have a bank account with TSB and got compensation as a result of this mix-up. Some rather personal experiences of the fiasco: – Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, "dynamic" way. I still can't use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid…

How did you get compensation? Thank goodness for monzo and revolut being so quick to set up but I had money trapped in TSB for some time. I thought it would only last a day or two at most. The services and ability to get support were non-existent during that time I totally stopped trying to call. I closed my TSB account shortly after

Re: UK bank fined £49M over IT system meltdown

#66

Post by rlpb »

insomniacity wrote: post #43
petepete wrote: post #8

Hopefully Virgin Money will get one too. They broke their Android app earlier this year and since they make you verify web logins using the app I was unable to access any of my business accounts for ~3 weeks. If something really urgent had come up I could have done what I needed via telephone banking or in a branch, but it was a huge pain in the arse because of a single point of failure. Just let me use a Yubikey as…

+1 on the Yubikey. I'm pretty good at moving my savings around and getting the best interest rate possible - the side effect is a ton of accounts, which means I'm drowning in 'secure memorable passcode key PINs' and my SMS inbox is full of SMS 2FA codes, and I'm wondering what it would take to get a bank to offer Webauthn/FIDO. How about a website where we pledged to open an account and deposit £X into savings, or sw…

I'd love FIDO for online banking auth. But AIUI, there's some EU regulation that requires 2FA, but that 2FA must also verify some other data (like the recipient of a transfer, amount being transferred and suchlike). I don't remember the details, but unfortunately that rules out FIDO for 2FA to make transactions. For initial authentication it would work, but it would have to be yet another system on top of the 2FA they have to use for transaction validation.

Re: UK bank fined £49M over IT system meltdown

#67

Post by nerdawson »

kitd wrote: post #25
lmm wrote: post #7

Earlier quoted context omitted.

True as far as it goes, but "everything broke" as a predictable result of poor decisions they made, such as moving everyone over in one go.

Note that "they" in this case is the new parent company. IIRC, they were a fairly new bank, heavily reliant on technology. They had the tech but not the customers. TSB were the opposite. The parent thought their tech, which up to that point was only dealing with 100,000s of records, could deal with billions with little change. They were spectacularly wrong and it showed in all testing. But their management pushed ahe…

TSB’s parent company is Sabadell which is a massive Spanish corporation.

I was a Solbank (one of their brands) customer and can safely say tech isn’t their strong point. Awful UX and a pain to deal with.

Re: UK bank fined £49M over IT system meltdown

#68

Post by antihero »

zeristor wrote: post #17
arpinum wrote: post #10

The 250+ page analysis of the incident was an excellent insight into how large IT projects fail: https://www.tsb.co.uk/news-releases/slaughter-and-may/slaugh... money quote: > This situation has all the hallmarks of business management strong-arming the IT organization into an unrealistic timeline. When business leaders push for overly-aggressive timelines, or regulators ask for multiple competing risk frameworks and…

The report is by Slaughter & May, one of the more delightful company names in the City of London. My understanding was that they’re a law firm, perhaps they’ve also branched into IT consultancy?

Generally legal firms like this will have domain specialists.

Re: UK bank fined £49M over IT system meltdown

#69

Post by LeifCarrotson »

ryandrake wrote: post #44
usr1106 wrote: post #21

Earlier quoted context omitted.

As a privacy-aware user, when making a contract with a bank (or buying a flight ticket or whatever) you should get assertions that their web site meets certain quality standards so you can use your browser to access the account or actually check in. Paper did not have those incompatibility problems... However, from the BBC article I conclude that even customers with a default browser could not necessarily use their a…

Businesses can change, too. My credit union[1] recently made a web site change causing me to no longer be able to log in. The new shiny red login button they probably paid $millions for an incompetent developer to provide does nothing when you click it (desktop Safari). I vetted the old site which worked perfectly, but now it doesn’t. I’m working on moving my business elsewhere. 1: https://www.techcu.com/

Hopefully they didn't pay $millions...the source is completely unminified, it checks a cookie, calls Google Analytics, then changes the login link from display:none to display:block.

    function LoginButtonClick() {
        var selAccount = $("#accounts").val();
    
        LoginCookieSet(selAccount);
    
        if (typeof ga !== 'undefined')
            ga('techcu.send', 'event', 'button', 'Click', 'Member Login');
    
        var formAction = "https://online.techcu.com/User/AccessSignin/Password"; // testing url
    
        switch (selAccount) {
            case "1":
                formAction = "https://online.techcu.com/User/AccessSignin/Password";
                if (window.location.host === "dev.techcu.com" || window.location.host === "qa.techcu.com") {
                    formAction = "https://onlinetest.techcu.com/User/AccessSignin/Password";
                }
                break;
            case "3":
                formAction = "https://businessbanking.techcu.com/";
                break;
            case "2":
                formAction = "https://businessbanking.techcu.com/smallbusiness";
                break;
            default:
                formAction = "http://online.techcu.com/User/AccessSignin/Username";
        }
        if ($('#UsernameField1').val().substr(0, 2) == "**") {
            $('#onlineBankingLogin #UsernameField').val($('#UserNameHidden').val());
        } else {
            $('#onlineBankingLogin #UsernameField').val($('#UsernameField1').val());
        }
        $('#onlineBankingLogin #PasswordField').val($('#PasswordField1').val());
    
        $('#onlineBankingLogin').attr('action', formAction);
        $('#onlineBankingLogin').submit();
    }
The direct login link is then visible, you can bookmark https://online.techcu.com/User/AccessSignin/Start for later...but yeah, nonfunctional for ~10% of desktop browsers is not a good look for a technology credit union.

Re: UK bank fined £49M over IT system meltdown

#70

Post by foldr »

ryandrake wrote: post #44
usr1106 wrote: post #21

Earlier quoted context omitted.

As a privacy-aware user, when making a contract with a bank (or buying a flight ticket or whatever) you should get assertions that their web site meets certain quality standards so you can use your browser to access the account or actually check in. Paper did not have those incompatibility problems... However, from the BBC article I conclude that even customers with a default browser could not necessarily use their a…

Businesses can change, too. My credit union[1] recently made a web site change causing me to no longer be able to log in. The new shiny red login button they probably paid $millions for an incompetent developer to provide does nothing when you click it (desktop Safari). I vetted the old site which worked perfectly, but now it doesn’t. I’m working on moving my business elsewhere. 1: https://www.techcu.com/

The login button works for me on Safari (15.2).
Post reply on HN