{"id":46935,"date":"2025-03-03T15:35:00","date_gmt":"2025-03-03T20:35:00","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=46935"},"modified":"2025-03-03T15:35:00","modified_gmt":"2025-03-03T20:35:00","slug":"citibanks-81-trillion-error","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/03\/03\/citibanks-81-trillion-error\/","title":{"rendered":"Citibank’s $81 Trillion Error"},"content":{"rendered":"

Doloresz Katanich<\/a>:<\/p>\n

\n

An error almost led to a Citigroup account being credited with $81tn (€77.8tn) - an amount that is about 5 times the total wealth of the UK, which was estimated at €14.7tn in 2023 by ONS.<\/p>\n

[…]<\/p>\n

The erroneous internal transfer, which occurred last April, was initially missed by two employees, one of whom was assigned to check the transaction.<\/p>\n

[…]<\/p>\n

The first employee had to go through a rarely-used back-up screen following another system’s fault to send $280 (€269) to a client’s account. One quirk of the rarely-used screen was that the amount field came pre-filled with 15 zeros, something that would have to be deleted but that did not happen[…]<\/p>\n<\/blockquote>\n

Pre-filling the field sounds like such a terrible design that wouldn’t happen by accident, so there must be an interesting reason why that was done.<\/p>\n\n

Stephen Gandel and Joshua Franklin<\/a>:<\/p>\n

A third employee detected a problem with the bank’s account balances, catching the\npayment 90 minutes after it was posted.<\/p>\n

[…]<\/p>\n

The bank said its “detective controls promptly identified the inputting error between two\nCiti ledger accounts and we reversed the entry” and that these mechanisms “would have\nalso stopped any funds leaving the bank”.<\/p>\n

[…]<\/p>\n

A total of 10 near misses — incidents when a bank processes the wrong amount but is\nultimately able to recover the funds — of $1bn or greater occurred at Citi last year,\naccording to an internal report seen by the FT.<\/p><\/blockquote>\n\n

In the financial world, fractions of a second matter, but somehow 90 minutes after the fact is considered prompt. A good Mac app will preemptively warn the user if they do something that’s probably an error, like try to open 100 documents at a time. The G-SIB’s “detective controls” sound like the equivalent of killing the process after it’s used up all the RAM but before it brings down the whole machine. OK, that’s a good thing, but there’s really no input validation or sanity checking earlier in the process? I suppose that’s not actually necessary when there are legal means of undo.<\/p>\n\n

Previously:<\/p>\n