Now that the decision is out we have more details on what caused the blunder, and it's a good (terrifying?) lesson in the importance of good system and UI design:
> Citi’s software will only let you pay principal to some lenders if you pretend to pay it to every lender, and it will only let you pretend to pay principal to every lender if you check the “just pretend” box next to “PRINCIPAL” (fine!) and “FUND” (what?) and “FRONT” (what even?).
> Raj then proceeded with the final steps to approve the transfers, which prompted a warning on his computer screen — referred to as a “stop sign” — stating: “Account used is Wire Account and Funds will be sent out of the bank. Do you want to continue?” But “[t]he ‘stop sign’ did not indicate the amount that would be ‘sent out of the bank,’ or whether it constituted an amount equal to the intended interest payment, an amount equal to the outstanding principal on the loan, or a total of both.” Because Raj intended to release “the interim interest payment to [the] [L]enders,” he therefore clicked “YES.”
The requirements of the software to check specific boxes that are not obvious is going to make this incident part of some UI 101 classes.
This all screams that the feature was grafted unto an existing form and no one wanted to spend the time to update it or no one wanted to create a dialog and form dedicated to what they wanted to accomplish.
sadly, co opting existing forms and code isn't unique to Citi
Even given the bad UI form, the error, and likely many others like it, could easily have been avoided by a more verbose confirmation. Rather than a simple warning, "money will be sent out of our accounts" a warning showing a brief synopsis of the totals and where they will be sent would be much more helpful.
A situation like this can arise without new features, whether grafted onto an existing form or not. All it takes is a use case for which the system was not designed (which seems quite likely here), but which can just about be accomplished by abusing the purpose of the existing system.
One software-independent thing Citi could have done that might have reduced the risk of procedures like this would have been a rule that the reviewers must reconvene, and all concur, before proceeding past a warning.
The software isn't Citi-built though - it's Flexcube, which is an Oracle product. Still Citi's mistake (among multiple other mistakes along the way) for not a) throwing their weight around and demanding new features or b) building something in-house.
This seems like a case where an interface like Scratch to assemble transactions with a live description of what will be sent to whom alongside, then the whole thing sent for review like a programmer would do code review, would be the best interface.
I love this story, and happy to see it has a sensible resolution.
If you want to avoid mistakes like this in the long run, here's a shameless plug for a long term research project: public domain, radically simpler software (https://treenotation.org/). This is the way.
11 comments
[ 1.4 ms ] story [ 36.9 ms ] thread> Citi’s software will only let you pay principal to some lenders if you pretend to pay it to every lender, and it will only let you pretend to pay principal to every lender if you check the “just pretend” box next to “PRINCIPAL” (fine!) and “FUND” (what?) and “FRONT” (what even?).
> Raj then proceeded with the final steps to approve the transfers, which prompted a warning on his computer screen — referred to as a “stop sign” — stating: “Account used is Wire Account and Funds will be sent out of the bank. Do you want to continue?” But “[t]he ‘stop sign’ did not indicate the amount that would be ‘sent out of the bank,’ or whether it constituted an amount equal to the intended interest payment, an amount equal to the outstanding principal on the loan, or a total of both.” Because Raj intended to release “the interim interest payment to [the] [L]enders,” he therefore clicked “YES.”
This all screams that the feature was grafted unto an existing form and no one wanted to spend the time to update it or no one wanted to create a dialog and form dedicated to what they wanted to accomplish.
sadly, co opting existing forms and code isn't unique to Citi
One software-independent thing Citi could have done that might have reduced the risk of procedures like this would have been a rule that the reviewers must reconvene, and all concur, before proceeding past a warning.
My online banking has that, I don't get why software for managing 900m dollar loans doesn't have that.
What good is it if you require three people to sign off on the transaction when noone actually looks at the transactions!!
If you want to avoid mistakes like this in the long run, here's a shameless plug for a long term research project: public domain, radically simpler software (https://treenotation.org/). This is the way.