2
$\begingroup$

Okay, let's assume here for a minute I am the greatest hacker in the history of our tiny little blue planet, and I manage, after years of work, to make a program that hacks banks to put money in my United States bank account. I can simply change the figure of my balance at any time. Say, for example, my program says I have

£300

in the bank. I can simply edit this £300 and make it...

£300,000

Let us assume I can make this program in total sancuatary and will never get caught, say, if a passerby simply notices this program through my window. Let us also assume this program is the only way I currently make money. If I simply spend the money on my needs: shelter, food, water, insurance, and all the basics, how long will it be before I am caught (if I am caught at all)?

$\endgroup$

closed as off-topic by JDługosz Jun 9 '17 at 10:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ It really depends on the region and government $\endgroup$ – Cows quack Jan 4 '17 at 18:33
  • 2
    $\begingroup$ Probably worth making clear whether you are moving money (ie theft) or just creating money (ie counterfeiting) as that may well have an effect on the answers. $\endgroup$ – Matt Bowyer Jan 4 '17 at 19:16
  • 3
    $\begingroup$ Stupid thought from my side: why would you have pound sterling in an American bank account, shouldn't you have dollars? ;) $\endgroup$ – Mrkvička Jan 5 '17 at 8:04
  • 1
    $\begingroup$ One thing banks are good at is keeping track of money (debit and credit, audit trails). So even the worlds greatest hacker would have a hard time fooling bank security. Now, if I was this hacker, I wouldn't go after a bank, but rather some other institution that handles a lot of money, but has another main purpose. Retail stores, casinos, investors etc. Or target regular people, but lots of them. A hacker that is good enough to create magic money on a bank account undetected can get more money with less effort somewhere else. $\endgroup$ – Guran Jan 5 '17 at 9:22
  • 1
    $\begingroup$ See the plot of “Off to be the Wizard”. $\endgroup$ – JDługosz Feb 23 '17 at 13:34
8
$\begingroup$

I guess that depends on how sophisticated your hacking is and how sophisticated the bank's auditing systems are.

If you just updated your bank balance, the bank should catch that very quickly, because their books won't balance. They'll have a credit with no matching debit.

If you're smart enough to update both sides of the ledger, the bank will still surely notice something when they try to reconcile. Where did the money for this deposit come from. If you enter that it was made with cash, then when the bank does their cash reconciliation they'll find they have less cash than they should. If you say it was a direct deposit, they'll turn up short on deposits received. Etc.

If their audit trail is sophisticated enough -- and bank audit trails tend to be very sophisticated -- they'll track it back to your account pretty quickly.

There was a scam that was discussed a lot about 20 years ago -- I don't know how many people really got away with it, but it was a big buzz in computer circles -- that a programmer would change the bank's interest calculations to round fractions of a penny down instead of rounding of to the nearest whole penny, and then put those pennies in a dummy account created by the programmer. Few customers would notice that there interest was a penny short, and if they did, they'd grumble, "Hey, the bank is rounding 14.9 cents down to 14 instead of up to 15, what a rip-off", and then forget about it. Who's going to make a stink about a penny? Meanwhile if the bank has a lot of customers, the programmer is collecting significant money off all these pennies. And the bank's books would balance: if they're paying, say, 2% interest, 2% of the total of all count balances matches the total interest paid. They'd have to look pretty close to see that one account got way more interest than it should while many other accounts were a penny short.

The point is, you need to have the money come from someplace or somebody's books won't balance. You can't just create money out of thin air and expect no one to notice.

$\endgroup$
  • $\begingroup$ By scam, do you mean Office Space? $\endgroup$ – kingledion Jan 4 '17 at 19:20
  • 2
    $\begingroup$ @kingledion Umm, by scam I mean "criminal fraud". Did they use that idea in this movie you're referring to? I didn't see it. $\endgroup$ – Jay Jan 4 '17 at 19:25
  • 3
    $\begingroup$ This type of fractional cent scam was used in Superman III. That was in 1983. $\endgroup$ – Thom Blair III Jan 4 '17 at 19:32
  • 2
    $\begingroup$ @ThomBlairIII Okay, the idea was around 30 years ago. I'm an old man, I often find myself saying, "Let's see, was that last week? Two weeks ago? Oh, no, it was 1975." $\endgroup$ – Jay Jan 5 '17 at 6:54
  • 1
    $\begingroup$ @kingledion you are correct that they use penny shaving in Office Space, but the characters in the movie say that they get the idea from Superman III. The scam itself has been around for ages. $\endgroup$ – Mrkvička Jan 5 '17 at 8:13
5
$\begingroup$

It depends on how good of a hacker you are.

If you think about it, the reason we put money in banks is because we trust that they are very good at not losing track of it. Any money you "create" by adding zeroes to your account and the subsequently withdraw is technically money they lost. Needless to say, they have a vested interest in this not happening, so they'll have a net of safeguards in place to catch you.

For instance, no bank account is permitted to simply "have a value." They have a transaction history that backs that value up. You would have to forge that transaction history. The better you do it, the harder it will be to find. Done well, you'll slip through the cracks. I'm certain banks do lose money every once in a while. As long as it stays below their profit margins, they can create the illusion of reliability by simply fixing the error with their own profits. Done poorly, however, and you'll trip some statistical safeguard that someone put in place to prevent some other issue you didn't even think of (maybe, by sheer luck, you accidentally make it look like a rounding error occurred, and for want of that penny, the bank becomes aware of your exploits!).

Remember Sutton's law. Willie Sutton robbed banks "because that's where the money is." There's a lot of organized crime groups that would love to rob banks, just like you. You may have to explain why your particular program manages to do it successfully when organized crime, with their extraordinary resources and botnets of zombies, couldn't.

Also, you have to be aware of offline backups. While the money you are stealing may be a pittance, the hole you are leveraging in the banks' security is a big deal to them. They don't want the mob to do what you're doing. Once they do detect your work, they'll start relying on all their resources. This includes offline backups which will help them detect your changes.

$\endgroup$
  • $\begingroup$ Banks do lose money, as you say. We don't have many bank robberies in my country (too small to have any larger number of robbers), but when someone do rob a bank, they never report to the public how much was stolen, simply to make sure that they can maintain an illusion of safeguarding money. They only report along the lines of "exactly how much the robbers obtained is unknown, but it was not a major sum". Also, one way of potentially avoid detection could be smurfing, to simply do the adding in small steps to look legit. $\endgroup$ – Mrkvička Jan 5 '17 at 8:22
  • 1
    $\begingroup$ One way to fix the history/transaction/tracking problem for your account is to have the program shift money from someplace the bank cannot easily track. The bank robbers stole \$3000? No, they actually stole \$300,000, and \$270,000 of it just entered my account. When caught they say they only got \$3000? They are obviously lying and hid the rest somewhere. $\endgroup$ – Mark Ripley Jan 5 '17 at 9:42
  • $\begingroup$ @MarkRipley Yes, but now you have drawn the attention of the banks with a much larger sum, so they will be investigating faster. Ideally you could find someone who already robbed a bank and piggback on their transactions, but now we're getting into a really clever sort of hack that may be beyond what the OP was thinking. $\endgroup$ – Cort Ammon Jan 5 '17 at 16:23
  • $\begingroup$ @JDługosz Thanks for the tip. Is there a central location where all of the special formatting rules for this site exists (for answers and comments)? It would be nice to have a reference page/cheat sheet so I can avoid formatting problems rather than fixing each problem one at a time whenever I stumble across them. In another answer I discovered using a '*' in an ASCII picture caused formatting problems $\endgroup$ – Mark Ripley Feb 24 '17 at 6:57
  • $\begingroup$ @MarkRipley yea, the help link right under the Add Comment button, followed by Learn more… link in the displayed summary. Contue this in Worldbuilding Chat room Factory Floor as this is off-topic. There might be a better summary and gotchas list somewhere. $\endgroup$ – JDługosz Feb 24 '17 at 14:09
3
$\begingroup$

In the US income is reportable, including interest in a bank account. Banks that loan money (read: every bank) must also establish the capital that they're loaning from by federal law.

Accounting works by a series of debits (increasing assets or recorded values) and credits (decreasing assets or recorded values), and the golden rule of accounting is that credit transactions must equal debit transactions, thus making the books balanced. In fact, this balancing is where the less-than-legitimate "balancing the books" comes from, as criminals try to artificially create this balance in records. By the sounds of it, you're not doing this, so the bank will be easily, easily tell that their (metaphoric) books aren't balanced. When they discover this will depend on how often they run reports, but it could be as soon as only a few minutes.

Assuming (by some miracle, or by you lining the right person's pockets) the bank never catches on, it becomes a matter of if the IRS will catch on. People joke about the IRS wanting its money, but the IRS typically doesn't investigate income reports unless there's a significant amount of money being dealt with, there's a significant oddity, or another government organization alerts them to suspicious behavior. So you'd probably be safe from the IRS as long as you're very cautious about how much you tweak your bank account.

$\endgroup$
  • $\begingroup$ if you are very careful, the bank won't notice either. $\endgroup$ – Mark Gardner Jan 4 '17 at 18:57
2
$\begingroup$

We're talking about a fictional character in a story, right? Kids, don't do this at home. You will be caught and go to prison unless you are the world's best programmer. Then there are easier ways to earn money ...

Other answers have pointed to the problem with accounts, credits, and debits. So the answer would be to hack the ATM system and to create a card that will allow unlimited withdrawals. Of course the problem would be detected as soon as an ATM has less cash on hand than it should have.

  • Delete the malware immediately after the withdrawal and leave no digital traces.
  • Wear a disguise in case there is a camera covering the machine.
  • Use many different ATMs.
  • Hack different banks in different jurisdictions. (But don't hope to stay undetected, it just slows the investigation.)
$\endgroup$
0
$\begingroup$

You will almost immediately be caught

Banks are required to do audits. They do them all the time. Screwing up an audit or having the books not balance is simply not an option. They need audits to be an FCC member, to meet the requirements of BIS for foreign transactions, to prove to the Treasury department they are not funding terrorists, to comply with Dodd-Frank, etc.

The bank will balance their books. There will be thousands of dollars in your account they cannot explain. They will investigate. You will go to jail. Its as simple as that.

$\endgroup$
  • $\begingroup$ Even if the bank isn't able to catch you, the national tax authorities will be very interested in all this money.... $\endgroup$ – Thucydides Jan 7 '17 at 1:44
  • $\begingroup$ It's one thing for a bank to realize it's happening and another to catch the person who did it. The obvious thing to do is to put a trace on whoever is withdrawing money from the account and to contact the account owner. Though, if you simply set the money to 300k and left, assuming you managed to cover your tracks as a hacker, they'd have a hard time catching you. $\endgroup$ – Neil Jun 9 '17 at 9:38
0
$\begingroup$

Yes you will get caught. In the past there have been people that rigged accounts to take tenths (and less in later attempts) of pennies on every transaction which is basically a below notice operation.

What you are proposing is a well above notice operation.

The people who actually did this type of stuff have all been caught as far as we know, sometimes after decades of doing it, other times almost immediately. It has nothing to do with the programming itself, but rather that accounts keep track better and better.

So... your proposed thing would be caught instantly.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.