<story><title>UK bank fined £49M over IT system meltdown</title><url>https://www.bbc.com/news/business-64036529</url></story><parent_chain><item><author>azalemeth</author><text>I have a bank account with TSB and got compensation as a result of this mix-up.&lt;p&gt;Some rather personal experiences of the fiasco:&lt;p&gt;– Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, &amp;quot;dynamic&amp;quot; way. I still can&amp;#x27;t use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid extensions block.&lt;p&gt;– This was introduced at the time of the switchover, and until that point the IT system used looked identical between Lloyds, TSB and Halifax &amp;#x2F; BOS systems (I have accounts with some of those)&lt;p&gt;– The online browser-based system was telemetry and JS heavy, replacing a far leaner page&lt;p&gt;– I was unable to log in during the time of the fiasco, mostly due to 403 errors or timeouts. Often the page would just hang as an async request wasn&amp;#x27;t answered.&lt;p&gt;– Once I did manage to log in, I was amazed to see another person&amp;#x27;s account details (!!!), replete with (their) name and statement.&lt;p&gt;– I was unable to use online banking to pay bills or check my balance – I could see someone else&amp;#x27;s account in detail but was too honest to do anything with that knowledge. I can&amp;#x27;t remember if my card stopped working but I was effectively forced to make other arrangements for quite an extended period of time.</text></item></parent_chain><comment><author>varispeed</author><text>&amp;gt; – The online browser-based system was telemetry and JS heavy, replacing a far leaner page&lt;p&gt;I remember one of those banks using the &amp;quot;leaner&amp;quot; page also had heavy telemetry turned on at some point. I type very fast, so I noticed that when I was entering my user id, it was lagging heavily. Then I turned on developer tools only to see that they were logging all keystrokes to analytics. Including username and password. At first I thought I got a virus or something, but these appeared to be legit scripts from the bank.
So I decided to not use that bank account for a while.
I wonder why would they turn something like that on.</text></comment>
<story><title>UK bank fined £49M over IT system meltdown</title><url>https://www.bbc.com/news/business-64036529</url></story><parent_chain><item><author>azalemeth</author><text>I have a bank account with TSB and got compensation as a result of this mix-up.&lt;p&gt;Some rather personal experiences of the fiasco:&lt;p&gt;– Rather pointlessly, the website changed from being mostly static to entirely written in a very JS-heavy, &amp;quot;dynamic&amp;quot; way. I still can&amp;#x27;t use it in my normal browser (FF) with its extensions because it relies heavily upon CORS requests and referrer information that my somewhat privacy-paranoid extensions block.&lt;p&gt;– This was introduced at the time of the switchover, and until that point the IT system used looked identical between Lloyds, TSB and Halifax &amp;#x2F; BOS systems (I have accounts with some of those)&lt;p&gt;– The online browser-based system was telemetry and JS heavy, replacing a far leaner page&lt;p&gt;– I was unable to log in during the time of the fiasco, mostly due to 403 errors or timeouts. Often the page would just hang as an async request wasn&amp;#x27;t answered.&lt;p&gt;– Once I did manage to log in, I was amazed to see another person&amp;#x27;s account details (!!!), replete with (their) name and statement.&lt;p&gt;– I was unable to use online banking to pay bills or check my balance – I could see someone else&amp;#x27;s account in detail but was too honest to do anything with that knowledge. I can&amp;#x27;t remember if my card stopped working but I was effectively forced to make other arrangements for quite an extended period of time.</text></item></parent_chain><comment><author>usr1106</author><text>As a privacy-aware user, when making a contract with a bank (or buying a flight ticket or whatever) you should get assertions that their web site meets certain quality standards so you can use your browser to access the account or actually check in.&lt;p&gt;Paper did not have those incompatibility problems...&lt;p&gt;However, from the BBC article I conclude that even customers with a default browser could not necessarily use their account&lt;p&gt;Edit: Forgotten not added.</text></comment>