Brit bank TSB TITSUP* after long-planned transfer of customer records from Lloyds UK bank TSB's efforts to upgrade its systems have left numerous customers without online banking services – and some report having unintentionally accessed different accounts' details. The organisation, which split from Lloyds Banking Group in 2013, chose this weekend to complete the move of its customers' data from Lloyds IT …
Completely down for me (with no bonus access to others' accounts, unfortunately).
I was surprised to see they chose to illustrate their unavailability with a fat cat (maybe they're trying to reclaim the term?), lying on a tree branch, apparently sick through overindulgence. One of their marketing people must be a frustrated satirist.
This post has been deleted by its author
"Although the transfer has been a long time coming, many TSB customers only found out about the planned service disruption via a tweet sent at 5.36pm on Thursday 19 April – less than 24 hours before the digital blakcout was due to start."
Bullshirt. I got an email about 2 weeks ago about the transfer, and a text message last Wednesday about the downtime.
Now unless I've got some special TSB account where I get all of this information before the great unwashed, I would rather think those moaning just need something to moan about to make their Monday a little bit more interesting.
The only notification I got (as I've just checked) was an email on the evening of Tuesday 17th (21:19) stating TSB would be down from 4pm on the Friday throughout the weekend. No text messages. So I got a full day's extra warning than those on twitter - lucky me!
Even 2 working days notice is pathetic from a bank for such a major shift. And the fact they're having issues today means it still didn't go correctly. I'm probably going to vote with my feet on this one and shut the account over it - that'll learn 'em!
That depends, if you have enough products or money with them, then quiet possibly (not that you'd always know mind...) - I used to work for HBOS once upon a time and we did this kind of thing for more important customers.
Annon because It was a long time ago and I needed the money.
Same here, I've seen a decent amount of notification about the big upgrade in the weeks proceeding.
I've had email , text message, warning message every time I opened the mobile app for the past week or two, and it has also on the online banking site as well to reminding us that the upgrade was happening and to plan ahead if needed.
"Bullshirt. I got an email about 2 weeks ago about the transfer, and a text message last Wednesday about the downtime."
Well I got my text 45 minutes after the down time started.
They dont send me emails because they constantly sent me crap, but they are meant to send important messages...
Regardless of when people were notified the notice clearly said that access would be restored at 6pm on sunday. Unless Im very much mistaken its now 1pm on Monday and I still dont have access to my personal or business accounts.
Im willing to bet they managed to take their mortgage payment though....
@wolfetone
"Bullshirt. I got an email about 2 weeks ago about the transfer, and a text message last Wednesday about the downtime.
Now unless I've got some special TSB account where I get all of this information before the great unwashed, I would rather think those moaning just need something to moan about to make their Monday a little bit more interesting."
Well, its wednesday now... and it all still off. Hows that working out for you?
This post has been deleted by its author
The migration was originally due in October 2017, as to avoid a serious rise in the fees charged by Lloyds for managing their IT for them. The reason given for the delay was to avoid impacting the new system with an increase in queries around the upcoming rate rises. I'd also read that Brexit concerns were a reason too.
Does anyone seriously think this was ready to go last year? Course not, they HAD to delay it to get it working. Not saying the involvement of KPMG made it worse either......
And why I am now seriously considering changing bank - they wanted me to install their mobile app which demands permissions for everything. Why do you want to make phone calls, see my pictures? It looks to me as if nobody has done the most basic security audit. I'm thinking of complaining to the ICO. An app which if breached basically allows someone to pwn your phone? What is wrong with these people?
Exactly the same problem with business banking.
It's a land-grab before GDPR. Immoral and reprehensible. Boiler plate replies don't help either.
I'm moving. Read the comments. It's not just us.
https://play.google.com/store/apps/details?id=uk.co.tsb.businessmobilebank&hl=en
@Anon
"Exactly the same problem with business banking."
I have installed the business banking app on a shitty old mobile that I leave on my desk (only recruiters get that number) so its got access to nothing more interesting than a bunch of texts offering me work that I dont want!
That said, the old card reader was fine, Im sure the app saves them money but putting the key gen on an internet connected device seems like a step backwards in terms of security to me.
I think I'd be more worried about my bank account being pwned than my phone...
The call permissions is to enable a customer to make a phone call from within the app itself that is then treated as pre-authorised for security purposes, rather than re-running all the questions about your granny's sister-in-law's mother's maiden name, or the last three purchases made with your debit card - all of which are difficult when you've just had the bag lifted and are now standing in a dark street in a foreign country with neither cards nor cash. Or any other stressful circumstance at which you might actually *need* to talk to the call centre.
"The call permissions is to enable a customer to make a phone call from within the app itself"
Yes, and what about access to my photos, music, location and contacts? Why would it need these?
Now I check again, I note it doesn't ask for permission to make phone calls. So your example seems to be somewhat invalidated.
I wouldn't bother. The ICO don't appear to give a fuck unless its a massive breach. 2 of us reported a local recruitment agency for their continued data breaches. Although appear minor, they are still breaches. All the ICO advised was to try and sort it out with the company yourself.
I have, several fucking times, they apologise then do the same thing again a few months later. The worse was sending my payslip to another engineer.
Who cares about your phone being pwned through a banking app? I care more about my bank account being pwned through my phone! After all it's got all my money in it...
It'd be inconvenient for them to break into my e-mail and ebay, but liveable, and I'm thinking of dumping the ebay app anyway due to its lack of features and repeated promoting of bullshit IT from Currys
All your base belongs to us:
This app has access to:Identity
find accounts on the device
Contacts
find accounts on the device
read your contacts
Location
precise location (GPS and network-based)
SMS
read your text messages (SMS or MMS)
receive text messages (SMS)
Phone
read phone status and identity
Photos/Media/Files
read the contents of your USB storage
modify or delete the contents of your USB storage
Storage
read the contents of your USB storage
modify or delete the contents of your USB storage
Wi-Fi connection information
view Wi-Fi connections
Device ID & call information
read phone status and identity
Other
receive data from Internet
view network connections
full network access
run at startup
control vibration
read Google service configuration
I actually think the average banks board thinks they're living in a bad dream and the internet and computers are going to go away. Rather than do the honorable thing, resign and go and run a private bank. They continue to avoid investment, long term planning and spend inordinate amounts of time waiting for the spreadsheet to load, to adjust the bonus and bribes columns. #youeachhaveacharacter #emeraldcity
The banks are, on the whole, paying the price for moving fastest into IT, like, 30-40 years ago, then upgrading continuously.
They invested heavily in mainframes early on, and built new on that (remarkably solid) base, then new on that, then new on that... and now they're stuck with seven layers of legacy hell because a full replacement is expensive and risks looking exactly like this news item. They've traded a system that mostly worked for one that doesn't. There's a chance they could have done it right, but few people are willing to take that risk, given how often IT change programs fail.
It's the same story all through finance as a whole - new shiny companies have great responsive public-facing IT but no understanding of what will go wrong at scale, and no built-in pile of fixes for problems most people have entirely forgotten about.
Old companies have rock-solid mainframes buried under layers of cruft and middleware before approaching the customer-facing applications, which inevitably run like cold treacle and fragment at the merest thought of a change request.
That's your choice, really: do you want your hard problems addressed with organically developed spaghetti-code in five languages, or with clean modern code that's not been battletested in the same depth?
Re your point on Banking IT, If you are in the UK then I would recommend the Horizon from 1977/78 on iPlayer.
https://www.bbc.co.uk/iplayer/episode/p01z4rrj/horizon-19771978-now-the-chips-are-down
I watched it the other night and it is fascinating looking at it 40 years later (having been around 10 when the program went out).
Steve
"The timing is plausible, since decimalisation was in 1971, and banking mainframes did exist in the 60s, [...]"
A friend was manager for one of the high street banks. His twin children had been born on New Year's Eve - which was always the day when he couldn't leave the bank until they had balanced the books down to the last 1/2p (1/2d?). He always arrived home long after the party had finished.
He was finally at home for the twins' 21st birthday party in 1971. That was the year the computerised systems relieved him of the end of year chore.
But why bother to fix it by amending many tens of thousands of lines of COBOL when you can just write a shim to do the conversion on all the inputs and outputs? There's an exact conversion between LSD and decimal currency so even those financial institutions which calculated interest to 10 or more decimal places would still be happy.
I got a text from them at 16:45 on friday telling me that the system would be offline from 16:00 on friday.
Which was nice.
Then on Sunday evening at 6pm when the system was meant to be back online my card stopped working - I don't know if that's because I've fucked up and don't have any money in that account (I only keep a small amount in that one as its contact-less) or if there is an issue at the bank stopping authorisations going through.
I also dont have access to my business account so dont know if clients have been paying me or not.
I dont have phone banking set up because a few years ago someone managed to phone up impersonating me, set up a new account and then set up direct debits with vodaphone on a business account and ordered a shit load of new phones in my name - luckily caught before the situation got bad but still a pain in the arse.
Development and testing was mostly offshored in Spain which is where their banking software originates. Some UK testing done too with mixture of contractors courtesy of KPMG and branch staff.
I'm wondering when TSB renames itself to Sabadell in the hope people forget about this weekend.
I have experience with testing this type of things long tome ago for a bank in spain.. and testing tends to be hell because they DONT trust you with real data.. so you get "synthetic data" that is "as good as the real deal".. and well, the whole thing is a travesty.
I dont know if this is the case this time,with this bank, but I suspect it might be.
"Testing is for wimps" well yes, in order to be able to test the thing, you have to design it for testing first. Try designing something (anything !) properly, when the only thing that matters is meeting the deadlines with the ever-growing list of features. Where things such a monitoring, or testability, or control, or logging, or benchmarking are sure to have dropped down the list because the only thing the managers understand is the flow of forms, or in the best case Excel spreadsheets. And when was the last time you saw tested spreadsheet?
I am not saying this has happened here (do not have sources in TSB or Lloyds) but I have worked in banking long enough to know that competent managers are exception, not rule.
Excel shouldn't be used for that sort of thing but is.
I have seen tested Excel spreadsheets. The issue is not the spreadsheet but the process and the documentation. The spreadsheet stays the same but the system it interfaces with does not. No one updates the spreadsheet, and the spreadsheet breaks the system.
Everything has to be documented and communicated with all parties, otherwise what is initially an unimportant aside becomes critical. Five years later this unimportant aside breaks, because it was never correct and made assumptions. If the existence of this aside was communicated the design would have been fixed, instead the component it depends upon is changed, it breaks the assumption made in the aside, and causes a huge amount of hassle.
Yes, you are supposed to use obfuscated data in test environments.
I would recommend that unless the system is entirely new production data is used where possible if you want things to actually work. I don't work for a bank, fortunately, but the systems I work on include :
Implementations where the code and data have changed over a decade, so what the data look like at year one are not the same as in year ten, for the same actions.
Data that have bypassed all validation, because validation wasn't included in a special out of bounds data submitter. The data were of course presumed correct when supplied.
Staff who have manually edited data, despite being told not to, because it's easier and quicker than doing it the right way.
Data that have been manually edited because otherwise it would need a convoluted code change, that has been tested and works for years, until a special new upgrade comes along that can't cope with the 'data in a state that is fine for everything except this' condition.
Code that has been incorrect for a short period, and tweaked data in ways that it shouldn't.
Tools that have the power to break things if they are used incorrectly, being used incorrectly.
Data being deleted when it is a dependency for something else
Data in the future or past because it was entered legally, but incorrectly.
Obfuscated test data would be unlikely to do any of the above, it's difficult to generate enough data to realistically test the system, and it's non trivial to anonymise all data as some have dependencies on others, and still possible to identify people.
For instance, if you tested your organisational chart modelling tool, with a certain Mr. Goreja Tray at the top, with 21 heads of department below him, another 294 'employees' in the organisation, supported by a third party organisation with 10 members, competing on 'deals' comprising 650 delegates including themselves.. I, for one, would have absolutely no idea where the source data came from.
TSB renaming itself to Sabadell? You mean something like The Sabadell Bank?
Yes, I bank with TSB, and no, it's still down. I think the cat must have fallen off the branch and squashed something important. Thankfully I have another bank account to be going on with.
How about going into the bank and withdrawing as much as they will allow and taking the cash to another bank or alternatively just transferring it to under your pillow where it gets more interest.
Did you think that putting your money in gave them the right to keep it and treat you like you didn't matter?
I did..
I had a halifax (Building Soc) account a bank of scotland account and a TSB (Back before the lloyds merge) account.
All of them were gobbled up into one big mess by lloyds banking group over the last 10-15 years.
Halifax and BOS merged what... 15 years ago. I still cant use my BOS card to pay cash in at the automated machines in branch... and my nearest BOS branch is over the border.
the problem with testing in these sort of situations is that the "test data" has been lovingly fiddled with over many years to be perfect.
Unlike the real world.
I have seen a few projects where more work went into fixing the test data than the program that was supposed to use it.
....that's what you get for outsourcing your IT to IBM. IBM who are making everyone redundant so no one gives a fuck especially with the thought your IT job is also going to be outsourced aboard.
Keep staff in house and give them a decent wage and they'll give a fuck. Treat them like cheap dogs, then they'll be like Roy from the IT Crowd when he takes ages to answer the phone.
When will companies and mangers learn IT matters and isn't something you can just do on the cheap and outsource.
Fools.
When will companies and mangers learn IT matters and isn't something you can just do on the cheap and outsource
Never. The important question is: When will IT-people (and engineers) learn that if one is not one of: Management or Sales (which pulls in the profits) one is merely an Operating Expense (a destroyer of shareholder value, something that must be minimised and something that the other two productive classes indeed get incentives to get rid of).
Ive been in.. its very slow and it told me twice that my user ID/Password was wrong (It wasnt)
Edit. Sorry everyone. I jinxed it.
Just getting "Error loading data" now and for some reason my mortgage balance looks like its quite a bit higher than last time I went in... Though I might be imagining that, its not something I monitor daily!
Doesn't seem too bad now, except that the debit card transactions I made over the weekend are still missing. Most annoying though is they've changed the date format in the .csv export from dd/mm/yyyy to dd-mm-yyyy, so I had to add an extra line of code to the import on my budgeting spreadsheet. I think I'll send the TSB a bill for my time.
Try viewing your direct debits.
On the one occasion it loaded for me they seem to have changed the paid date column so that every cell has the word "PAID : " before the date. Completely superfluous change and makes it harder for me to import the data into a spread sheet like I normally do...
You're lucky.
My Direct Debit screen says "You don't have any Direct Debits set up for this account". Which is gonna come as one hell of a surprise to my mortgage company...
The web page title for the list of accounts screen is "holding list" - yes, in lower case.
It's a total clusterfsck. This is pretty basic stuff. Did they do ANY testing??
It would probably help if they removed their test internal domain from their Angular javascript.... looks like a blocker on at least one piece of functionality to me; no expert... but I do not what the Google Developer Console is for. They should try it.
Well, I can't log in at all now. It's claiming invalid credentials, even though my credentials are correct.
Ah, there it is: "https://test1.int.uk.tsb/14562512/SbtlTsbr_t.js" - clearly flagged up on the login page console.
I get the impression someone, somewhere is frantically restoring "direct_debits.xls" from last week's backup tape. I had no idea banking IT was so shonky...
@clanger9
oh my god, I didnt even think to bother to check the dev console or fiddler...
That makes for quite comical reading.
We have websockets trying to establish connections back to 127.0.0.1 with a n array of port numbers, but of course thats all firewalled off so the only port its managed a connection on is 3389 which is already in use (Strange that).
Aaaaaannnnd look at that running synchronous code on the main thread.. that will be why the page stops working when I try to login...
And the fact that its trying to load resources from test1.int.uk.tsb is a bit of a worry... Ill bet it works for them though!
I half expect the images to all be pointing at "file:///c:\Development\Banks\TSB\Resources\Images\"
----
On a seperate note the few times I have been able to get on I have confirmed that there is money in my account... but my card is still being declined - anyone else experiencing that?
Logged into "my wife's" account but somebody else's account was presented that we didn't recognise. Screengrabbed about 6 months worth of statements and even managed to capture the real account holders name. I'll be keeping this somewhere safe until regulators are ready to act.
TBH this could be test data as I've tried to track this person down from their employer on linkedin and not found a match yet.
I could hand this evidence into the regulators Or....and way more fun...I can see they regularly pay over £100 every month or so to the same hair salon. I could phone them to confirm their next appointment, book myself in for a trim and start the mother of all stalking games....let me know what I should do. :p
This post has been deleted by its author
The sound of silence is deafening over the fact that this is a modern state-of-the-art banking system, dragged off the boring, reliable, legacy Lloyds mainframe and put on edgy x86 cloudy stuff - and - oh dear - it's all gone wrong. If this was a mainframe system, there would be finger-pointing at the platform from every commentator - as it is - nada - nothing to see here, move along...
And it's still playing silly Bs.
I managed to get in after several aborted attempts around 1900 and managed to move some cash from deposit to current accounts and it took several minutes between page redraws - but it worked.
I then tried to reduce my Credit card debt and it all looked OK until I got to the bit "enter your password to confirm the payment"
Then I got it again, and again and again until I gave up.
It's now midnight so I thought I'd have another go.
Logging in was almost as quick as it was when it was Lloyds but trying to make that payment was another exercise in futility.
I folks get penalised for late or missed payments as a result of this, is TSB liable?
"Thrice the brinded cat hath mew'd.
Thrice and once, the hedge-pig whin'd.
Harpier cries:—'tis time! 'tis time!"
... To render the curs-ed degrade live
I can login ok but when I attempted to make a payment just now, after re-entering password and clicking 'confirm' I got:
'! ArrayIndexOutOfBoundsException exception: null'
To be fair you always expect a few bugs in those hard to anticipate/test obscure ans subtle usage cases...
I also didn't get an email and got the text message an hour after too late.
Paris because I expect she was hired to head up the upgrade. And there's no Jedward icon
The TSB used to be owned by the people who has money in the bank, it was then sold by the UK Government of the time (Conservative Party)
So unless you are a member of the above political party then taking say £13k of money not belonging to you would be called theft and result in you being arrested as the criminal you are.
Before I was made redundant due to outsourcing I witnessed a massive loss of management control and ownership of the IT systems at Lloyds. As more systems were outsourced to India the management no longer had the knowledge or experience to manage their changing systems. They had to place their faith in 3rd parties who in many cases had pull the wool over the executive eyes. And the architect of this shambles - Antonio Horta Osario (Share Price stuck around 65p for the past 10 years) - time to go I think.
Seems to me they're probably in a real bind by now, in any 'normal' upgrade snafu you would be reassured that you could roll back to the last known good position and back out gracefully. But because the last known good was on the Lloyds Bank system any roll back would involve rolling back all of the Lloyd systems as well......
Measuring the complexity of the systems and issue probably means there is never a snapshot in time that they can actually ever accurately roll back to, so the only way to perform a migration of this nature is the equivalent of running two trains in parallel and throwing the TSB customer accounts across the gap and hoping that they land up in the equivalent carriage and seat.
The only way that I can think that a rollback could possibly work would be if every transaction in and out has been logged and can be re-run back into the old system, the problem being that as soon as they migrated into the new environment and transactions started to go through a rollback to lloyds was off the cards.
I would hope that they have some clever process to be able to unwind everything but having been involved in big migration projects in the past I very much doubt it.
On one occasion we told the business that once the process finishes and users hit the system rollbacks are impossible... 7 days after go live some muppet manager scheduled a final go/no go meeting to decide whether to keep the migrated system or not... I have no idea what his plan was if they decided "no go" because with a weeks worth of new data and updates to the old data there was *no* going back...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
