£26,000 gone missing!

rb10

richardmk wrote: »

Looking at the vocalink Modulus validation of account numbers. It would seem Nationwide is going to have more problems than most by having two different modulus checks, 10 and 11. This is what happens when an organisation panics when their account numbers are about to run out, and the risk is passed onto customers.
http://www.vocalink.com/media/300578/vocalink_-_validating_account_numbers_v2.50.pdf
If you transpose account digits you would expect that you would simply create an invalid number, but by accepting the results of two checks the probabilty of catching such errors is considerably reduced.

To put this into perspective, even if you are indeed correct (I'm not convinced!), this'll be a tiny number when compared to Natwest.

You will see from the document that Natwest don't validate sort codes at all - so if you mean to send money to 60-01-01 XXXXXXXX and you actually send it to 60-01-02 XXXXXXXX (or any other genuine Natwest sort code, of which there are many), then there will be nothing in place to prevent that from going through and either getting stuck in a holding account, or going into someone else's account.

That's something to be concerned about for those with Natwest accounts.

(The same applies to all Clydesdale and Co-op accounts, also to most RBS group accounts on sort codes beginning 15/16/18).

richardmk

If looking at the exceptions validation can be either Mod 10 or Mod 11 it follows that the account number is less secure.


Exception 12/13 where passes the modulus 11check (in this example, modulus 10 check passes as well, however, there is no need for it to be performed as the first check passed).

Valli

opinions4u wrote: »

Not many savings statements get issued monthly.

That £1 test transaction is so important.

Have to agree with this - have used it myself in the past.

dalesrider

rb10 wrote: »

No - since the validation rules apply simultaneously to both the sort code and account number, then if you enter one incorrect digit to the sort code, but enter the account number correctly, then the payment will fail.

I would love to know what the real story behind this Guardian article is. My guess would be that she actually set up the payment to a payee already on her internet banking list (i.e. a completely different account number), instead of to her other account.

Well let me put it like this.
I have entered a sort code 1 digit wrong and hit a valid acc.....

Have to agree the story does not really stack up on many levels.

Hmm71

ylesia wrote: »

That is crazy that someone didn't notice £1k a month going missing - almost unbelievable! Also the suggestion that online statements are to blame! I am pretty much completely paperless and keep a much closer eye on things than I ever have as I don't need to refer to bits of paper!

I don't have any sympathy for her but pretty appalled at the lucky recipient who has obviously kept their mouth shut for 2 years (well if you believe the 'story' I guess)

I think I'd be very, very tempted to spend the first £1000 but if it kept happening I would tell my bank (I hope I would anyway ).

rb10

richardmk wrote: »

If looking at the exceptions validation can be either Mod 10 or Mod 11 it follows that the account number is less secure.


Exception 12/13 where passes the modulus 11check (in this example, modulus 10 check passes as well, however, there is no need for it to be performed as the first check passed).

Yes, thought about this a little more. You are completely correct. It does in fact mean there is a tiny chance of getting one digit wrong and it referring to a valid account number.

dalesrider wrote: »

Well let me put it like this.
I have entered a sort code 1 digit wrong and hit a valid acc.....

Did you see my later post? (Post 22).

With certain sort codes (including all Natwest ones), there is no validation in place to ensure that the sort code AND account number match up.

Nationwide explicitly validate the last four digits of the sort code, plus the account number. (But since the combination of 'weights' they use on this validation is unique to them, it implicitly validates the rest of the sort code too).

So whilst your experience will hold true for Natwest (and some others), Nationwide's validation means you are unlikely to have this problem when transferring to one of their accounts.

stclair

I have just gone to set up a payee on my online banking using my actual account number and a different NatWest sort code and this is the message I got:



Why? it says that ill never know as its actually the sort code thats not correct as it relates to another branch.

Now on postcodeanywhere.co.uk it suggests the details are valid:



How uncanny ;-)

lolavix

There are a few natwest sort codes with just 1 digit different which hold accounts of the same account number, so very easy to make an incorrect transfer...

rb10

stclair wrote: »

I have just gone to set up a payee on my online banking using my actual account number and a different NatWest sort code and this is the message I got:



Why? it says that ill never know as its actually the sort code thats not correct as it relates to another branch.

Can't see the image, but I assume it's from Natwest online banking and says the account doesn't exist.

stclair wrote: »

Now on postcodeanywhere.co.uk it suggests the details are valid:



How uncanny ;-)

As said above, Natwest don't include the sort code as part of their validation. So, as far as postcodeanywhere (or, more importantly, another bank) can see, that's a valid account.

It just happens that Natwest haven't yet used that account number (and so they know to instantly reject attempts at payments made to it). But it could exist, so other banks may attempt to make payments to it.

stclair

rb10 wrote: »

Can't see the image, but I assume it's from Natwest online banking and says the account doesn't exist.



As said above, Natwest don't include the sort code as part of their validation. So, as far as postcodeanywhere (or, more importantly, another bank) can see, that's a valid account.

It just happens that Natwest haven't yet used that account number (and so they know to instantly reject attempts at payments made to it). But it could exist, so other banks may attempt to make payments to it.

Cool just NatWest said the details do not exist, but as postcode says it does as you have correctly identified.

I guess it'll be one of life's mysteries