Who is responsible for missing money?

https://shkspr.mobi/blog/2025/04/who-is-responsible-for-missing-money/

I have a simple rule of thumb when it comes to news reports. The real story is always in the penultimate paragraph.

Let's look at this inflammatory headline:

Woman’s 'spree' after $158k banking error, refuses to return pensioner’s life savings

An Auckland beneficiary is under investigation for an alleged “spending spree” after $158,000 was mistakenly transferred to her account.

[…] pensioner lost his life savings due to an account number error.

The account number provided to Westpac had only 15 digits, not the intended 16, so Westpac added a zero to the suffice [sic] as per its usual protocols.

Newstalk ZB

Wow! That seems pretty bad. Obviously the woman who allegedly received the money and then spent it shouldn't have done that. Spending money that doesn't belong to you is a crime in most parts of the world. But let's focus on the real villain here - the evil bank!!

Why did the bank make the decision to add an extra digit to the recipient's account number?

An NZ bank account number looks like BB-bbbb-AAAAAAA-SSS.

The first two digits are the banking institution and the next four are the specific branch. The seven digit account number relates to the specific account. The three digit suffix is for the type of account. For example, your spending account might have suffix 001 and your savings account might have suffix 099.

However, because all suffices have a leading zero, it is often only displayed as two.

So, adding an extra zero to the suffix itself shouldn't have caused a problem. It would have gone to the correct recipient although it might have either gone to the wrong sub-account. Indeed, WestPac's help page on international transfers says "if your account suffix is 12, enter 012". It sounds like the journalist hasn't quite understood where the insertion happened.

It seems likely to me that the victim meant to type 1234567-001 but missed a digit, causing WestPac to shift things to 1235670-01. That's poorly formatted but technically valid.

But, wait! Don't bank account numbers have checksums? Yes! According to NZ's internal revenue, all bank account numbers have a check-digit. However, when checking an account number's validity:

If less than the maximum number of digits is supplied, then values are right justified and the fields padded with zeroes

Bank account number validation

Having played around with the algorithm, the first few digits of the account number aren't included in the checksum validation. For example, the account number 1234567 and 0234567 both pass checksumming. So it is possible that padding the start of the string wouldn't have been picked up.

Whatever the underlying issue, it is distressing to hear of someone losing a significant amount of money.

What could have stopped this?

Humans make mistakes. As an industry, we know this. It's our job to prevent, rectify, and neutralise those mistake. We need systems in place which reduce the likelihood of errors causing catastrophic failures.

Here are some systemic changes which could have prevented this:

1. New Zealand could adopt the IBAN standard for international transfers.
   • They don't seem keen on doing this.
   • It wouldn't prevent mistyping, but a standardised length makes transferring to the wrong account less likely.
2. Confirmation of Payee asks the user to type in the name of the intended recipient. If it doesn't match the bank account, the payment is rejected or cautioned against.
   • NZ is rolling out CoP but it doesn't yet apply to international transfers.
   • Multi-lingual CoP is complex. I don't know if any cross-border payments do this yet.
3. WestPac should have noticed the name discrepancy.
   • This is the argument I have the most sympathy with.
   • Of course, returning the money (especially to a closed account) may be difficult.

Large systems changes are expensive and time consuming.

What else could have been done? Let's go to the final few sentences of the story:

Unfortunately, the incorrect bank account number provided by Che was a valid account number for another customer, Westpac said.

“As soon as Mr Che alerted us to the issue, we traced the payment and froze the remaining funds.”

But Westpac was unable to recover the rest of Che’s money due to the seven-week delay in reporting his error to the banks.

Emphasis added

I'm not trying to victim blame here, but WestPac seem to have done what was asked for them. The sender provided an ambiguous bank account number which was, nevertheless, valid.

The sender didn't raise an issue for seven weeks. Once notified, the bank froze the recipient account and notified the police.

Yes, big evil banks should be less evil. But they're in a tough spot. People want protection, but they resent banks telling them what they can and can't do with their own money. Big systemic change is difficult but it seems crushingly unfair when an innocent party is caught in the middle.

I don't think anyone comes out of this covered in glory. Banks need to invest in technology which keeps their customers safe. Customers need to take some responsibility for checking whether a bank has done the right thing.

The only tips I can give is that you must always copy & paste financial details from a trusted source, rather than manually type them in. Always send a small amount first to check it is received. If you suspect a mistake, contact your bank immediately.

Stay safe out there.