47

There's a popular story that describes a programmer having altered a program at a bank so it diverted fractions of a cent from every transaction to another account (or some variation like multiple accounts) so he could collect it later.

The story has been so popular that variations have been referenced in a Superman movie and Office Space.

Was this based on an actual story, or is it simply a myth? If it did happen, what happened to the programmer?

  • 4
    Difficult to get a real proof, because no Bank will ever recognize that kind of internal fraud. – Dr. belisarius Feb 6 '13 at 22:41
  • 1
    I live in a "Banker's Town" and, as such, I have numerous friends who work in the industry. I recall having a conversation with a friend about 4-5 years ago on this "exploit". What I recall is that once this was discovered by the banks, the banks wised up. Banks now do this on their own. This may seem like banker fraud. But, the difference is they take all values, positive and negative. This keeps the account value at a running average of 0, but the movement is traceable. – RLH Feb 7 '13 at 13:26
  • 4
    This is called salami slicing – Sam I Am Feb 7 '13 at 15:41
  • Wasn't that the plot to Superman III? – RecursivelyIronic Feb 13 '13 at 19:28
  • I read the story about a banking employee that embezzled around US $2 million on the East Coast of America. The story appeared in an old edition of Readers Digest in Australia, so it was at least 20 years ago. The man was caught and later went on to work for the good guys in the field of security. You may be able to find the original article through Reader's Digest in America. Good luck! – user23412 Dec 22 '14 at 0:11
38

There is a significant amount of anecdotal evidence that supports the claim that, not only did this happen once, but that it happens rather frequently. Unfortunately, most of these claims appear to come from members of the security industry, which may have a vested interest in convincing people that this type of activity is taking place.

The type of theft you're talking about is called salami slicing. There have been a number of papers published on this attack by security researchers (not peer reviewed, mind you), such as this one and this one. This second paper repeats a variation of what is probably the most famous claim: a former bank employee in Canada who stole $70,000 using this type of attack. Unfortunately, the papers are lacking in details, and the references don't match the contents.

The most often quoted (and not cited) source for these claims seems to be this Network World article, which recites a list of supposed convictions based on salami-slicing techniques. Again, it's lacking in details, though it does give dates and jurisdictions for several purported cases of salami slicing.

Overall, my intuition tells me that micro-theft of this sort has certainly occurred at some point in the past. It's really nothing more than a modernized version of clipping coins, which certainly happened on a regular basis. However, I cannot find any evidence of any single, famous, and verifiable case of salami slicing that matches the circumstances usually supplied in the anecdotes you mentioned.


On a related note, there's much better evidence regarding similar kinds of salami attacks, just not ones involving bank employees. For example, this Wired article describes a man who allegedly defrauded E*Trade using a variation of a salami attack (related to how the brokerage firm verified that it could deposit money into your account), including links to a Dept. of Justice affidavit describing the attack. There was also a case in Florida of a rental car firm overcharging customer for tiny amounts of gasoline on returns.

  • 6
    @RoryAlsop unless they use floating point ;-) – gerrit Feb 7 '13 at 12:43
  • 4
    @gerrit Mostly they used fixed-point decimal values since they are more accurate when doing calculations in base-10; we typically do the math out to ~8 decimal places then round to 4 (a SQL MONEY type, for example). – KutuluMike Feb 7 '13 at 13:31
  • 1
    @gerrit - Or if they are using a Pentium processor. – rjzii Feb 7 '13 at 17:12
  • 3
    @gerrit: as long as the money is "moved" in each transaction (I know financial systems do this but I don't the exact name), using float point calculation is fine. By "moving" I mean decrease certain amount from one account and increase exactly the same amount on the another account. A example would be calculation can come up with an interest of $0.55555... but it will be rounded to either $0.55 or $0.56. In either cases, one account will be credited while the other account will be debited at the same amount. You never get one extra cent from such a transaction. – Codism Feb 7 '13 at 19:12
  • 12
    @Codism I'm afraid that's not true. You're wrongly assuming that it's always possible to, given an amount, add exactly this amount to a particular balance, or subtract it. When X and Y are valid floats, X+Y often isn't representable and you end up with X+Y±ε, probably with different ε at debited and credited account. Floats + money = no. – Kos Feb 9 '13 at 11:15
8

The Snopes entry on the "Salami Technique" calls it a "legend," which doesn't say whether it's true or false. http://www.snopes.com/business/bank/salami.asp

It references stories from the 1978 book Computer Capers, whose description says it's "incredible but true." http://www.snopes.com/sources/business/computer.htm

One story is about a "programmer working at a mail-order sales company" who was caught and fired.

You must log in to answer this question.

protected by Oddthinking Feb 11 '15 at 4:24

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .