#HTE

Screenshot of the Horrific UI Design That Led Citigroup to Accidentally Send $893 Million

Last year Citigroup, representing Revlon, attempted to make a $7.8 million interest payment to Revlon’s lenders. Instead they accidentally sent $893 million–the entire balance of the loan, which was not due until 2023.

When they realized their mistake, they tried to get the money back. Some of the lenders refused, leaving Citigroup out of roughly $500 million. The case went to trial, and this week U.S. District Judge Jesse Furman in Manhattan ruled against Citigroup.

How could an error like this possibly happen? Terrible, terrible UI design, as it turns out. First off we need to understand the mechanisms of the repayment arrangement, which is executed through a piece of financial software called Flexcube. As Judge Furman summarized:

On Flexcube, the easiest (or perhaps only) way to execute the transaction—to pay the Angelo Gordon Lenders their share of the principal and interim interest owed as of August 11, 2020, and then to reconstitute the 2016 Term Loan with the remaining Lenders—was to enter it in the system as if paying off the loan in its entirety, thereby triggering accrued interest payments to all Lenders, but to direct the principal portion of the payment to a “wash account"—"an internal Citibank account… to help ensure that money does not leave the bank.”

Ars Technica got ahold of a screenshot used in the case, which shows where the screw-up occurred:

The actual work of entering this transaction into Flexcube fell to a subcontractor in India. He was presented with a Flexcube screen that looked like this:

The subcontractor thought that checking the “principal” checkbox and entering the number of a Citibank wash account would ensure that the principal payment would stay at Citibank. He was wrong. To prevent payment of the principal, the subcontractor actually needed to set the “front” and “fund” fields to the wash account as well as “principal.” The subcontractor didn’t do that.

Citibank’s procedures require that three people sign off on a transaction of this size. In this case, that was the subcontractor, a colleague of his in India, and a senior Citibank official in Delaware. All three believed that setting the “principal” field to an internal wash account number would prevent payment of the principal. As he approved the transaction, the Delaware supervisor wrote: “looks good, please proceed. Principal is going to wash.”

Instead, the principal went directly to the lenders.

It looked “good” to the senior supervisor because there are no design provisions to make it look bad. You would think, where an error of this magnitude was possible, the software designers would group certain buttons together, provide warning prompts, change colors from green to red, or a combination of these things. Instead the program appears to have been designed by an engineer in the ‘90s.

The upshot for you UI designers out there: Banks will certainly be looking for better software in the future, and willing to pay top dollar for it. There’s a real opportunity here.