Two brothers in their twenties were briefly detained by police this week after they allegedly transferred TL 16 billion ($1.08 billion) to each other due to a flaw in a bank’s mobile banking app private. The brothers, identified as RG and EG, were detained but released on bail and their bank accounts frozen.
The suspects reportedly discovered a loophole that allowed them to withdraw as much money as they wanted via an investment account connected via the bank’s mobile app. The account, reserved for customers carrying out stock market transactions, would have had a bug and would have allowed the brothers to make in two days nearly 70 withdrawals.
EG told investigators he had no money in the account when he checked it on Feb. 26. He selected the “investment account” option on the app when a menu appeared and asked him to enter the amount of money he wanted to withdraw. . “I typed a random number and saw that the amount I had written was transferred to my account. I decided to try typing more and each time that amount was transferred on my account,” he said. EG was quick to spend the money. On the same day, he transferred TL 300,000 ($20,215) to buy a mobile phone and a car online, but the transfer was blocked. He said he managed to withdraw around 40,000 TL from an ATM and the next day he withdrew more money from his “new” 16 billion TL account.
“I told my family and we decided to pay the unpaid debts of everyone we know. I did it with my brother and we wired 80,000 TL to my indebted relatives.” The brothers were not arrested until two days later when a bank official called them to inquire about the “huge sum of money” transferred to their account. The brothers told the official that they transferred it from their investment account but the account was blocked during the phone call. RG said he used his debit card linked to the account to first buy three mobile phones for 100,000 TL and then withdraw cash from ATMs. “We wired 300,000 TL to a car salesman to buy a car. He received the money through his online account but the transfer was later blocked by the bank,” he said. RG confessed that some relatives he sent money to were able to withdraw the money and some even spent it.