business hacking currency
Is unintentional one-time bug abuse illegal?
<p>Concrete examples :</p>
<ol>
<li><p>Someone making API requests through a banking platform, withdrew many times in succession, and through some miracle bug they all went through.</p>
</li>
<li><p>Someone unaffiliated with a business, deletes a its entire database with an unintentional request.</p>
</li>
<li><p>Someone purchases twenty video game Steam codes at -99% through one transaction.</p>
</li>
</ol>
<p>etc.. All of these are one-off mistakes, where a bug does exist, yet it is unintentionally used in a way where this single error causes notable damage to the business. Are they legally allowed to confiscate any financial gain the user has made? Maybe even sue if the confiscation is not directly feasible? Does the user have no right to any of the gains made through this error? And are they liable for any damages caused if any?</p>

<p>Let’s say I go to a cash machine, ask for £100, and the machine gives me £10,000. I use my banking app and see that £100 left my account, not £10,000.</p>
<p>At this point I haven’t done anything illegal. If I asked for another £100 and got £10,000 again, that might be illegal.</p>
<p>But the extra £9,900 are not mine. They are the bank’s money. If I try to keep it, that is simply theft.</p>

<p>You find a wallet on the ground with $10,000 and a driver’s licence in it. If you keep it, is this a crime?</p>
<p>In almost all jurisdictions the answer is, yes.</p>
<p>Same fact situation except you find it electronically.</p>

<p>You did not specify the jurisdiction. In many jurisdictions, the user is required to cooperate with the correction of the mistake.</p>
<ul>
<li>If the user uses a banking API to withdraw money, and through a bug the proper account balance is not <em>immediately</em> shown, then the bank needs to correct the display. That's not &quot;confiscation&quot; but the fix of a display error to reflect actual withdrawals which have happened. The bank might have a problem collecting interest on the overdraft, maybe.</li>
<li>If the user uses a banking API to send money to a third party, and through a bug the money is sent several times, the user has cause for complaint and the bank may be stuck with the loss. This assumes the user used the API properly.</li>
<li>If the user deletes a database with an unintentional and legimitate request (e.g. some bug means that the 65537th request of the day makes everything go haywire because some index uses only 8 bit) then there is no culpability. The user can not really help to fix anything, either.</li>
<li>The programmer of the webshop made a mistake and allowed a &quot;99% off&quot; promotion to be applied to more than one product. Here it gets into contract law which will be slightly different in various jurisdictions. Was there a contract, when was it entered, was any side <em>deceptive</em> to do it, etc.</li>
</ul>
