Two brothers in their 20s were briefly detained this week by police after they allegedly transferred themselves TL 16 billion ($ 1.08 billion) due to a loophole in the mobile banking app of a private bank. The brothers, identified as R.G and E.G., were detained but released with judiciary control and had their bank accounts frozen.
The suspects allegedly discovered a loophole that allowed them to withdraw as much cash as they wanted through an investment account connected via the bank's mobile app. The account, reserved for customers conducting stock trading, reportedly had a bug and over two days allowed the brothers to make nearly 70 withdrawals.
E.G. told investigators that he had no money in the account when he checked it on Feb. 26. He selected the "investment account" option on the app when a menu came up and asked him to type in the amount of cash he wanted to withdraw. "I randomly typed a number and saw the amount I wrote was transferred to my account. I decided to try typing more and, every time that amount was transferred to my account," he said. E.G. was quick to spend the money. The same day, he wired TL 300,000 ($20,215) to purchase a cellphone and a car online but the transfer was blocked. He said he managed to withdraw about TL 40,000 from an ATM and the next day, he proceeded to withdraw more money from his "new" TL 16 billion account.
"I told this to my family and we decided to pay the outstanding debts of anyone we knew. I did it with my brother and we wired TL 80,000 to my relatives in debt." The brothers were only caught two days later when a bank official called them to inquire about the "massive amount of money" transferred to their account. The brothers told the official that they transferred it from their investment account but the account was blocked during the phone call. R.G. said they used their debit card linked to the account to first buy three cellphones for TL 100,000 and then withdrew money from ATMs. "We wired TL 300,000 to a car salesperson to purchase a car. He received the money through his online account but the transfer was then blocked by bank," he said. R.G. confessed that some relatives he sent money to were able to withdraw the money and some even spent it.
