01 The Hour
18:00
Sunday 22 April 2018, United Kingdom
The window had been advertised in advance: from four on the Friday afternoon to six on the Sunday evening, online banking, payments and transfers might be unavailable while the bank moved its customer records off its former parent's systems and onto a platform built by its new owner.
At six on the Sunday customers logged in. Some could not get on at all. Some were shown balances that were not theirs. The migration had moved more than 1.3 billion records belonging to 5.2 million customers, and the figure that stuck afterwards was 1.9 million, the digital and mobile users who found themselves locked out.
02 The Sequence
20 Apr 2018, Friday, 16:00. The planned upgrade begins. Customers had been told that services such as online banking might be unavailable until six on the Sunday evening.
22 Apr Sunday, 18:00. Customers attempting to log in meet technical faults. Around 700 customers are declined when using a cash machine abroad that day.
22 Apr Sunday into Monday. Customers report seeing other customers' accounts, including account numbers, sort codes and transaction histories. The bank later puts at 402 the number of customers who were able to see data not normally available to them.
23 Apr Monday. The bank says it is seeing large volumes of customers accessing the app and internet banking, and that this is leading to intermittent issues. App access that day reaches 72 per cent of customers. Average waits at the call centres run to an hour.
24 Apr Tuesday. The chair of the Treasury Committee writes to the bank asking what has gone wrong, the extent of the failure, and how it intends to compensate customers. Her statement refers to reports of unauthorised transactions, access to other customers' accounts and failures of in-branch services.
26 Apr Thursday. Average call waits are down to thirty minutes. By the Friday, app access is at 93 per cent.
30 Apr Monday. The committee publishes the exchange of letters. The figures above enter the public record through that correspondence rather than through any announcement by the bank.
2 May Wednesday. The committee takes oral evidence from the bank's chief executive and chairman and the chief operating officer of its Spanish parent. The chief executive puts login success on the app and website at around 95 per cent. A parliamentary researcher present at the hearing tries to access a TSB account and fails.
6 Jun Wednesday. The committee publishes correspondence with the Financial Conduct Authority. Its chief executive states that the regulator will conduct a joint investigation with the Prudential Regulation Authority, that the bank had not met the requirement in the Payment Services Regulations to refund relevant customers by the end of the business day after becoming aware of the fraud, and that more than 40 per cent of calls were still being abandoned or disconnected before getting through the voice system, with waits to reach an agent at times longer than thirty minutes.
03 The Hidden Dependency
When the app stops, what is left is the number on the back of the card.
The bank's own figures put app access at 72 per cent of customers on the Monday, rising to 93 per cent by the Friday. Across the same days the call centres carried the difference, at average waits of an hour on the Monday and half an hour by the Thursday.
Six weeks after the migration weekend the regulator told the committee that more than 40 per cent of calls were still being abandoned or disconnected before they got through the voice system. The same lines carried the fraud reports, which under the Payment Services Regulations start a clock that expires at the end of the next business day.
The channel a customer reaches for when the ledger looks wrong is a telephone line with a fixed number of seats.
04 What Still Worked
Cards at Machines Abroad
On the Sunday of the migration the bank counted around 700 customers declined at a cash machine abroad, out of a base of 5.2 million.
The App, for Most
Access ran at 72 per cent of customers on the Monday and 93 per cent by the Friday, a level the bank described as typical of the proportion before the migration.
The Telephone, at a Price
It answered. An hour on the Monday, thirty minutes by the Thursday, and for a substantial share of callers weeks later, not at all.
05 The Document
The Document 2 May 2018
Oral evidence, Service Disruption at TSB, HC 1009, taken on Wednesday 2 May 2018 and ordered by the House of Commons to be published the same day. Six members present. Three witnesses: the chief executive and the chairman of the bank, and the chief operating officer of its Spanish parent. Questions 1 to 156. The first question is housekeeping, asking the witnesses to introduce themselves because people are watching online. The transcript is the fullest published account of the ten days that preceded it.
06 The Pattern Library
1
When one retail withdrawal channel closes or fails, demand concentrates on whichever channel is left open, and the capacity of that channel sets what a depositor can obtain.
Observed: Northern Rock 2007, Cyprus 2013, India 2016, Greece 2015, United States 1933, Argentina 2001, Lebanon 2019, Worldpay 2026, TSB 2018.
2
A currency replacement can require physical modification of each cash dispensing machine before the new notes can be issued, so the machine estate returns to service site by site rather than at once.
Observed: India 2016.
3
Withdrawal limits imposed on a domestic banking system can be written to exempt cards issued outside it, so one machine dispenses under two rules according to where the card was issued.
Observed: Greece 2015.
4
Domestic payment and deposit channels can continue operating while cross-border payment routes fail, with the central bank standing in as the intermediary for payments to and from the country.
Observed: Iceland 2008.
5
When the institutions that convert payment instruments into cash are closed, wages and checks already received cannot be spent, and merchants and carriers extend their own credit in place of the missing conversion.
Observed: United States 1933.
6
A public employer short of the national currency can pay wages in an instrument it issues itself, which then circulates alongside the currency it stands in for.
Observed: Argentina 2001.
7
Withdrawal restrictions can be imposed by individual institutions and their trade association rather than by statute, so the limit differs from bank to bank and no law governs it.
Observed: Lebanon 2019.
8
A cash withdrawal ceiling set in nominal units has to be raised alongside the note denominations that pay it, because the ceiling can only be dispensed in the notes that exist.
Observed: Zimbabwe 2008.
9
A payment outage can hit card authorisation and merchant funding as separate faults, so acceptance at the terminal is restored while the money owed to the merchant arrives a day late under its own incident notice.
Observed: Worldpay 2026.
10
A retailer that loses electricity can go on trading by taking cash and rationing goods by hand, so the counter outlasts the checkout system that normally prices and settles the basket.
Observed: Texas 2021.
11
A systems migration can leave account records readable but wrong, including presenting one customer's account to another, so a working login is no guarantee that the balance on the screen belongs to the person reading it.
Observed: TSB 2018.
Changed today: Entry 1 gained TSB 2018, where the digital channel failed and the demand landed on call centres running at an hour's wait, with more than 40 per cent of calls still abandoned six weeks later. Entry 11 added, on records presented readable but wrong.