Incident: NatWest, RBS, and Ulster Bank Mobile Banking App Outage

Published Date: 2013-03-28

Postmortem Analysis
Timeline 1. The software failure incident mentioned in Article 17497 happened on 2013-03-28. 2. The software failure incident mentioned in Article 75469 happened on 2018-09-21.
System 1. Mobile banking app system for NatWest, Royal Bank of Scotland, and Ulster Bank [17497] 2. Online banking system for RBS, NatWest, and Ulster Bank [75469]
Responsible Organization 1. RBS Group - The software failure incident was caused by a "technical glitch" in a regular update to their firewall applied by RBS Group [75469]. 2. Previous incidents suggest that the bank's IT systems and software upgrades were also responsible for causing software failure incidents [17497].
Impacted Organization 1. NatWest 2. Royal Bank of Scotland 3. Ulster Bank [Cited Articles: <Article 17497>, <Article 75469>]
Software Causes 1. A technical glitch in a regular update to the firewall caused the online banking glitch, leading to customers being locked out of their accounts [75469]. 2. A botched software upgrade in June 2012 caused millions of NatWest, RBS, and Ulster Bank customers to be without access to their money for more than a week [17497]. 3. An apparent IT error caused the bank's systems to crash, resulting in customers being unable to withdraw cash, pay for goods and services, or carry out telephone and online banking for hours [17497].
Non-software Causes 1. The failure incident was caused by a "technical glitch" in a regular update to the firewall applied by RBS, NatWest, and Ulster Bank [75469]. 2. The failure was also attributed to an "access issue" rather than a compromise of customer data [75469].
Impacts 1. Customers were locked out of their mobile banking apps for hours, affecting users of NatWest, Royal Bank of Scotland, and Ulster Bank, causing inconvenience and frustration among customers [17497]. 2. The technical glitch prevented customers from accessing their bank accounts online for about five hours, leading to complaints on social media and impacting customers on payday [75469]. 3. The failure resulted in customers being unable to transfer wages, pay bills, or access their accounts, causing financial inconvenience [75469]. 4. The incident raised concerns about the reliability and robustness of banks' IT systems, leading to questions about the safety and accessibility of customers' money [17497]. 5. The software failure incidents added to a series of problems experienced by customers of various banks in the UK over the past 18 months, highlighting a trend of IT failures in the banking sector [75469].
Preventions 1. Regular and thorough testing of software updates before deployment to prevent glitches like the one caused by a firewall update at RBS, NatWest, and Ulster Bank [75469]. 2. Implementing robust IT infrastructure and systems to ensure the stability and reliability of online banking services, reducing the likelihood of access issues and outages [75469]. 3. Investing in cybersecurity measures to protect against potential hacks or breaches that could compromise customer data and lead to service disruptions [17497]. 4. Prioritizing customer experience and service reliability by addressing previous IT failures promptly and effectively to build trust and confidence among customers [17497]. 5. Considering the impact on customers, especially during critical times like payday, and ensuring contingency plans are in place to minimize disruptions and inconvenience [75469].
Fixes 1. Implement more rigorous testing procedures before deploying updates to the system to prevent technical glitches like the one caused by a firewall update [75469]. 2. Invest in improving the overall robustness and reliability of the IT systems to prevent frequent IT meltdowns and failures [17497]. 3. Enhance customer communication and support during incidents to keep customers informed and address their concerns promptly [75469]. 4. Consider diversifying IT infrastructure and services to reduce the impact of failures on a large scale [17497]. 5. Conduct a thorough investigation into the root causes of the failures and implement measures to prevent similar incidents in the future [75469].
References 1. Social media platforms such as Twitter [17497, 75469] 2. Statements from the affected banks (RBS, NatWest, Ulster Bank) [17497, 75469] 3. Customer testimonials and complaints [75469] 4. RBS chief executive Ross McEwan [75469] 5. Customer Paul Murphy and Jess Cochrane interviewed by the BBC [75469] 6. Nicky Morgan MP, Chair of the Treasury Committee [75469]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - NatWest has been hit by its third IT glitch in nine months, with previous incidents including customers being unable to withdraw cash, pay for goods and services, and carry out banking activities [Article 17497]. (b) The software failure incident having happened again at multiple_organization: - The RBS group, which includes RBS, NatWest, and Ulster Bank, experienced an online banking glitch that affected customers' access to their accounts, similar to previous incidents at other banks like TSB and Barclays [Article 75469].
Phase (Design/Operation) design (a) The software failure incidents mentioned in the articles are primarily related to the design phase. In Article 17497, the failure incidents at NatWest, RBS, and Ulster Bank were attributed to technical glitches, IT errors, and botched software upgrades. For example, in June 2012, a software upgrade issue caused millions of customers to lose access to their money for over a week [17497]. Similarly, in Article 75469, the online banking glitch experienced by RBS, NatWest, and Ulster Bank was caused by a technical glitch in a regular update to their firewall applied early in the morning, affecting customers' access to their accounts [75469]. (b) The articles do not provide specific information about software failure incidents related to the operation phase.
Boundary (Internal/External) within_system (a) The software failure incidents reported in the articles are primarily within_system failures. In Article 17497, the failure at NatWest, RBS, and Ulster Bank was caused by technical problems within their IT systems, affecting their mobile banking apps and online banking services [17497]. Similarly, in Article 75469, the issues faced by RBS, NatWest, and Ulster Bank were attributed to a "technical glitch" in a regular update to their firewall, which was an internal system update that caused the access issue for customers [75469]. These incidents highlight failures originating from within the system itself, leading to customer inconvenience and service disruptions.
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurring due to non-human actions: - Article 17497 reports on a technical glitch that caused customers to be locked out of their accounts, affecting NatWest, Royal Bank of Scotland, and Ulster Bank. The issue was attributed to a fault that prevented people from logging into the mobile banking app, impacting both personal and business customers [17497]. - Article 75469 discusses a similar incident where customers of RBS, NatWest, and Ulster Bank were unable to access their bank accounts online due to a technical glitch in a regular update to their firewall. The update was reversed to resolve the issue, and the banks emphasized that it was an "access issue" with no evidence of customer data compromise [75469]. (b) The software failure incident occurring due to human actions: - The articles do not specifically mention any software failure incidents caused by human actions.
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - Article 75469 reports that the online banking glitch experienced by RBS, NatWest, and Ulster Bank was caused by a "technical glitch" in a regular update to their firewall which was applied early on Friday morning. This hardware-related issue led to customers being locked out of their accounts until the problem was fixed [75469]. (b) The software failure incident occurring due to software: - Article 17497 mentions that NatWest, RBS, and Ulster Bank faced an IT glitch that left customers locked out of the mobile banking app. The fault, which prevented people from logging in, was attributed to a software issue, causing inconvenience to customers [17497]. - Additionally, the same article highlights a previous incident in June 2012 where a botched software upgrade led to millions of customers being without access to their money for more than a week. This incident was also related to software problems within the banking group [17497].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incidents reported in the articles are categorized as non-malicious. The failures were attributed to technical glitches, regular updates causing issues, and access problems rather than any malicious intent to harm the system [17497, 75469].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incidents reported in the articles seem to be more aligned with poor_decisions. The incidents were caused by technical glitches resulting from regular updates to the firewall [75469], botched software upgrades [17497], and previous IT problems [17497]. These issues indicate that poor decisions or inadequate planning in implementing updates and upgrades contributed to the failures. Additionally, the incidents led to customer dissatisfaction and raised questions about the robustness and reliability of the banks' IT systems [17497]. (b) The articles do not provide information indicating that the software failure incidents were due to accidental_decisions.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incidents reported in the articles can be attributed to development incompetence. In Article 17497, it is mentioned that NatWest experienced its third IT glitch in nine months, with previous incidents including a botched software upgrade and problems after offshoring IT jobs to India. Customers expressed frustration on social media, questioning the bank's ability to learn from past mistakes and highlighting concerns about the robustness of the bank's IT systems [17497]. Similarly, in Article 75469, RBS, NatWest, and Ulster Bank faced an online banking glitch that prevented customers from accessing their accounts due to a technical glitch in a regular update to their firewall. This incident caused frustration among customers, especially as it occurred on payday, impacting their ability to carry out financial transactions. The bank emphasized that it was an "access issue" and assured customers that their data was not compromised [75469]. (b) The software failure incidents reported in the articles can also be seen as accidental. In Article 75469, the online banking glitch experienced by RBS, NatWest, and Ulster Bank was described as a "technical glitch" in a regular update to their firewall that was applied early in the morning. The update was reversed to allow customers to access their accounts again, indicating that the issue was unintentional and not a deliberate act to disrupt the service. The banks also stated that there was no evidence of customer data being compromised during the incident [75469].
Duration temporary (a) The software failure incident reported in the articles was temporary. In Article 17497, it is mentioned that the technical problems preventing customers from logging into the mobile banking app were fully resolved by noon on the same day the issue started. Similarly, in Article 75469, the online banking glitch that locked customers out of their accounts was resolved within about five hours of the problem being identified. These incidents were not permanent and were resolved relatively quickly, indicating a temporary software failure [17497, 75469].
Behaviour crash, omission, other (a) crash: The articles describe incidents where customers were locked out of their accounts due to technical glitches, such as a fault in the mobile banking app [17497]. Customers were unable to access their bank accounts online for about five hours until the problem was fixed [75469]. (b) omission: Customers experienced issues where they could not access their accounts online [75469]. This omission to perform the intended function caused frustration among users, especially during payday. (c) timing: There is no specific mention of timing-related failures in the articles. (d) value: The articles do not mention any instances of the system performing its intended functions incorrectly. (e) byzantine: There is no indication of the system behaving with inconsistent responses or interactions in the articles. (f) other: The articles highlight failures related to technical glitches, regular updates causing issues, and access problems, leading to customers being unable to perform online banking activities as intended.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The articles do not mention any consequences related to death, harm, basic needs, or physical property damage resulting from the software failure incidents at NatWest, RBS, and Ulster Bank. The incidents primarily caused inconvenience, frustration, and financial disruption to customers, leading to delays in accessing accounts and making transactions. There were no reports of direct physical harm or loss of life due to the software failures.
Domain finance (a) The failed system was related to the finance industry, specifically affecting NatWest, Royal Bank of Scotland (RBS), and Ulster Bank's mobile banking apps, causing customers to be locked out and unable to access their accounts [17497, 75469]. (h) The software failure incident was directly impacting the finance industry, as it disrupted the mobile banking services of the mentioned banks, affecting customers' ability to manage their money and accounts [17497, 75469].

Sources

Back to List