|
| Featured Contents |
| Question of the Day |
| The Voice of the DBA |
An Eventual Consistency Scam Recently I sold a car. It was an interesting process as I hadn't sold a car to someone I didn't know in a long time. I listed the car in a few places and was surprised by the interest. It was an EV (I guess it still is), and with the rising price of fuel in the US, maybe I shouldn't have been surprised. I arranged a couple of showings, but I had quite a few people offer to buy the car after only seeing a few pictures, asking if I'd take a check. Some of you might be wary at this point, and I was. However, my wife had gotten similar offers from a few people when she was selling a horse. She never did, but we talked about where the scam is if someone sends a check and says they'll wait for the funds to clear. I was curious, so I agreed to take checks from three people. Two of them sent the checks in registered letters, with proof of delivery. This is a USD$20 cost right now. One sent a FedEx letter. That probably cost a similar amount. In all cases, the people said they were sending enough for the car to be shipped, on top of my asking price. I also told them I'd need the check to clear, and they agreed. The first one I received, I drove by the bank while in town and deposited the check. I discussed the check clearing with the bank. I was told by the teller that I'd be able to get $400 that day and the rest the next day. I asked about when the check actually clears and the funds were moved, since all three checks were drawn on non-Colorado banks. The teller realized I wanted validation and said it would be 7-10 days and gave me a customer service number to call. I haven't used checks very much the last few years. While I know technology has improved, what has mostly happened is that the banks operate on a system of trust that appears to move faster even though many of the underlying systems are older and still slow. When you deposit a check, the bank doesn't validate anything. That might seem strange, but it doesn't. It sends the bank routing number, the account number, and amount through a process that reconciles the money with another bank. Think of this as data in two different databases, which it really is. The update in bank 1 isn't sent to bank 2 for a period of time. The update from bank 2, which debits their account and credits bank 1, takes longer. In this case, the time in days. That's serious eventual consistency. What happened with person 1 was that they asked for confirmation of the deposit, and then texted me 2 days later saying that they'd need a deposit for the shipping company. I repeated that I'd need the funds to clear. They wanted to argue about needing to move fast, but I ignored them. After a few days, they said they were sick and could I front them money for a few bills and they'd drive to get the car. I didn't agree and eventually they gave up communicating with me. A week after the deposit, I got a "funds failed to clear" message from my bank. No charge to me, but the "money" that appeared to be in my balance disappeared. Person 2 texted me the image of their FedEx note, and when I said I would wait a week for the check to clear, they asked me to tear up the check and send them a picture. I declined. Person 3 sent a check blindly, saying they were trusting me. I ignored future texts, but they persistently kept checking for 12 days. In all cases, these are checks on real banks, but fake names and accounts. Checks are insecure. And just like plenty of data replication systems that try to synchronize data between two databases, there can be issues if you do not have a two-phase commit. I wrote this so many of you would be aware of a scam that is out there. Watch out and warn your less tech-savvy friends. However, also be careful when you work with data that lives in two places. There is a lot of overhead to ensuring the data is correct in all the systems, and there are good reasons for this. Sometimes eventual consistency isn't good enough. Note: A few people are concerned about the check images linked. Those are fake people and fake accounts. Steve Jones - SSC Editor Join the debate, and respond to today's editorial on the forums |
| Featured Contents |
