427 transfers, one destination: what a Taiwanese bank's "program error" leaves unexplained

On the morning of 3 November 2026, customers of Bank SinoPac in Taiwan started reporting unexpected transfers of NT$100,000. Economic Daily News quoted a customer who said they had neither opened the app nor registered the recipient. That afternoon, SinoPac said in a statement on its website: it had found a program error in its “new online banking transaction system”, identified the cause and suspended the service. The bank said it had refunded the money, including fees, but did not disclose the cause.

Correction (3 November 2026, 22:05 Taipei): The summary no longer says the new app sent the transfers; which channel they went through has not been confirmed. Suggested by Codex (gpt-6-astra), checked by Claude.

Taiwan’s Financial Supervisory Commission (FSC), which regulates banks, gave preliminary figures, reported by United Daily News: 427 transfers of about NT$100,000 each, over NT$40 million in total, affecting 419 customers. The transfers all went to the same Taipei Fubon Bank account, which had been frozen. CNA reported that the new app had been withdrawn and customers redirected to the old app or ATMs. Sources were first checked to 18:03 Taipei time on 3 November, with a follow-up check to 21:50.

“Program error” carries about as much information as a commit message that reads fix bug. With the cause undisclosed, this post examines the records a transfer should leave and the information available so far.

Some local context

A “non-designated transfer” is a transfer to a recipient account the customer has not registered with the bank in advance as a designated payee. The Bankers Association of the Republic of China, Taiwan’s banking industry association, sets limits in its self-regulatory electronic banking security standard. The 7 January 2026 text, reproduced by RootLaw, caps low-risk internet transfers at NT$50,000 per transaction, NT$100,000 a day and NT$200,000 a month, per account. It allows higher limits subject to conditions, including controls that let customers confirm transaction details and protect both those details and identity verification data against alteration. The bank must assess the risk.
165 is the police-run anti-fraud hotline. Its count, reported by ETtoday from the Criminal Investigation Bureau, was 68 reports between 10:48 and 12:16. That is a different number from the FSC’s 419 customers, and the two should not be added together.
Banks must notify the FSC’s Banking Bureau of a major incident. Under the FSC’s reporting rules, they must submit details or a progress update within seven business days, counted from the day after the initial notification. CNA quoted the FSC as expecting SinoPac’s follow-up report by 12 November.

A later check found SinoPac’s statement on its website. Statements attributed here to the FSC, Taipei Fubon Bank and the police still come from news reports; no FSC press release on this case was found.

What one transfer should leave on record

From an engineering point of view, these records should be traceable for each transfer. The per-transfer records for this incident have not been made public. The bank says it has identified the cause; the FSC says it is waiting for the bank’s investigation before deciding on further checks or penalties.

Start with the channel: new app, old app, web, or a back-end batch. The FSC, as quoted, said money left accounts whose owners had not logged into the new app. The bank’s “new online banking transaction system” and the FSC’s “new app” are different descriptions; the reports do not establish how they map to each other.

Next, check the transaction type and the limit applied. SinoPac’s FAQ for the new mobile app says a non-designated transfer can use biometrics once quick login is enabled. For that service, it lists a NT$50,000 per transaction limit for ordinary deposit accounts opened at a branch. Each transfer here was about NT$100,000. The published information does not establish the account types or transaction paths, so it does not show which limit should have applied.

Authorisation needs a record of its own. Economic Daily News quoted a customer’s social media post describing a transfer as confirmed by a face scan, although they had not opened the app. A screen saying “confirmed” and a stored verification record should not be squeezed into one tick box in the requirements.

For notifications, EBC News relayed customers’ accounts that they had received no verification text message before the transfers and only learnt about them from app and messaging notifications. It remains unclear whether this kind of transaction was supposed to trigger a verification code.

Then there is the money trail back. The FSC was quoted as saying SinoPac refunded customers by advancing the money itself, while Taipei Fubon said the funds in the receiving account had not been moved on and it would help return them. The reports do not establish whether Taipei Fubon has since returned the frozen funds.

Old code as a guard rail

Engineers like calling old systems technical debt. The phrase is convenient: once the debt is on the books, it feels as if someone owns the repayment.

The public record goes no further than this: the new app was withdrawn and customers were sent back to the old one. What follows is a general view of rewrites in the AI era, not an explanation of this incident.

Old code may contain checks added through earlier fixes, with little documentation of why they exist. Calling that code debt does not tell us which checks remain necessary. Before removing it, establish what it prevents and what protection a replacement must retain.

AI tools can shorten a rewrite, but undocumented rules still need to be understood. Record them in specifications and tests, such as the limits that apply to different accounts and transactions. Once a rule is written as a test, the rewrite has something to be checked against. Keep any path whose rules remain unclear on the old system until the replacement has been verified.

Other banking incidents

These cases illustrate different disruptions to banking services and how they were handled. They do not explain SinoPac’s case.

TSB, United Kingdom, 2018: after migrating customers to a new platform, services were disrupted, and some problems lasted until December 2018. On 20 December 2022 the FCA and PRA fined TSB a combined £48.65 million, and TSB paid £32.7 million in customer redress. That incident caused an outage; it did not involve money moving to one account.
FISC, Taiwan, 2021: CNA, republished by INSIDE, reported that the interbank ATM network run by Financial Information Service Co., Ltd. was interrupted on 11 December, from about 17:06 to 17:13. FISC said debits without cash being dispensed would be reversed automatically after system checks. It had notified the FSC of a major incident; the investigation report was still to follow.
Taipei Fubon, Taiwan, 2023: on 14 April, CNA quoted the Ministry of Finance as saying that more than 300 payments had been credited twice during a government cash payment programme, early in Fubon’s integration of Jih Sun Bank’s systems. The bank and FISC reversed the duplicate credits. On 18 April, CNA quoted the FSC as saying that, as far as it knew, the problem was unrelated to the system integration.
Next Bank, Taiwan, 2022: Commercial Times reported that the internet-only bank sent mistaken requests to top up accounts on 5 May, affecting about 2,200 customers and more than 3,700 transactions. The paper quoted the FSC as saying that a transaction sequence number used to release funds held in the core system had not been reset each day. The bank said the accuracy of customers’ accounts was unaffected.

Notes

SinoPac’s own statement attributes the abnormal transfers to a program error in its new online banking transaction system. The bank said it suspended the service and refunded customers, without disclosing the cause.
The FSC’s preliminary figures, via media, are 427 transfers, 419 customers and over NT$40 million; the 165 hotline’s 68 reports by 12:16 are a separate count.
The cited banking standard caps low-risk internet transfers to non-designated accounts at NT$50,000 per transaction, with conditional increases. Which limit applied here remains unanswered.
The face-scan description comes from a customer’s post quoted by Economic Daily News. The bank’s authorisation records have not been published.
Old code that looks like debt may be holding undocumented checks; write them down as tests before a rewrite removes them.