1

Concrete examples :

  1. Someone making API requests through a banking platform, withdrew many times in succession, and through some miracle bug they all went through.

  2. Someone unaffiliated with a business, deletes a its entire database with an unintentional request.

  3. Someone purchases twenty video game Steam codes at -99% through one transaction.

etc.. All of these are one-off mistakes, where a bug does exist, yet it is unintentionally used in a way where this single error causes notable damage to the business. Are they legally allowed to confiscate any financial gain the user has made? Maybe even sue if the confiscation is not directly feasible? Does the user have no right to any of the gains made through this error? And are they liable for any damages caused if any?

Improve this question
6
  • In what jurisdiction?
    – Ryan M
    Sep 30, 2020 at 7:36
  • Also, this is likely to be quite fact-specific...for example, how did someone "unintentionally" purchase video game keys at a 99% discount? Was it a weird issue where they had no idea what happened, or were they intentionally poking around looking for bugs and merely surprised it worked?
    – Ryan M
    Sep 30, 2020 at 7:37
  • I am not sure about the jurisdiction question, the user and company could be in the US, or with the business being abroad, or vice versa, it's a bit open-ended as this could happen with any online business. As for the second question, no, there is no intention of bug testing, simply typical usage of the platforms either designed for consumers, or developers.
    – Zee
    Sep 30, 2020 at 8:00
  • The laws for this are going to differ by jurisdiction, so you may get answers for random jurisdictions that you don't care about if you're not specific.
    – Ryan M
    Sep 30, 2020 at 8:02
  • The bug concerning -99% discount could in theory happen through multiple ways, currency conversion or localization error, etc.. as long as there is no intention of breaking it. And well, for the jurisdiction I guess I'll add the assumption that the business is based in the U.S.
    – Zee
    Sep 30, 2020 at 8:09

3 Answers 3

Reset to default
6

Let’s say I go to a cash machine, ask for £100, and the machine gives me £10,000. I use my banking app and see that £100 left my account, not £10,000.

At this point I haven’t done anything illegal. If I asked for another £100 and got £10,000 again, that might be illegal.

But the extra £9,900 are not mine. They are the bank’s money. If I try to keep it, that is simply theft.

Improve this answer
1
  • The crucial legal concept here is "mens rea": the intent to commit a crime. With the first overpayment there was no intent. Once you know that this is a way to steal money, you have intent.
    – Paul Johnson
    Sep 30, 2020 at 8:46
2

You find a wallet on the ground with $10,000 and a driver’s licence in it. If you keep it, is this a crime?

In almost all jurisdictions the answer is, yes.

Same fact situation except you find it electronically.

Improve this answer
2

You did not specify the jurisdiction. In many jurisdictions, the user is required to cooperate with the correction of the mistake.

  • If the user uses a banking API to withdraw money, and through a bug the proper account balance is not immediately shown, then the bank needs to correct the display. That's not "confiscation" but the fix of a display error to reflect actual withdrawals which have happened. The bank might have a problem collecting interest on the overdraft, maybe.
  • If the user uses a banking API to send money to a third party, and through a bug the money is sent several times, the user has cause for complaint and the bank may be stuck with the loss. This assumes the user used the API properly.
  • If the user deletes a database with an unintentional and legimitate request (e.g. some bug means that the 65537th request of the day makes everything go haywire because some index uses only 8 bit) then there is no culpability. The user can not really help to fix anything, either.
  • The programmer of the webshop made a mistake and allowed a "99% off" promotion to be applied to more than one product. Here it gets into contract law which will be slightly different in various jurisdictions. Was there a contract, when was it entered, was any side deceptive to do it, etc.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .