Banking systems store account information in databases such as Oracle and databases are maintained and administered by DB administrators. The account information is stored in a table and a column of that table may contain balances. So it sounds like a DB admin can change balance of an account and for example he can put a few zeros in front of current balance.

How does banking software prevent such changes?

How do they store monetary value in databases?

Is there any standard for that?

1 Answer 1


They prevent it by using access controls to restrict access to who can change data fields and by implementing auditing to monitor authorized changes. As you might expect, a database holding banking information is typically fairly restrictive on who can make changes. They also have transaction logs that may be used to validate account balance changes, where if an account balance change is noticed without a corresponding transfer from another source it is flagged for review. This as well as the user audit logs maintained work as a means to discourage unauthorized changes as well as identify the source of a change if one was made.

Different countries have different standards, but in the United States of America we have federal and state regulations that subject financial institutions to both internal and external audits of their practices. Maintaining proper technical and process controls over account management are part of the things these audits investigate.

All of these measures don't make insider fraud impossible, but it makes it much more difficult and likely to be detected.

  • In addition, they also implement Security Event Monitoring (SEM) that should detect modification of records.
    – Jeroen
    Commented Sep 23, 2015 at 18:19
  • Also, companies like Imperva and McAfee have products designed to detect as well as prevent this type of scenario from occurring. These products are dubbed "Database Activity Monitoring" - aka: DAM.
    – k1DBLITZ
    Commented Sep 24, 2015 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .