This sounds like the closure was due to Anti Money Laundering. I suspect this sort of activity triggers the banks AML procedures and it's standard operating procedure (sometimes mandated by law) that you can't disclose if an account was closed due to AML breaches. Obviously agree that you weren't money laundering but that's what this closure sounds like.

This could be possible as well, because they never gave me any information.

Same thought, and I don’t think they get a lot of choices of this is triggered.

You don't.

My gut agrees with this statement.

Technically, if a SAR was filed, even the engineer he spoke to would not have known. Every training I've ever taken in that field basically says you don't tell anyone but your company's team that you filed such a report. Not a coworker, not even a Manager.

As I was reading your story and got the the part where they said they didn't have a bounty -- for some reason I anticipated that the next line would be them telling you that you could keep the $5,000.

I was extremely disappointed. :(

Thank you for sharing.

Even their newly developed responsible disclosure program doesn't have bounties.

You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.

I suspect they know they have a lot of vulnerabilities and they don't want to encourage people to poke around. I mean, their passwords aren't even case sensitive. This is also probably why they fired you as a customer, to discourage anyone else from even trying.

Case-sensitive password gets you <1 bit of entropy per password character. That doesn't sound like that big of a deal.

So a password with 10 characters is 1000 times less secure if you don't use case sensitivity. That's a big deal in my eyes.

" times less secure" isn't really well defined. Entropy is usually measured in log-space.

And in practice, it's less than one bit, since not all characters are letters.

What? That's their bread and butter. You wouldn't expect a pizza place to give away pizza....

The core skill of bankers is trading money and risk. They lend you money based on one risk calculation. They put aside more money against default if your loan gets riskier. They set budgets for whole departments of people based on how much they help mitigate risk.

So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."

Uhh, I would expect them to do exactly that for someone who presented them valid proof and and an MVP for how someone could get away with stealing tens, hundreds, thousands? of pizzas undetected. Rewarding someone for helping them with their “bread and butter” is how I would expect to be compensated for helping.

Or maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.

sarcasm seems to be unnoticed...