Probably the code had logic such as the following, which from an amateur perspective, seems to work. After all, the first check prevents the withdrawal if the account balance is too low, so what could go wrong?

  $balance = sql_query(“SELECT balance FROM accounts WHERE account_id = “ . $account_id);
  if ($withdrawal_amount < $balance) {
    withdraw_funds($account_id, $withdrawal_amount);
  }

The correct solution of course requires putting the checks in an ACID transaction along with the account balance updating. This requires more work upfront (SQL is harder to write than PHP) and an impatient amateur coder probably didn’t think of it. Also I’m guessing they didn’t properly index all the DB columns and this made transactions take longer which exacerbates race conditions.