In April 2024, a payments employee at Citigroup set out to credit a client's account with $280 and posted $81 trillion instead. The colleague assigned to check the entry let it through, and a third person spotted the problem about an hour and a half later. No money left the bank, so the episode was logged as a near miss, which is usually where the story ends: human error, caught in time. A recent essay arguing that legibility is becoming the new premium in business and finance makes the case that firms increasingly win or lose on whether they can be understood under stress, and I'd take that idea one level further down the stack than it usually goes. Long before a market or a regulator tries to read a financial company, its own people have to read its screens.

If you build internal tools, that is a practical claim, not a philosophical one. Admin panels, payment repair queues and loan servicing forms are where a company's grip on its own money is either made obvious or left to memory and luck. And the standard safeguard, a second person who checks the first person's work, turns out to be much weaker than it looks.

Three Approvals, One Misreading

One of the most expensive checkboxes in banking history belongs to Citibank. In August 2020 the bank was administrative agent on a 2016 term loan to Revlon and needed to pass about $7.8 million of interest to the lenders. Because the loan was being restructured, the payment had to be booked in an awkward way inside Flexcube, the loan software Citi used: pay out the interest, and route a notional repayment of principal into an internal wash account so the money never left the bank. The appeals court that later reviewed the case described the setup as three cryptically named boxes, FRONT, FUND and PRINCIPAL, all of which had to be checked. The operator, who worked for a contractor in India, checked only PRINCIPAL.

Citi ran a "six eyes" policy on payments like this one. A local manager approved the setup, then a senior manager in Delaware gave the final sign-off. All three believed the single checkbox was enough, and the final approval in the court record reads "looks good, please proceed. Principal is going to wash." It was not going to wash. Citi sent $893,944,008.52 of its own money to 315 creditors as early repayment of a loan that was not due until 2023. Most of them returned it. Ten creditors holding more than $500 million refused, a federal judge ruled in February 2021 that they could keep the money, and it took an appeals decision in 2022 to vacate that judgment.

Redundancy Only Works When Failures Are Independent

Maker-checker controls rest on an assumption that almost nobody writes down: the two people will make different mistakes. If each one misses an error once in a hundred tries and their misses are unrelated, the pair misses it once in ten thousand. That arithmetic collapses when the misses are related, and three people trained on the same tool, reading the same form and holding the same wrong belief about one field are about as related as reviewers get. Reliability engineers call this a common-mode failure. Two backup pumps wired to the same power supply are, for planning purposes, one pump.

Notice what the Revlon reviewers actually approved. Not an outcome, but a configuration of fields, on a screen that gave them no way to see what that configuration would do. Nothing on it said that close to $900 million was about to leave the bank. Now imagine the checker's view had been generated from the computed result instead of the maker's inputs: outgoing principal to external lenders, $893,944,008.52; expected for an interest payment, $0. The shared misunderstanding would have had nowhere to hide. That is the design principle in one line. The second reviewer needs a different view of the transaction, not a second look at the same one.

The Fallback Screen Is the Riskiest Screen You Own

The $81 trillion near miss began with a far smaller problem. According to the Financial Times, which first reported the incident, four payments totaling $280 bound for a client's escrow account in Brazil were held in March 2024 by a sanctions screen. They were cleared but stayed stuck, so the technology team told a payments employee to enter them manually through a rarely used backup screen. That screen's amount field came pre-filled with 15 zeros, which the operator was expected to delete. They stayed. As CBS News reported, the entry got past both the employee and the second worker assigned to check it, a third employee caught it about 90 minutes after it posted, and the transaction was reversed several hours later. The same reporting cited an internal Citi tally of 10 near misses of $1 billion or more in 2024, down from 13 the year before.

Citi said a payment that size could not actually have been executed and that its controls caught the mismatch between two internal ledger accounts. That is fair, and it is also beside the point. Look at where the failure lived. It was not in the main payment flow, the one that gets design reviews, validation and tests. It was in the fallback path, used rarely, under pressure, by someone who does not touch it every day, to repair something that has already gone wrong. Every company that moves money has a screen like this: the manual adjustment form, the replay tool, the force-settle button someone added during an incident three years ago. It usually has the weakest validation in the building and the most stressed users.

A Warning That Fires Every Day Is Decoration

Fallback screens are not the only place where controls quietly rot. On December 8, 2005, a trader at Mizuho Securities meant to sell one share of J-Com, a recruiting firm making its stock market debut that morning, for ¥610,000. The order that went in was 610,000 shares at ¥1, which came to 41 times the company's outstanding stock. The trader's terminal did flash a warning, and the trader overrode it. A Mizuho spokesman later explained that the warning appeared from time to time, which is a polite way of saying people had learned to click past it. The Tokyo Stock Exchange accepted the order, a fault in the exchange's own system blocked Mizuho's attempts to cancel it, and the loss ran to hundreds of millions of dollars. Four years earlier, UBS Warburg had made almost the same swap of price and quantity on shares of Dentsu.

Two lessons come out of that morning. A warning that people see routinely stops carrying information, so any control that depends on someone heeding it gets weaker every time it fires for nothing. And plausibility depends on context. Nobody can sell more shares than exist. Nobody's $280 repair job should turn into a figure larger than the annual output of any single country. A system that knows the context can refuse those inputs outright instead of asking a tired person whether they are sure.

Rules for Screens That Move Money

None of these fixes needs new technology. They need someone to treat the internal tool as part of the control environment rather than as a side project:

  • Show consequences, not fields. Run the operation as a dry run and build the approval view from its output: ledger postings, money leaving the institution, balances afterward. A reviewer should be reading "outgoing principal: $893.9 million," not a row of checkboxes.
  • Give the checker independent work. Blind re-entry of the amount or the recipient count turns a glance into a test, and if the two entries disagree, the system stops and asks why.
  • Bound every amount by its context. Compare it with the account's history, the instrument's outstanding shares or the size of the payment being repaired, and send anything absurd to a slower path with a hard stop instead of a dismissible pop-up.
  • Never pre-fill a money field. Empty should mean unknown. Show large values with separators, the currency code and the magnitude in words, so 81 trillion looks like 81 trillion.
  • Hold fallback paths to production standards. Same validation code, same limits and same tests as the main flow, and exercise them deliberately so their first real use isn't in the middle of an incident.
  • Budget your warnings. Measure how often each one gets overridden. A warning that people click through most of the time is teaching them to ignore it, so either fix what triggers it or turn it into a hard block.
  • Record what the reviewer saw. Store a snapshot or hash of the rendered approval view alongside the decision, so an investigation can tell a bad judgment from a bad screen.

Supervisors Already Treat This as Core Work

It would be convenient to file all of this under interface polish. Bank supervisors don't. In October 2020, two months after the Revlon payment, the Office of the Comptroller of the Currency fined Citi $400 million over weaknesses in risk management, data governance and internal controls. When the fixes lagged, the Federal Reserve's July 2024 penalty added $60.6 million for insufficient progress on data quality management, issued alongside an OCC fine that brought the combined total to about $135.6 million. Read those orders with an engineer's eyes and they describe a familiar problem: an institution that struggled to trust and explain its own data.

That is what makes legibility more than a communications theme. A bank can publish a meticulous annual report and still post $81 trillion from a backup form that came with 15 zeros already typed in. If you build internal tools, find the screen in your system that only gets opened when something is already broken, and give it the care you give your checkout page. It is usually the screen with the most money behind it and the least design in front of it.