# CRITICAL: Stripe Bank Account Configuration Bug

**Date**: 2025-10-21  
**Priority**: 🚨 CRITICAL  
**Impact**: Payouts to incorrect bank account  
**Status**: Investigation in progress

---

## Issue Summary

**User Report**:
- Correct bank account: `15-3959-xxxxx36-085`
- Stripe displays: `••••0085 / 153959`
- Problem: Extra '0' added (should be `085` not `0085`)
- Cannot confirm edit in Stripe Dashboard

**Impact**:
- Payouts may fail or go to wrong account
- User's $5 test transaction already processed
- Payout scheduled but may fail due to incorrect account number

---

## Root Cause Analysis

### Where This Configuration Lives

**NOT in your website code** - Bank account configuration is stored in:
- Stripe Dashboard → Settings → Bank accounts and scheduling
- This is configured directly in Stripe's system
- Your website code (Koha) doesn't touch this

### How the Bug Likely Occurred

**NZ Bank Account Format**: `XX-XXXX-XXXXXXX-XXX`
- Branch: 15
- Account: 3959
- Suffix: (hidden in your report)
- Last digits: 085

**Stripe's Interpretation**:
- Stripe may have parsed: `153959xxxxx36085`
- Then formatted as: `153959` / `0085` (added leading zero)
- This is a Stripe dashboard parsing bug for NZ bank accounts

### Why Edit Doesn't Work

When you click [Edit] in Stripe Dashboard:
1. Form opens with current (incorrect) value
2. You enter correct value
3. Form saves and returns to summary
4. **But**: No visual confirmation that edit was saved
5. **And**: Stripe may be re-parsing the number incorrectly again

---

## Immediate Action Required

### Step 1: Verify Current Bank Account in Stripe

**Log into Stripe Dashboard**:
1. Go to https://dashboard.stripe.com
2. Navigate to: Settings → Bank accounts and scheduling
3. Check what Stripe has on file

**Expected to see**:
```
Bank: TSB Bank
Account: ••••0085 / 153959
```

**Need to verify**:
- Is the routing number (153959) correct?
- Is the account number suffix (0085 vs 085) correct?

### Step 2: Correct Format for NZ Bank Accounts

**NZ Bank Account Components**:
```
Bank code: 15 (TSB Bank)
Branch: 3959
Account base: xxxxx36
Suffix: 085
```

**Stripe Format** (varies by country):
- Routing number: Typically `bank-branch` (15-3959 = 153959)
- Account number: Typically `base-suffix` (xxxxx36-085)

**Your issue**: Suffix should be `085` not `0085`

### Step 3: Fix in Stripe Dashboard

**Method 1: Edit Existing**
1. Stripe Dashboard → Settings → Bank accounts
2. Click "Edit" on the TSB Bank account
3. **Carefully enter**:
   - Bank code: 15
   - Branch: 3959
   - Account number: xxxxx36
   - Suffix: 085 (NOT 0085)
4. Click "Save"
5. **Verify**: Does it show correctly after save?

**Method 2: Delete and Re-add**
1. Delete the incorrect bank account
2. Click "Add bank account"
3. Select country: New Zealand
4. Bank: TSB Bank
5. Enter account number in NZ format: `15-3959-xxxxx36-085`
6. Let Stripe parse it
7. **Verify before saving**: Check preview is correct

### Step 4: Test Payout (Critical)

After correcting:
1. Stripe Dashboard → Balance → Manual payout
2. Request payout of small amount (e.g., $1)
3. **Monitor**: Does it arrive in correct account within 2-3 business days?
4. If it fails: Stripe will email you with error details

---

## Why This is Critical

### Current Situation

**Your $5 test transaction**:
- Status: Succeeded (Oct 18)
- Stripe balance: $4.56 (after fees)
- Payout: Scheduled but delayed by Labour Day bank holiday
- **Risk**: Will attempt payout to account `0085` instead of `085`

### If Payout Fails

Stripe will:
1. Return funds to Stripe balance
2. Email you about failed payout
3. Mark bank account as "verification needed"
4. Require you to fix and retry

### If Payout Succeeds to Wrong Account

**This is unlikely** because:
- Invalid account numbers usually get rejected by bank
- Bank will return funds to Stripe
- But: Small risk of funds going to wrong account if `0085` exists

---

## How to Verify the Fix Worked

### After Editing Bank Account

1. **Visual Check** (Stripe Dashboard):
   - Settings → Bank accounts
   - Should show: `••••085 / 153959` (NOT `••••0085`)

2. **Micro-Deposit Test** (if Stripe offers it):
   - Some regions: Stripe sends 2 small deposits to verify
   - You confirm amounts to verify account ownership
   - Not always available in NZ

3. **Small Payout Test**:
   - Request manual payout of $1-5
   - Check it arrives in your TSB account
   - Confirms routing and account number are correct

---

## Long-Term Fix

### For Future Transactions

1. **Correct bank account** in Stripe Dashboard
2. **Test with small payout** before large transactions
3. **Monitor email** for Stripe payout notifications
4. **Enable 2FA** on Stripe account (prevents unauthorized changes)

### For This Transaction

Your $5 test payment:
- Already succeeded (money left your card)
- Payout to bank scheduled
- **Watch for**:
  - Payout success email from Stripe
  - Money arriving in TSB account
  - Or: Payout failure email (then you know to fix)

---

## Technical Details (For Developers)

### NZ Bank Account Format

**Standard**: `XX-XXXX-XXXXXXX-XXX`
- Bank (2 digits): 15 = TSB Bank
- Branch (4 digits): 3959
- Base (7 digits): xxxxx36
- Suffix (3 digits): 085

**Stripe expects** (varies by integration):
- Routing number: 153959 (bank + branch)
- Account number: xxxxx36085 (base + suffix)

**Leading Zero Issue**:
- Suffix `085` should NOT become `0085`
- Stripe dashboard may be adding leading zero incorrectly
- This is a Stripe parsing bug for NZ accounts

### Not a Code Issue

Your website code (Koha donation form) does NOT:
- ❌ Store bank account numbers
- ❌ Configure payout settings
- ❌ Handle bank account validation

Stripe API handles:
- ✅ Creating checkout sessions (what Koha does)
- ✅ Processing payments (Stripe's responsibility)
- ✅ Sending payouts (configured in Stripe Dashboard)

**This bug is in Stripe's dashboard configuration, not your code.**

---

## Immediate Checklist

- [ ] Log into Stripe Dashboard
- [ ] Navigate to Settings → Bank accounts
- [ ] Click "Edit" on TSB Bank account
- [ ] Verify suffix is `085` not `0085`
- [ ] If wrong: Correct to `085`
- [ ] Save and verify change persists
- [ ] Request test payout of $1
- [ ] Monitor for payout arrival (2-3 business days)
- [ ] Enable 2FA on Stripe account
- [ ] Enable payout notification emails

---

## Support Resources

**If you can't fix in dashboard**:
1. Contact Stripe Support: https://support.stripe.com
2. Chat with Stripe: Dashboard → Help → Chat
3. Explain: "NZ bank account suffix showing 0085 instead of 085"
4. Reference: TSB Bank account ending in 085

**Stripe Support can**:
- Manually correct your bank account details
- Verify the account format is correct
- Help process test payout to verify
- Investigate why edit doesn't persist

---

## Status Updates

**2025-10-21 (Initial Report)**:
- Issue identified by user
- Bank account number has extra '0'
- Cannot confirm edit in Stripe Dashboard
- $5 test transaction already processed
- Payout scheduled but may fail

**Next Steps**:
1. User logs into Stripe Dashboard
2. User attempts to correct bank account
3. User reports back if edit persists or fails
4. If edit fails: Contact Stripe Support immediately
5. If edit succeeds: Request test payout to verify

---

## Risk Assessment

**Current Risk**: 🟡 MODERATE TO HIGH

- Payout amount: Small ($4.56)
- Payout timing: Delayed by Labour Day (gives time to fix)
- Account error: May cause rejection (funds return to Stripe)
- Wrong account: Unlikely (invalid accounts get rejected)

**Action Required**: Fix bank account configuration in next 24-48 hours

---

**Prepared by**: Claude Code (Autonomous Security & Bug Investigation)  
**Status**: Awaiting user action in Stripe Dashboard  
**Priority**: CRITICAL - Affects real money payouts