How a rounding error can become a hidden transfer
Money is usually displayed in cents, but the calculations behind a payment can involve fractions of a cent. Interest, currency conversions, fees, and percentage-based charges may produce amounts such as $2.347. A system must decide what to do with the extra digits when it records or pays out the result.
A “salami-slicing” scheme exploits that gap. Instead of taking a conspicuous sum from one account, an attacker manipulates the software’s calculation or rounding rule so that a tiny remainder is diverted—potentially to an account they control. The individual difference may be hard to notice because it is smaller than a cent, while the customer-facing transaction still appears ordinary.
Why repetition matters
The arithmetic is simple: a fraction of a cent multiplied across a huge number of transactions can become a substantial amount. For example, a hypothetical diversion of $0.009 on each of one million transactions would total $9,000. The point is not that every payment system can be exploited this way; it is that small discrepancies can accumulate when the same process runs at scale.
The attacker’s challenge is to make the totals appear consistent. If each transaction is rounded correctly and the leftover fractions are accounted for, there may be no money to skim. The opportunity arises when software handles those remainders inconsistently, or when a change to the calculation routes them somewhere they should not go.
The trail is in the aggregate
A single transaction may look harmless, but repeated discrepancies can leave a pattern in reconciliations—the checks that compare recorded payments with the money actually moved. That is why financial systems need consistent precision rules and records that let auditors trace how fractional amounts were handled. A tiny amount can hide in one line item; repeated millions of times, it becomes a question the books have to answer.
