Bangladesh Central Bank, The Federal Reserve of New York, Swift and the hackers

Bangladesh Bank officials claimed that more than $100m was stolen from its foreign exchange account with the New York Fed on 5 February, and pointed the finger at Chinese hackers. The stolen money was allegedly transferred to Sri Lanka and the Philippines, where authorities were able to freeze some of the assets. However, the New York Fed contradicted the Bangladesh Bank’s claims, stating that it could find no evidence of its systems being breached. More details have emerged since, including the claim that the hackers could have made off with more money had they been better spellers – money intended for a non-governmental organisation was halted when the routing Deutsche Bank noted that the thieves had misspelt ‘foundation’ as ‘fandation’, thereby denying the hackers their full bounty of $951m.hideAs it was, at least $30m-worth of the heist was handed over to an unidentified Chinese man in Manila in cash by a foreign exchange broker in several instalments over a period of days. The haul, worth 600 million Philippine pesos, would have involved at least 780,000 banknotes, according to Reuters. The payment credentials were stolen at the Bangladesh Bank’s end through the use of malware and this led to the dismissal of the central bank’s governor, who failed to report the crime to the country’s finance minister, Abul Maal Abdul Muhith. However, the minister has subsequently hit out at the New York Fed, blaming it for ignoring several red flags and failing to stop the fraudulent transactions. The possibility of legal action was raised. According to internal Bangladesh Bank documents reported by Bloomberg, the New York Fed blocked more than 30 giant transactions because of a lack of bona fide beneficiary details but let five through, which were subsequently flagged for due diligence review. The Bangladesh Bank officials view this “as a major lapse on the part of FRB NY”. Their criticism was echoed by US politicians such as US Representative Carolyn Maloney, who stated that the “brazen heist…threatens to undermine the confidence that foreign central banks have in the Federal Reserve and the safety and soundness of international monetary transactions”. At the heart of it all lies the Society for Worldwide Interbank Financial Transactions (Swift), the Brussels-based banking cooperative which runs the network for international financial transactions. Further investigation by Bangladeshi Police revealed a lamentable standard of security at the central bank – it did not have a firewall and used second-hand, $10 routers to connect to Swift’s network. The police have blamed both Bangladesh bank and Swift for the sub-standard security arrangements, stating that the latter had a responsibility to point out the risk of exposure. Instead, Swift only advised the central bank to upgrade its switches when its system engineers came to inspect after the incident. Things got worse for Swift in April, when it confirmed that the Bangladesh bank hack was not an isolated incident, in a security alert sent to its member banks. “Swift is aware of a number of recent cyber incidents in which malicious insiders or external attackers have managed to submit Swift messages from financial institutions’ back-offices, PCs or workstations connected [via] their local interface to the Swift network.” Firstly, Vietnam’s Tien Phong Bank confirmed that it had thwarted an attempt by cyber criminals to steal €1m through fake Swift messages. And then, in late May, details emerged of another attack involving Ecuador’s Banco del Austro (BDA) that took place last year but was never reported. According to papers filed by BDA as part of a lawsuit, US bank Wells Fargo wrongly approved at least 12 transactions totalling $12m of funds over the Swift network, believing they were sending the money to legitimate accounts in Hong Kong. In echoes of the Bangladesh Bank/New York Fed case, BDA has blamed Wells Fargo for failing to flag the transactions as suspicious, while Wells Fargo has blamed BDA for allowing the hack in the first place after a staff member’s Swift login credentials fell into the wrong hands. BDA also alleges that a similar issue occurred with another US bank, Citi, and the transfer of $1.8m based on fraudulent requests. Citi has since repaid the money but, along with Wells Fargo and BDA, failed to inform Swift of the breach, despite the fact its managing director of franchise risk and strategy is actually Swift’s chairman, Yawar Shah. Swift has subsequently taken action. At the end of May, chief executive Gottfried Leibbrandt released a five-point security plan designed to restore faith in its system. This plan included improved information sharing; hardened security arrangements for customer-managed software and enhanced security audit frameworks; more support for banks’ use of payment pattern controls to identify suspicious behaviour; and certification requirements for third-party providers. Announcing the changes, Mr Leibbrandt also referred to the Bangladesh attack as a watershed moment for the banking industry. “Banks that are compromised like this can be put out of business. It’s not like retailers losing credit card details or telcos losing customer details. Telcos and retailers will take reputational hits and may face some financial liabilities but things will move on. When banks lose control of access to their payment channels, it’s different... The financial system is hugely interconnected and it operates on trust.” Mr Leibbrandt also called for more innovation in security, such as next generation pattern recognition, monitoring, anomaly detection, authentication and biometrics, along with “a host of innovations we have yet to develop that will improve and preserve the security of our industry”. It has also been speculated that greater use of the much-vaunted blockchain, a distributed ledger technology that can be applied to money transfers, could well have prevented the recent cyber attacks. Mr Leibbrandt has since gone further, telling the Financial Times that member banks with weak security could be excluded from the its network, although he acknowledged that this strategy could be double-edged. “There are pros and cons to that. The pros are that it provides clarity that if you are on the Swift network you need minimum standards. I think the con is if you are too heavy-handed, you could drive people to unsafe channels.” Despite the tough talk, Swift and central banks continue to face criticism and greater scrutiny. A US congressional committee is investigating the Federal Reserve’s security practices, while a group of US banking regulators – the Federal Financial Institutions Examination Council – has encouraged banks to regularly check the security of their links with interbank messaging and payment systems, and “actively manage the associated risks”.

Bangladesh Central Bank, The Federal Reserve of New York, Swift and the hackers

Want to read this article?

Read Next

Hong Kong and Shanghai to cooperate on captives and ILS

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Swerma to focus on AI and ESG in 2024

Hong Kong and Shanghai to cooperate on captives and ILS

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Swerma to focus on AI and ESG in 2024

Want to read this article?

Read Next

Hong Kong and Shanghai to cooperate on captives and ILS

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

Consultancy S-RM expands cybersecurity practice to APAC

Four in five non-EU companies to align with CSRD

Swerma to focus on AI and ESG in 2024

Related Articles