EnlargeThe Dark Knight, Warner Bros.
reader comments 6
Share this story
Finance messaging giant SWIFT plans new measures to help banks combat fraud after a gang broke into Bangladesh’s central bank in February and stole £57 million pounds—and were only caught because one of them made a typo in a £15 million transfer.
The banking communications network, which allows financial institutions across the world to send each other secure messages about their transactions, is introducing “Daily Validation Reports,” which it bills as a mechanism to help customers detect unusual patterns in their message flows, giving them more of a chance “to identify possible fraud attempts and improving the likelihood they can cancel any fraudulent transfers.”
The heist could have cost almost £700 million but for the typo—which spelled the name of a Sri Lankan NGO called the “Shalika Foundation” as the “Shalika Fandation”—raised red flags at Deutsche Bank, who warned the Bangladeshis, allowing them to cancel most of the rest of the transactions. Worse still, the Shalika Foundation appears not even to exist, Reuters reported.
In May, the investigation into the hack was opened out to a further 12 banks through whom the robbers’ activity seems to have been routed, a development which prompted SWIFT to beef up its security.
In June, it launched a customer security programme designed “to reinforce and evolve the security of global banking” and to help individual customers improve their own security baselines.
Bangladeshi security services has claimed that SWIFT technicians left the national bank vulnerable to attacks of this kind.
The new measure is billed to customers as “an independent means of verifying their messaging activity.” SWIFT said:
Reports will be provided through a separate channel to customers’ payments and compliance teams.
This “out of band” access will ensure that independent departments at customer firms will be able to access independently sourced information through an independent channel, even if their own systems or operational staff have been compromised and their locally stored records have been obfuscated.
According to Stephen Gilderdale, who heads up the new security programme, “a key step in the modus operandi in recent wire fraud cases at customer firms involves the attackers concealing their fraudulent messaging activity on customers’ local systems.” He said:
Smaller institutions, in particular, are currently dependent on the accuracy of the data on their own systems, but in the event of a security breach, their locally stored payment and reconciliation data may be altered or unavailable.
Daily Validation Reports will provide a reliable and independent source of information, providing such institutions with an activity lens to help them quickly detect fraud—whether perpetrated by external attackers or by malicious insiders.
SWIFT, headquartered in Belgium and owned by thousands of financial stakeholders, processes the majority of international interbank messages, connecting “over 11,000 banking and securities organisations, market infrastructures, and corporate customers in more than 200 countries and territories.”
The new service will include both activity reports and risk reports.
The former enable banks to see “their aggregate daily activity across currencies, countries, and counterparties—giving them a snapshot view of each day’s messaging activity against which to detect unusual patterns.” While risk reports, we’re told, “provide customers with a focused review of large or unusual payment flows and new combinations of payment parties—allowing unusual senders, destinations and patterns to be more quickly and easily identified.”
The new measures will be introduced in December 2016.
This post originated on Ars Technica UK