2016 Bangladesh Bank heist
In February 2016, instructions to steal US$951 million from Bangladesh Bank, the central bank of Bangladesh, were issued via the SWIFT network. Five transactions issued by hackers, worth $101 million and withdrawn from a Bangladesh Bank account at the Federal Reserve Bank of New York, succeeded, with $20 million traced to Sri Lanka (since recovered) and $81 million to the Philippines (about $18 million recovered).[1] The Federal Reserve Bank of NY blocked the remaining thirty transactions, amounting to $850 million, at the request of Bangladesh Bank.[2]
Background
The 2016 cyber-attack on the Bangladesh Central bank was not the first attack of its kind. In this cyber heist, thieves tried to illegally transfer US$951 million to several fictitious bank accounts around the world. In 2013, the Sonali Bank of Bangladesh was also successfully targeted by hackers who were able to cart away US$250,000. In 2015, two other hacking attempts were recorded, a $12 million theft from Banco del Austro in Ecuador in January and an attack on Vietnam's Tien Phong Bank in December that was not successful. In all these cases, the perpetrators are suspected to have been aided by insiders within the targeted banks, who assisted in taking advantage of weaknesses within the SWIFT global payment network.[3][4]
In 2012, the Philippines loosened restrictions on its gambling industry despite opposition from the Catholic Church. After the country's gambling industry benefited from Chinese paramount leader Xi Jinping's campaign against corruption, which drove gamblers further south of Macau,[5] its casinos lobbied against a 2012 amendment by the Philippine Senate of the 2001 Anti-Money Laundering Act that required them to report suspicious transactions. Senate President Juan Ponce Enrile had lobbied for the inclusion of casinos in the scope of the law. At that time, big casino firms in the Philippines such as the City of Dreams had not yet been established.[6]
Events
Capitalizing on weaknesses in the security of the Bangladesh Central Bank, including the possible involvement of some of its employees,[7] perpetrators attempted to steal $951 million from the Bangladesh central bank's account with the Federal Reserve Bank of New York sometime between February 4–5 when Bangladesh Bank's offices were closed. The perpetrators managed to compromise Bangladesh Bank's computer network, observe how transfers are done, and gain access to the bank's credentials for payment transfers. They used these credentials to authorise about three dozen requests to the Federal Reserve Bank of New York to transfer funds from the account Bangladesh Bank held there to accounts in Sri Lanka and the Philippines.
Thirty transactions worth $851 million were flagged by the banking system for staff review, but five requests were granted; $20 million to Sri Lanka (later recovered[8][9]), and $81 million lost to the Philippines, entering the Southeast Asian country's banking system on February 5, 2016. This money was laundered through casinos and some later transferred to Hong Kong.
Attempted fund diversion to Sri Lanka
The $20 million transfer to Sri Lanka was intended by hackers to be sent to the Shalika Foundation, a Sri Lanka-based private limited company. The hackers misspelled "Foundation" in their request to transfer the funds, spelling the word as "Fundation". This spelling error gained suspicion from Deutsche Bank, a routing bank which put a halt to the transaction in question after seeking clarifications from Bangladesh Bank.[8][10][11]
Sri Lanka-based Pan Asia Bank initially took notice of the transaction, with one official noting the transaction as too big for a country like Sri Lanka. Pan Asia Bank was the one which referred the anomalous transaction to Deutsche Bank. The Sri Lankan funds have been recovered by Bangladesh Bank.[8]
Funds diverted to the Philippines
The money transferred to the Philippines was deposited in five separate accounts with the Rizal Commercial Banking Corporation (RCBC); the accounts were later found to be under fictitious identities. The funds were then transferred to a foreign exchange broker to be converted to Philippine pesos, returned to the RCBC and consolidated in an account of a Chinese-Filipino businessman;[6][9] the conversion was made from February 5 to 13, 2016.[12] It was also found that the four U.S. dollar accounts involved were opened at the RCBC as early as May 15, 2015, remaining untouched until February 4, 2016, the date the transfer from the Federal Reserve Bank of New York was made.[12]
In February 8, 2016, during the Chinese New Year, Bangladesh Bank through SWIFT informed RCBC to stop the payment, refund the funds, and to "freeze and put the funds on hold" if the funds had already been transferred. Chinese New Year is a non-working holiday in the Philippines and a SWIFT message from Bangladesh Bank containing similar information was received by RCBC only a day later. By this time, a withdrawal amounting to about $58.15 million had already been processed by RCBC's Jupiter Street (in Makati City) branch.[12]
On February 16, the Governor of Bangladesh Bank requested Bangko Sentral ng Pilipinas' assistance in the recovery of its $81 million funds, saying that the SWIFT payment instructions issued in favor of RCBC on February 4, 2016 were fraudulent.[12]
Investigation
Bangladesh
Initially, Bangladesh Bank was uncertain if its system had been compromised. The governor of the central bank engaged World Informatix Cyber Security, a US based firm, to lead the security incident response, vulnerability assessment and remediation. World Informatix Cyber Security brought in the leading forensic investigation company Mandiant, a FireEye company, for the investigation. These cyber security experts found "footprints" and malware of hackers, which suggested that the system had been breached. The investigators also said that the hackers were based outside Bangladesh. An internal investigation has been launched by Bangladesh Bank regarding the case.[8]
The Bangladesh Bank's forensic investigation found out that malware was installed within the bank's system sometime in January 2016, and gathered information on the bank's operational procedures for international payments and fund transfers.[12]
The investigation also looked into an unsolved 2013 hacking incident at the Sonali Bank, wherein US$250,000 was stolen by still unidentified hackers. According to reports, just as in the 2016 Central Bank hack, the theft also used fraudulent fund transfers using the SWIFT International Payment Network. The incident was treated by Bangladeshi police authorities as a cold-case until the suspiciously similar 2016 Bangladesh Central Bank heist.[13]
Philippines
The Philippines' National Bureau of Investigation (NBI) launched a probe and looked into a Chinese-Filipino who allegedly played a key role in the money laundering of the illicit funds. The NBI is coordinating with relevant government agencies including the country's Anti-Money Laundering Council (AMLC). The AMLC started its investigation on February 19, 2016 of bank accounts linked to a junket operator.[12] AMLC has filed a money laundering complaint before the Department of Justice against a RCBC branch manager and five unknown persons with fictitious names in connection with the case.[14]
A Philippine Senate hearing was held on March 15, 2016, led by Senator Teofisto Guingona III, head of the Blue Ribbon Committee and Congressional Oversight Committee on the Anti-Money Laundering Act.[15] A closed-door hearing was later held on March 17.[16] Philippine Amusement and Gaming Corporation (PAGCOR) has also launched its own investigation.[8] In August 12, 2016, RCBC was reported to have paid half of the P1 billion penalty imposed by the Central Bank of the Philippines.[17] Prior to that, the bank reorganized its board of directors by increasing the number of independent directors to 7 from the previous 4.[18]
United States
FireEye's Mandiant forensics division and World Informatix Cyber Security, both US-based companies, are investigating the hacking case. According to investigators, the perpetrators' familiarity with the internal procedures of Bangladesh Bank was probably gained by spying on its workers. In a separate report, the US Federal Bureau of Investigation (FBI) says that Agents have found evidence pointing to at least one bank employee acting as an accomplice, with evidence pointing to several more people as possibly assisting hackers in navigate the Bangladesh Bank’s computer system.[19] The government of Bangladesh is considering suing the Federal Reserve Bank of New York in a bid to recover the stolen funds.[8]
Other attacks
Computer security researchers have linked the theft to as many as eleven other attacks, and alleged that North Korea had a role in the attacks, which, if true, would be the first known incident of a state actor using cyberattacks to steal funds.[20][21]
Response from linked organizations
![](../I/m/Dr._Atiur_Rahman%2C_Governor_of_Bangladesh_Bank_cropped.jpg)
The Rizal Commercial Banking Corporation said it did not tolerate the illicit activity in the RCBC branch involved in the case. Lorenzo V. Tan, RCBC's president, said that the bank cooperated with the Anti-Money Laundering Council and the Bangko Sentral ng Pilipinas regarding the matter.[22] Tan's legal counsel has asked the RCBC Jupiter Street branch manager to explain the alleged fake bank account that was used in the money laundering scam.[23]
The RCBC's board committee also launched a separate probe into the bank's involvement in the money laundering scam. RCBC president Lorenzo V. Tan filed an indefinite leave of absence to give way to the investigation by the authorities on the case.[24][25] On May 6, 2016, despite being cleared of any wrongdoing by the bank's internal investigation, Tan resigned as President of RCBC to "take full moral responsibility" for the incident.[26][27] Helen Yuchengco-Dee, daughter of RCBC founder Alfonso Yuchengco, will take over the bank's operations. The bank also apologized to the public for its involvement in the heist.
Bangladesh Bank chief governor Atiur Rahman resigned from his post amid the current investigation of the heist and money laundering. He submitted his resignation letter to Prime Minister Sheikh Hasina on March 15, 2016. Before the resignation was made public, Rahman stated that he would resign for the sake of his country.[28]
On August 5, 2016, the Bangko Sentral ng Pilipinas approved a ₱1 billion (~US$52.92 million) fine against RCBC for its non-compliance with banking laws and regulations in connection with the bank heist. This is the largest monetary fine ever approved by BSP against any institution. RCBC stated that the bank will comply with the BSP's decision, and will pay the imposed fine.[29]
Ramifications
The incident shows the risks that banks connected to the SWIFT system are exposed to as a result of the security vulnerabilities of other member banks. By breaching the Bangladesh Central Bank's security firewalls, hackers were able to hack the system and transfer the funds through the established global banking networks almost undetected. The failure of the Bangladeshi government to build adequate safeguards for its financial system became the starting point for a global, multi-million money laundering scheme whose effect was felt beyond the country's borders.
The case threatens the reinstatement of the Philippines to the blacklist, by the Financial Action Task Force on Money Laundering, of countries making insufficient efforts against money laundering.[30] Attention was given to a potential weakness of Philippine authorities' efforts against money laundering after lawmakers in 2012 managed to exclude casinos from the roster of organizations required to report to the Anti-Money Laundering Council regarding suspicious transactions.
The case also highlights the threat of cyber attacks to both government and private institutions by cyber criminals using real bank codes to make orders look genuine. SWIFT has advised banks using the SWIFT Alliance Access system to strengthen their cyber security posture and ensure they are following SWIFT security guidelines. Bangladesh is reportedly the 20th most cyber-attacked country, according to a cyber threat map developed by Kaspersky Lab, which runs in real time.[31]
References
- ↑ Cabalza, Dexter. "Ex-RCBC branch manager free on bail".
- ↑ Schram, Jamie (22 March 2016). "Congresswoman wants probe of 'brazen' $81M theft from New York Fed".
- ↑ Das, Krishna; Paul, Ruma (25 May 2016). "Exclusive: Bangladesh probes 2013 hack for links to central bank heist". Reuters. Retrieved 26 August 2016.
- ↑ "Bangladesh probes 2013 hack for links to Swift-linked central bank heist". Reuters. 25 May 2016. Retrieved 26 August 2016.
- ↑ Alcuaz, Coco (10 March 2016). "Philippine Bank Claims Innocence In Bangladesh-Federal Reserve Money Laundering Controversy". International Business Times. Retrieved 11 March 2016.
- 1 2 Ager, Maila (3 March 2016). "Senate to probe $100-M laundering via PH, says Osmeña". Philippine Daily Inquirer. Retrieved 11 March 2016.
- ↑ "Swift rejects Bangladesh Central Bank claims".
- 1 2 3 4 5 6 Quadir, Serajul (11 March 2016). "Spelling mistake stops hackers stealing $1 billion in Bangladesh bank heist". The Independent. Retrieved 13 March 2016.
- 1 2 Byron, Rejaul Karim (10 March 2016). "Hackers' bid to steal $870m more from Bangladesh central bank foiled". Asia News Network. The Daily Star. Retrieved 11 March 2016.
- ↑ "Sri Lankan in Bangladesh cyber heist says she was set up by friend". 31 March 2016 – via Reuters.
- ↑ "Story behind Shalika Foundation - Ceylontoday.lk".
- 1 2 3 4 5 6 Byron, Rejaul Karim; Rahman, Md Fazlur (11 March 2016). "Hackers bugged Bangladesh Bank system in Jan". Asia News Network. The Daily Star. Retrieved 13 March 2016.
- ↑ "Bangladesh probes 2013 hacking incident for connections to 2016 heist".
- ↑ "RCBC manager, others face anti-money laundering complaint". Rappler. March 5, 2016. Retrieved March 5, 2016.
- ↑ Pasion, Patty (15 March 2016). "RCBC manager invokes right vs self-incrimination at Senate probe". Rappler. Retrieved 20 March 2016.
- ↑ Yap, Cecilia; Calonzo, Andreo (17 March 2016). "Printer error foiled billion-dollar bank heist". Sydney Morning Herald. Retrieved 20 March 2016.
- ↑ Rada, Julito. "RCBC pays half of P1-b penalty".
- ↑ Rappler.com. "RCBC reorganizes board after Bangladesh Bank heist scandal".
- ↑ "FBI suspects inside job in Bangladesh bank heist".
- ↑ Shen, Lucinda (27 May 2016). "North Korea Has Been Linked to the SWIFT Bank Hacks". Fortune. Retrieved 28 May 2016.
- ↑ Perlroth, Nicole; Corkery, Michael (26 May 2016). "North Korea Linked to Digital Attacks on Global Banks". New York Times. Retrieved 28 May 2016.
- ↑ Agcaoili, Lawrence (10 March 2016). "RCBC denies alleged money laundering". The Philippine Star. Retrieved 11 March 2016.
- ↑ "Explain 'fake account,' RCBC chief tells branch manager". ABS-CBN News. March 13, 2016. Retrieved March 13, 2016.
- ↑ Dumlao-Abadilla, Doris (March 23, 2016). "RCBC chief goes on leave amid $81M dirty money probe". Philippine Daily Inquirer. Retrieved March 24, 2016.
- ↑ Agcaoili, Lawrence (March 23, 2016). "RCBC president goes on leave". The Philippine Star. Retrieved March 24, 2016.
- ↑ "RCBC Prexy resigns after board clears him of wrongdoing".
- ↑ "Tan cleared of wrong doing, resigns to take full moral responsibility".
- ↑ "Bangladesh central bank governor quits over $81m heist". The Daily Star/Asia News Network. March 15, 2016. Retrieved May 11, 2016.
- ↑ http://www.gmanetwork.com/news/story/576498/money/companies/bangko-sentral-slaps-p1-b-fine-on-rcbc-for-stolen-bangladesh-bank-fund
- ↑ Remitio, Rex (3 March 2016). "Sen. Osmeña: PH may suffer if money laundering is proven". CNN Philippines. Retrieved 11 March 2016.
- ↑ Tweed, David; Devnath, Arun (10 March 2016). "$1 Billion Plot to Rob Fed Accounts Leads to Manila Casinos". Bloomberg. Retrieved 11 March 2016.