DHAKA/NEW YORK (Reuters) – Hours before the Federal Reserve Bank of New York approved four fraudulent requests to send $81 million from a Bangladesh Bank account to cyber thieves, the Fed branch blocked those same requests because they lacked information required to transfer money, according to two people with direct knowledge of the matter.
On the day of the theft in February, the New York Fed initially rejected 35 requests to transfer funds to various overseas accounts, a New York Fed official and a senior Bangladesh Bank official told Reuters. The Fed’s decision to later fulfill a handful of resubmitted requests raises questions about whether it missed red flags.
The New York arm of the U.S. central bank initially denied the transfer requests because they lacked proper formatting for the SWIFT messaging system, the network banks use for international financial transfers, the two officials said.
The Bangladesh Bank official said they lacked the names of correspondent banks, which typically receive wired funds. The Fed rejected the requests, which came from hackers who had broken into the SWIFT network through Bangladesh Bank systems.
Later in the day, however, the cyber thieves resubmitted those 35 requests. On the second try, the messages had the proper formatting, the New York Fed official said. The requests had been authenticated by SWIFT, the first line of defense against fraudulent wire transfers.
Despite the technical compliance, the New York Fed rejected 30 of the requests a second time. But the Fed did approve five requests – for a total of $101 million. Later, one of those five transfers – a $20 million request – was reversed because of a misspelling.
The source close to the bank, who also had direct knowledge of the matter, said anomalies in the four transfers that ultimately went through should have raised questions at the New York Fed. They were paid to individual recipients, a rarity for Bangladesh’s central bank, and the false names on the four approved withdrawals also appeared on some of the 30 resubmitted requests rejected by the bank, said the source close to the Bangladesh Bank.
“Of course, we asked the Fed why the repetition of the names did not create red flags,” the source said.
“They are saying they rejected 35 badly submitted ones,” the source said. But when the requests were re-submitted, they “paid 5 of them and stopped 30. Why? They can give no answer.”
The cyber theft from Bangladesh’s central bank – and recent disclosures of other similar fraud attempts – have brought scrutiny on the SWIFT messaging system. SWIFT is a cooperative of global banks formally known as the Society for Worldwide Interbank Financial Telecommunication, and its transaction system was used as a conduit for one of the largest cyber bank heists in history.
The New York Fed’s reviews of payment requests that come over the SWIFT system are focused chiefly on guarding against money laundering and transfers to people and entities that are under U.S. government sanctions, Fed officials have said. But requests often also are temporarily halted to fix typos and other formatting problems.
SWIFT, which has come under scrutiny after the Bangladesh Bank heist and cyber attacks in at least three other cases, plans a new program to improve security and also wants banks to “drastically” improve information sharing.
Full article: Exclusive: NY Fed first rejected cyber-heist transfers, then moved $81 million (Yahoo!)