Scourge · February 4 2016

The Great Bangladesh Bank Heist

Chronicle

On the night of 4–5 February 2016, taking advantage of the weekend, attackers used Bangladesh Bank's SWIFT credentials to send 35 fraudulent transfer orders worth nearly $1 billion from its account at the Federal Reserve Bank of New York. Most were blocked after the New York Fed grew suspicious, and a spelling error alerted an intermediary bank and stopped a $20 million transfer, but $81 million reached the Philippines and was laundered through casinos. The theft was later attributed to North Korea's Lazarus Group.

Lesson learned

SWIFT launched a customer security programme with mandatory controls, and banks learned that even the most trusted system is only as safe as the computer it runs on.

Prayer of reparation

O blessed typo, who saved twenty million with one misplaced letter, watch over our transfers and keep the thieves careless. Amen.

How it is remembered

Remembered by isolating payment workstations, double-checking any unusual transfer and remembering that thieves love long weekends.