SWIFT confirms new cyber thefts, hacking tactics

LONDON/BOSTON - Cyber attacks on the global banking system have continued - and succeeded - since February’s heist of $81 million from the Bangladesh central bank, underscoring the continuing vulnerability of the SWIFT messaging network, a SWIFT official told Reuters.

The network, which handles trillions of dollars in transfers daily, has warned banks of the escalating threat to their systems, according to a SWIFT letter obtained by Reuters.

"The threat is very persistent, adaptive and sophisticated – and it is here to stay," SWIFT said last month in a letter to client banks, which has not been previously reported.

Client banks been have been hit with a "meaningful" number of attacks - about a fifth of them resulting in stolen funds, said Stephen Gilderdale, Head of SWIFT’s Customer Security Programme. Gilderdale's comments are the first confirmation of new thefts involving the SWIFT network since the February heist.

The revelations provide fresh evidence that SWIFT remains at risk of copycat attacks nearly a year after the massive theft from a Bangladesh Bank account at the New York Fed. The unprecedented cyber heist prompted regulators around the globe to tighten bank security requirements.

SWIFT'S letter to customers warned that hackers have refined their methods for compromising local bank systems. One new tactic, the letter said, involved using software that allows technicians to access computers to provide technical support.

"We unfortunately continue to see cases in which some of our customers’ environments are being compromised" by thieves who then send fraudulent payment instructions through the SWIFT network - the same kind of messages used to steal Bangladesh Bank funds.

On Monday, a top investigator in Dhaka told Reuters that some Bangladesh central bank officials deliberately exposed its computer systems and enabled the theft. The comments by Mohammad Shah Alam of the Dhaka police are the first sign that investigators have got a firm lead in one of the world's biggest cyber heists. Arrests are likely soon, he said.

SWIFT's Gilderdale declined to provide further details about more recent attacks or to name victims or amounts stolen. Asked how many heists had been attempted, he said only that it was "a meaningful number of cases.”

The intrusions had been detected in a variety of ways, Gilderdale said. In some cases, anti-virus software had identified malware. In one case, a financial supervisory body had notified SWIFT of an attempted attack.

The additional attacks SWIFT disclosed to Reuters do not include others that have already come to light since the Bangladesh Bank heist.

Thieves stole $250,000 from Bangladesh's Sonali bank in 2013. More than $12 million was stolen from Ecuador's Banco del Austro in 2015. Vietnam's Tien Phong Bank said in May that it foiled an attempt to steal money via SWIFT.

(Reporting by Tom Bergin and Jim Finkle; Editing by Brian Thevenot)

source: news.abs-cbn.com

NY Fed, Bangladesh central bank to resume normal money transfers - sources

NEW YORK - The Federal Reserve Bank of New York and Bangladesh's central bank have agreed to withdraw additional payment security measures put in place after one of the world's biggest cyber heists, the theft of $81 million from Bangladesh Bank's account at the Fed, two sources said.

The decision comes after SWIFT, the global financial messaging platform, promised in May to strengthen security on software tools used by its clients and to develop new tools that would spot a compromised account and raise a red flag when a payment instruction deviates from normal patterns.

The decision was taken at a meeting in New York this week between officials from Bangladesh Bank, the New York Fed and SWIFT, said a source close to Bangladesh Bank who has direct knowledge of the matter. They have agreed on a tentative timeline to withdraw the additional security measures but the source declined to give details.

"(The New York Fed and Bangladesh Bank) want to use (only) SWIFT for secure communication," said the source, declining to be named as he was not authorised to brief the media. "We are talking about normalising our communication channels as soon as possible."

The New York Fed and SWIFT could not immediately be reached for comment.

In early February, hackers used stolen Bangladesh Bank credentials to send three dozen SWIFT messages to transfer nearly $1 billion from its Fed account, eventually managing to route $81 million to a bank in the Philippines. Most of the money was laundered through casinos in Manila and remains missing.

Following the heist, Bangladesh Bank initiated a new protocol under which the Fed could only clear any SWIFT request from Dhaka after a voice authentication. Fed officials had to call one of two or three Bangladesh Bank officials whose voice samples were shared with the Fed.

A senior Bangladesh Bank official in Dhaka, who declined to be named, said more time was needed "to improve the system" before moving back to a SWIFT-only transfer mechanism.

Both sources said the New York Fed wanted to do away with the additional measure as it delayed genuine transfer instructions.

SWIFT has told Bangladesh Bank its system was secure and that the Asian bank needed to tighten its own defenses to prevent criminals from hacking into their computer systems.

Bangladesh Bank spokesman Subhankar Saha said he was not aware of the agreement and would comment only after the bank's delegation came back from the United States.

The bank said in a statement on Wednesday that its officials discussed with the New York Fed and SWIFT "certain technical details" of the heist to enhance their understanding of how the fraud occurred and "steps that have been and will be taken to remediate the event."

The Bangladeshi delegation also requested the New York Fed to put more pressure on the Philippines' Rizal Commercial Banking Corp (RCBC), to recover the rest of the stolen money, said the source close to Bangladesh Bank. The funds were routed to four accounts at the bank before they disappeared into casinos in the city.


The New York Fed in June wrote to the Philippines' central bank, prodding it to help Bangladesh Bank retrieve the money.

Bangladesh Bank officials believe the nudge from the Fed was one of the reasons the Philippines central bank this month slapped a record fine of P1 billion ($21 million) on RCBC in connection with the heist.

source: www.abs-cbnnews.com

SWIFT says second bank hit by malware attack

SWIFT, the global financial messaging network that banks use to move billions of dollars every day, warned on Thursday of a second malware attack similar to the one that led to February's $81 million cyber heist at the Bangladesh central bank.

The second case targeted a commercial bank, SWIFT spokeswoman Natasha de Teran said, without naming it. It was not immediately clear how much money, if any, was stolen in the second attack.

While SWIFT had previously warned that the Bangladesh heist was not an isolated incident, and said its core messaging system remained intact, confirmation of a second attack on a bank will likely increase scrutiny on the security of a network that is a linchpin of the global financial system.

SWIFT said in a statement that the attackers exhibited a "deep and sophisticated knowledge of specific operational controls" at targeted banks and may have been aided by "malicious insiders or cyber attacks, or a combination of both."

The organization, a Belgian co-operative owned by member banks and used by 11,000 financial institutions globally, said that forensic experts believe the second case showed that the Bangladesh heist "was not a single occurrence, but part of a wider and highly adaptive campaign targeting banks."

News of a second case comes as authorities in Bangladesh and elsewhere investigate the February cyber theft from the Bangladesh central bank account at the New York Federal Reserve Bank. SWIFT has acknowledged that that scheme involved altering SWIFT software to hide evidence of fraudulent transfers, but that the messaging system it controls was not compromised.

In both cases SWIFT said insiders or cyber attackers had succeeded in penetrating the targeted banks' systems, obtaining user credentials and submitting fraudulent SWIFT messages that correspond with transfers of money.

In the second case SWIFT said attackers had also used a kind of malware called a "Trojan PDF reader" to manipulate PDF reports confirming the messages in order to hide their tracks.

source: www.abs-cbnnews.com

SWIFT network says aware of multiple cyber fraud incidents

SWIFT, the global financial network that banks use to transfer billions of dollars every day, warned its customers on Monday that it was aware of "a number of recent cyber incidents" where attackers had sent fraudulent messages over its system.

The disclosure came as law enforcement authorities in Bangladesh and elsewhere investigated the February cyber theft of $81 million from the Bangladesh central bank account at the New York Federal Reserve Bank. SWIFT has acknowledged that the scheme involved altering SWIFT software on Bangladesh Bank's computers to hide evidence of fraudulent transfers.

Monday's statement from SWIFT marked the first acknowledgement that the Bangladesh Bank attack was not an isolated incident but one of several recent criminal schemes that aimed to take advantage of the global messaging platform used by some 11,000 financial institutions.

"SWIFT is aware of a number of recent cyber incidents in which malicious insiders or external attackers have managed to submit SWIFT messages from financial institutions' back-offices, PCs or workstations connected to their local interface to the SWIFT network," the group warned customers on Monday in a notice seen by Reuters.

The warning, which SWIFT issued in a confidential alert sent over its network, did not name any victims or disclose the value of any losses from the previously undisclosed attacks. SWIFT confirmed to Reuters the authenticity of the notice.

SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, is a cooperative owned by 3,000 financial institutions.

Also on Monday, SWIFT released a security update to the software that banks use to access its network to thwart malware that security researchers with British defense contractor BAE Systems said was probably used by hackers in the Bangladesh Bank heist.

BAE's evidence suggested that hackers manipulated SWIFT's Alliance Access server software, which banks use to interface with SWIFT's messaging platform, to cover their tracks.

BAE said it could not explain how the fraudulent orders were created and pushed through the system.

But SWIFT provided some evidence about how that happened in its note to customers, saying that in most cases the modus operandi was similar.

It said the attackers obtained valid credentials for operators authorized to create and approve SWIFT messages, then submitted fraudulent messages by impersonating those people.

FireEye, the internet security company whose Mandiant unit was hired by Bangladesh Bank to help investigate the heist, said the same group behind that hack had probably attacked other financial targets.

"FireEye has observed activity in other financial services organizations that is likely by the same threat actor behind the cyber attack on the Bank of Bangladesh," Vivek Chudgar, Mandiant's senior director for the Asia Pacific said in a statement emailed to Reuters.

FireEye declined to go into detail.

Rakesh Asthana, the World Informatix Cyber Security CEO, who is overseeing Bangladesh Bank's probe into the hack, declined to discuss the other attacks that SWIFT referred to.

But he urged banks to conduct independent security assessments to make sure their networks are secure and prevent future attacks.

“SWIFT builds on security practices established by the customer itself and therefore it is imperative that in the wake of this attack, customers using SWIFT Alliance Access must strengthen their cyber security posture,” Asthana said

FOLLOWING THE MONEY

Cyber security experts said more attacks could surface as SWIFT's banking clients look to see if their SWIFT access has been compromised.

Shane Shook, a banking security consultant who investigates large financial crime, said hackers were turning to SWIFT and other private financial messaging platforms because such attacks can generate more revenue than going after consumers or small businesses.

"These hacks specifically target financial institutions because smaller efforts result in much larger thefts," he said. "It's much more efficient than stealing from consumers."

Justin Harvey, chief security officer with Fidelis Cybersecurity, said hackers followed the money and would be drawn into such schemes in hopes of emulating a big heist like the one on Bangladesh Bank.

"After the Bangladesh Bank heist became public, every other attacker out there is looking to see if they can do the same," he said.

SWIFT spokeswoman Natasha Deteran told Reuters that the commonality in these cases was that internal or external attackers compromised the banks’ own environments to obtain valid operator credentials.

"Customers should do their utmost to protect against this," she said in an email to Reuters.

SWIFT told customers that the security update must be installed by May 12.

"We have made the Alliance interface software update mandatory as it is designed to help banks identify situations in which attackers have attempted to hide their traces - whether these actions have been executed manually or through malware," she said.

source: www.abs-cbnnews.com

Bangladesh Bank hackers compromised SWIFT software

The attackers who stole $81 million from the Bangladesh central bank probably hacked into software from the SWIFT financial platform that is at the heart of the global financial system, said security researchers at British defense contractor BAE Systems.

SWIFT, a cooperative owned by 3,000 financial institutions, confirmed to Reuters that it was aware of malware targeting its client software. Its spokeswoman Natasha Deteran said SWIFT would release on Monday a software update to thwart the malware, along with a special warning for financial institutions to scrutinize their security procedures.

The new developments now coming to light in the unprecedented cyber-heist suggest that an essential lynchpin of the global financial system could be more vulnerable than previously understood to hacking attacks, due to the vulnerabilities that enabled attackers to modify SWIFT's client software.

Deteran told Reuters on Sunday that it was issuing the software update "to assist customers in enhancing their security and to spot inconsistencies in their local database records."

The software update and warning from Brussels-based SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, come after researchers at BAE, which has a large cyber-security business, told Reuters they believe they discovered malware that the Bangladesh Bank attackers used to manipulate SWIFT client software known as Alliance Access.

BAE said it planned to go public on Monday with a blog post about its findings concerning the malware, which the thieves used to cover their tracks and delay discovery of the heist.

The cyber criminals tried to make fraudulent transfers totaling $951 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York in February.

Most of the payments were blocked, but $81 million was routed to accounts in the Philippines and diverted to casinos there. Most of those funds remain missing.



Investigators probing the heist had previously said the still-unidentified hackers had broken into Bangladesh Bank computers and taken control of credentials that were used to log into the SWIFT system. But the BAE research shows that the SWIFT software on the bank computers was probably compromised in order to erase records of illicit transfers.

Deteran reiterated on Sunday that "the malware has no impact on SWIFT's network or core messaging services."

The SWIFT messaging platform is used by 11,000 banks and other institutions around the world, though only some use the Alliance Access software, Deteran said.

SWIFT may release additional updates as it learns more about the attack in Bangladesh and other potential threats, Deteran said.

SWIFT is also reiterating a warning to banks that they should review internal security.

"While we keep all our interface products under continual review and recommend that other vendors do the same, the key defense against such attack scenarios is that users implement appropriate security measures in their local environments to safeguard their systems," Deteran said.

Adrian Nish, BAE's head of threat intelligence, said he had never seen such an elaborate scheme from criminal hackers.

"I can't think of a case where we have seen a criminal go to the level of effort to customize it for the environment they were operating in," he said. "I guess it was the realization that the potential payoff made that effort worthwhile."

A Bangladesh Bank spokesman declined comment on BAE's findings.

A senior official with the Bangladesh Police's Criminal Investigation Department said that investigators had not found the specific malware described by BAE, but that forensics experts had not finished their probe.

Bangladesh police investigators said last week that the bank's computer security measures were seriously deficient, lacking even basic precautions like firewalls and relying on used, $10 switches in its local networks.

Still, police investigators told Reuters in an interview that both the bank and SWIFT should take the blame for the problems.

"It was their responsibility to point it out but we haven't found any evidence that they advised before the heist," said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department, referring to SWIFT.

THWARTING FUTURE ATTACKS

The BAE alert to be published on Monday includes some technical indicators that the firm said it hopes banks could use to thwart similar attacks. Those indicators include the IP address of a server in Egypt the attackers used to monitor use of the SWIFT system by Bangladesh Bank staff.

The malware, named evtdiag.exe, was designed to hide the hacker's tracks by changing information on a SWIFT database at Bangladesh Bank that tracks information about transfer requests, according to BAE.

BAE said that evtdiag.exe was likely part of a broader attack toolkit that was installed after the attackers obtained administrator credentials.

It is still not clear exactly how the hackers ordered the money transfers.

Nish said that BAE found evtdiag.exe on a malware repository and had not directly analyzed the infected servers. Such repositories collect millions of new samples a day from researchers, businesses, government agencies and members of the public who upload files to see if they are recognized as malicious and help thwart future attacks.

Nish said he was highly confident the malware was used in the attack because it was compiled close to the date of the heist, contained detailed information about the bank's operations and was uploaded from Bangladesh.

While that malware was specifically written to attack Bangladesh Bank, "the general tools, techniques and procedures used in the attack may allow the gang to strike again," according to a draft of the warning that BAE shared with Reuters.

The malware was designed to make a slight change to code of the Access Alliance software installed at Bangladesh Bank, giving attackers the ability to modify a database that logged the bank's activity over the SWIFT network, Nish said.

Once it had established a foothold, the malware could delete records of outgoing transfer requests altogether from the database and also intercept incoming messages confirming transfers ordered by the hackers, Nish said.

It was able to then manipulate account balances on logs to prevent the heist from being discovered until after the funds had been laundered.

It also manipulated a printer that produced hard copies of transfer requests so that the bank would not identify the attack through those printouts, he said.

source: www.abs-cbnnews.com

Bangladesh Bank exposed to hackers by cheap switches, no firewall: police

DHAKA -- Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said.

The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank's SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department.

"It could be difficult to hack if there was a firewall," Alam said in an interview.

The lack of sophisticated switches, which can cost several hundred dollars or more, also means it is difficult for investigators to figure out what the hackers did and where they might have been based, he added.

Experts in bank security said that the findings described by Alam were disturbing.

"You are talking about an organization that has access to billions of dollars and they are not taking even the most basic security precautions," said Jeff Wichman, a consultant with cyber firm Optiv.

Tom Kellermann, a former member of the World Bank security team, said that the security shortcomings described by Alam were "egregious," and that he believed there were "a handful" of central banks in developing countries that were equally insecure.

Kellermann, now chief executive of investment firm Strategic Cyber Ventures LLC, said that some banks fail to adequately protect their networks because they focus security budgets on physically defending their facilities.

POLICE BLAME BANK, SWIFT

Cyber criminals broke into Bangladesh Bank's system and in early February tried to make fraudulent transfers totalling $951 million from its account at the Federal Reserve Bank of New York.

Most of the payments were blocked, but $81 million was routed to accounts in the Philippines and diverted to casinos there. Most of those funds remain missing.

The police believe that both the bank and SWIFT should take the blame for the oversight, Alam said in an interview.

"It was their responsibility to point it out but we haven't found any evidence that they advised before the heist," he said, referring to SWIFT.

A spokeswoman for Brussels-based SWIFT declined comment.

SWIFT has previously said the attack was related to an internal operational issue at Bangladesh Bank and that SWIFT's core messaging services were not compromised.

A spokesman for Bangladesh Bank said SWIFT officials advised the bank to upgrade the switches only when their system engineers from Malaysia visited after the heist.

"There might have been a deficiency in the system in the SWIFT room," said the spokesman, Subhankar Saha, confirming that the switch was old and needed to be upgraded.

"Two (SWIFT) engineers came and visited the bank after the heist and suggested to upgrade the system," Saha said.

GLOBAL WHODUNIT

The heist's masterminds have yet to be identified.

Bangladesh police said earlier this week they had identified 20 foreigners involved in the heist but they appear to be people who received some of the payments, rather than those who initially stole the money.

Bangladesh Bank has about 5,000 computers used by officials in different departments, Alam said.

The SWIFT room is roughly 12 feet by 8 feet, a window-less office located on the eight floor of the bank's annex building in Dhaka. There are four servers and four monitors in the room.

All transactions from the previous day are automatically printed on a printer in the room.

The SWIFT facility should have been walled off from the rest of the network. That could have been done if the bank had used the more expensive, "managed" switches, which allow engineers to create separate networks, said Alam, whose institute includes a cyber-crime division.

Moreover, considering the importance of the room, the bank should have deployed staff to monitor activity round the clock, including weekends and holidays, he said.

source: www.abs-cbnnews.com

Conflicting statements muddle $81-million dirty money trail

Conflicting statements during a Senate hearing on Tuesday failed to shed light on how $81 million that was stolen from Bangladesh's central bank ended up in Philippine casinos.

The hearing opened under a cloud of suspicion after a lawyer denied authenticating the sworn statement of Mark Palmares, a courier of foreign exchange broker Philrem, who detailed how he delivered a portion of the money to Solaire casino.

Philrem owners Michael Bautista and Salud Bautista, Rizal Commercial Banking Corp (RCBC) branch manager Maia Deguito and casino junket operator Kim Wong later gave contradicting accounts to senators.

Unidentified hackers breached the Bangladesh central bank's account with the Federal Reserve in February and wired $81 million to RCBC. The money passed through Philrem before ending up in several casinos.

Senator Bam Aquino asked the Bautista couple, Deguito and Wong if they were willing to open their phone call logs to verify their testimonies. All four agreed.

Wong alleged that he received instructions by phone from Michael Bautista, asking him to pick up money from his house.

"Nagkausap kami sa phone at sabi niya may ganitong pera, at kunin na daw sa bahay," said Wong.

Bautista, however, said he never spoke to Wong on the phone.

Salud Bautista, on the other hand, claimed it was Deguito who instructed her to transfer money to Wong. Deguito denied the allegation.

"Wala akong instructions about cash deliveries, I would like to believe na derecho na sila [Wong and Philrem] nag-uusap. Ang instruction lang sa akin was to credit everything to Philrem," she said.

Of the $81 million, $62 million was converted into pesos and transferred to casinos while the remaining $18 million was delivered to another casino agent, Weikang Xu, whose whereabouts are unknown, according to Salud Bautista.

Bangladeshi authorities said Monday they were investigating 12 Filipinos for alleged involvement in the heist.

The daring caper exposed loopholes in Philippine anti-money laundering and banking laws that make the country a dirty money destination.

Casinos are exempt from scrutiny by the Anti-Money Laundering Council under present laws.

Also during the hearing, Deguito said admitted she lied to RCBC in her reply to a memorandum asking her to explain the questionable deposits.

Degutio said it was Wong, not a certain Jessie Christopher Lagrosas as she had told RCBC, who asked her to transfer the stolen money to the account of businessman William Go.

"During that time that I answered the show cause I wasn't ready to reveal the personalities behind those referred accounts," said.

When asked by Senator Serge Osmeña III if she lied in her response to the RCBC show cause order, Deguito said, "If you will consider that lying, yes, I would acknowledge."

RCBC has filed criminal charges against Deguito and former RCBC Jupiter branch staff Angela Torres for allegedly opening the accounts that received the money under fictitious names.

source: www.abs-cbnnews.com

RCBC chief to take steps to return Bangladesh funds

MANILA - Rizal Commercial Banking Corporation (RCBC) Lorenzo Tan on Tuesday promised to urge the bank's board members to return part of the $81 million stolen from Bangladesh if they are found liable in laundering the fund.

At a hearing led by the Senate Blue Ribbon Committtee, Tan first admitted that RCBC's market value has fallen after four local banks in their Jupiter branch received the stolen money last February 5.

Senator Ralph Recto suggested that RCBC's market position could be improved if it pledges to return some $50 million out of the total funds.

"Assuming that the RCBC gives this to the Bank of Bangladesh, your P5 billion profit minus P2.2 billion ($50 million), kita pa rin kayo ng P3 billion," Recto said.

"Maybe your market price will improve to what it used to be and you would gain from that anyway. Maybe your stock price will hit whatever value and you make the protocol corrections."

In reply, Tan conceded that, "Our business is an actuarial business... We either lose money on bad loans, bad trades or operational losses like this one."

He added that on the average, RCBS provisions P1 billion to P2 billion every year on losses from bad transactions like those involving the Bangladesh funds.

Given this, he promised: "If we're found liable, I would recommed to the board to set aside a certain amount of money."

- ABS-CBN News Channel, 12 April 2015

source: www.abs-cbnnews.com

RCBC's key shareholders increase stakes

MANILA  - Rizal Commercial Banking Corp.'s (RCBC) two biggest shareholders have bought an extra $9.48 million worth of stock, taking their combined stakes to 65.02 percent, the Philippine lender said in a stock exchange filing on Wednesday.

RCBC is at the center of a Senate investigation into a cyber heist in which $81 million stolen from the Bangladesh Bank's account at the U.S. Federal Reserve Bank of New York was allegedly deposited at RCBC.


In the filing, RCBC said top shareholder Pan Malayan Management and Investment Corp last week bought 8.8 million shares at 30 pesos apiece, raising its stake to 42.31 percent from 41.68 percent.

Taiwan's Cathay Life Insurance, a subsidiary of Cathay Financial Holding Co Ltd, bought 5.8 million shares also at 30 pesos apiece, taking its stake to 22.71 percent from 22.3 percent.

The price of RCBC shares fell to as low as 28.75 pesos last month after the bank was placed under investigation. The stock fell as much as 3.8 percent to 30.70 in Wednesday morning trade, versus a 0.6 percent decline in the broader market.

"The principals are very confident of the bank. They used their cash to buy out investors that wanted to exit," said Augusto Cosio, president at fund manager First Metro Asset Management.

RCBC's reputation may have suffered from the heist, but its balance sheet remains attractive given its clients and depositors, Cosio said.

A spokesman at Cathay Financial told Reuters it was "confident in (RCBC's) chairman and management team."

"The Philippines' market is booming. It is only one of its branches that is being investigated. And RCBC is fully cooperating with investigators," the spokesman said.

Unidentified hackers allegedly stole the money in early February and channelled it to casinos and gambling agents in the Philippines via a Manila branch of RCBC.

RCBC launched its own investigation and filed a case against two former employees.

source: www.abs-cbnnews.com

Senate digs deeper into $81-M laundering heist

MANILA - Sacked bank manager Maia-Santos Deguito, junket operator Kim Wong and representatives of PhilRem Services Corp. - all key personalities tagged in an $81-million laundering heist - are expected to face off at a Senate hearing Tuesday.

Speaking to radio dzMM, Senate President Pro-Tempore Ralph Recto said this will be the first time that the three parties will all be present during the Senate investigation on how stolen funds from the Bangladesh Bank reached Philippine banks and casinos.

"Maganda itong pagdinig na ito dahil maghaharap-harap sila mamaya," Recto predicted.

The three parties earlier presented conflicting accounts of their alleged involvement in one of the world's biggest cyber heist.

At the third Senate hearing last Tuesday, Wong said that Deguito and foreign nationals Gao Shuhua and Ding Zhize were responsible for bringing in the "dirty money" into the Philippines.



He also claimed that Deguito alone approved the documents for the RCBC dollar accounts opened in May 2015, which received the stolen funds from the Bangladesh Bank in February 2016.

Wong added that he only referred one foreigner - Gao - to Deguito, contrary to her earlier claim that she met the owners of the four dollar accounts at Solaire casino through Wong's referral.

The junket operator also said that Deguito delivered at least P20 million in cash to him at the Solaire hotel on February 5. Another P80 million, he said, was delivered to him by Philrem's Concon Bautista on the same day.

This runs counter to the statement of former RCBC Jupiter-Makati branch senior customer relationship officer Angela Torres who said that the P20 million was loaded into the car of another businessman, William Go.

Philrem president Salud Bautista also opposed Wong, saying that the money was received by Weikang Xu, who has been described as a "registered" junket agent in the gaming business.


 The Bautistas also denied Wong's claim that they still hold an estimated $17 million from the illegal funds.

In the interview, Recto said the Senate will trace the real connections of the names tagged in the scandal.

"We want to dig deeper. Ano ba iyung relationship? Kasi lahat sila magkaka-kilala, kung tutuusin natin," he said.

The Senate has invited Bureau of Internal Revenue (BIR) Commissioner Kim Henares to today's hearing to shed light on the tax compliance of the involved parties.

Recto added that the hearing will also attempt once again to trace the remainder of the stolen funds that could be returned to Bangladesh.

The fourth hearing will also tackle the scam's toll on overseas Filipino workers (OFWs) as Philippine banks face tighter scrutiny from their foreign counterparts.

 Watch the livestream of the hearing at: www.livestream.com/anctelevision.

source: www.abs-cbnnews.com

Bangladesh seeks FBI's help in investigating central bank heist

DHAKA - Bangladesh has formally sought assistance from the U.S. Federal Bureau of Investigation to track down the cyber crooks who stole $81 million from its central bank's U.S. account, the interior minister said on Saturday.

Unknown hackers breached the computer systems of Bangladesh Bank in early February and attempted to steal $951 million from its account at the Federal Reserve Bank of New York, which it uses for international settlements.

Some attempted transfers were blocked, but $81 million was transferred to accounts in the Philippines in one of the largest cyber heists in history.

The central bank governor resigned on Tuesday, as details emerged in the Philippines that $30 million of the money was delivered in cash to a casino junket operator in Manila, while the rest went to two casinos.

"We sought the FBI's assistance when a group of FBI met with me for investigating the central bank heist last month," Interior Minister Asaduzzaman Khan told Reuters.

An U.S. embassy official in Dhaka told Reuters Washington stood ready to assist the government of Bangladesh in its investigation.

A senior police official involved in the investigation said that an FBI team was expected to visit the Criminal Investigation Department (CID) of police in Dhaka on Sunday. The CID was also coordinating with Interpol to track down the perpetrators.

"We are trying to find out what type of security there was, what safety measures were taken, and how the thieves penetrated the fire wall," he said.

The chief of the main opposition Bangladesh Nationalist Party said on Saturday that if elected her party would ensure real autonomy for the central bank.

"There will be no interference or influence from the political party," Begum Khaleda Zia said at a party conference.

A central bank official said two engineers from secure network operator SWIFT (the Society for Worldwide Interbank Financial Telecommunication) had started tests on Saturday.

He said the system would be upgraded if needed.

"Bangladesh is a member of the SWIFT society, so we use its service for international transactions," the official added.

(Reporting by Serajul Quadir; Editing by Ros Russell and Catherine Evans)

source: www.abs-cbnnews.com