Nepal bank latest victim in heists targeting SWIFT system

KATHMANDU - A bank in Nepal is the latest victim in a string of cyber heists targeting the global SWIFT bank messaging system, though most of the stolen funds have been recovered, 2 officials involved in the investigation confirmed on Tuesday.

Hackers last month made about $4.4 million in fraudulent transfers from Kathmandu-based NIC Asia Bank to countries including Britain, China, Japan, Singapore and the United States when the bank was closed for annual festival holidays, according to Nepal media reports.

All but $580,000 of the funds were recovered after Nepal asked other nations to block release of the stolen money, Chinta Mani Shivakoti, deputy governor of the Central Nepal Rastra Bank (NRB), told Reuters.

Brussels-based SWIFT said last month that security controls instituted after last year's $81 million theft from Bangladesh's central bank helped thwart some recent hacking attempts, but it warned that cyber criminals continue to target SWIFT customers.

SWIFT or the Society for Worldwide Interbank Financial Telecommunication is a co-operative owned by its user banks. It declined to comment on the NIC Asia Bank hack, saying it does not discuss specific users.

Representatives with NIC Asia Bank, one of dozens of private banks in Nepal, were not available for comment.

The chief of Nepal's Central Investigation Bureau, Pushkar Karki, confirmed to Reuters that his agency was investigating the theft.

KPMG is also involved in the investigation, according to Nepali media reports. KPMG representatives could not immediately be reached for comment.

The central bank intends to release guidelines on how to thwart such incidents after investigations are completed, according to Shivakoti.

"The incident showed there are some weaknesses with the IT department of the bank," Shivakoti said.

SWIFT said in a statement on Tuesday that it offers assistance to banks when it learns of potential fraud cases, then shares relevant information with other clients on an anonymous basis.

"This preserves confidentiality, whilst assisting other SWIFT users to take appropriate measures to protect themselves," it said.

"We have no indication that our network and core messaging services have been compromised," SWIFT added.

source: news.abs-cbn.com

SWIFT says second bank hit by malware attack

SWIFT, the global financial messaging network that banks use to move billions of dollars every day, warned on Thursday of a second malware attack similar to the one that led to February's $81 million cyber heist at the Bangladesh central bank.

The second case targeted a commercial bank, SWIFT spokeswoman Natasha de Teran said, without naming it. It was not immediately clear how much money, if any, was stolen in the second attack.

While SWIFT had previously warned that the Bangladesh heist was not an isolated incident, and said its core messaging system remained intact, confirmation of a second attack on a bank will likely increase scrutiny on the security of a network that is a linchpin of the global financial system.

SWIFT said in a statement that the attackers exhibited a "deep and sophisticated knowledge of specific operational controls" at targeted banks and may have been aided by "malicious insiders or cyber attacks, or a combination of both."

The organization, a Belgian co-operative owned by member banks and used by 11,000 financial institutions globally, said that forensic experts believe the second case showed that the Bangladesh heist "was not a single occurrence, but part of a wider and highly adaptive campaign targeting banks."

News of a second case comes as authorities in Bangladesh and elsewhere investigate the February cyber theft from the Bangladesh central bank account at the New York Federal Reserve Bank. SWIFT has acknowledged that that scheme involved altering SWIFT software to hide evidence of fraudulent transfers, but that the messaging system it controls was not compromised.

In both cases SWIFT said insiders or cyber attackers had succeeded in penetrating the targeted banks' systems, obtaining user credentials and submitting fraudulent SWIFT messages that correspond with transfers of money.

In the second case SWIFT said attackers had also used a kind of malware called a "Trojan PDF reader" to manipulate PDF reports confirming the messages in order to hide their tracks.

source: www.abs-cbnnews.com

Osmena grills RCBC lawyer on bank secrecy law

MANILA - Senator Serge Osmeña and Macel Fernandez-Estavillo, head of RCBC's legal and regulatory group, got into a heated debate about the country's bank secrecy law, which Estavillo said hinder the bank from discussing details of the deposits linked to the $81-million money laundering heist.

At the resumption Tuesday of the Senate Blue Ribbon committee inquiry into the heist, Osmeña grilled Estavillo on the bank's role in the transaction of stolen funds from the account of the Bangladesh Bank.

Estavillo said that under the bank secrecy law, RCBC has to protect the rights of its clients and therefore could not speak about the deposits.

However, Osmeña argued that the owners of the accounts are fictitious, which means there is no client to protect.

“We understand that RCBC has already found out that those five accounts don’t exist—these persons don’t exist. So therefore, there is nobody to protect,” the senator said.

Estavillo said the bank would still need a court order determining that the accounts are indeed fictitious. She said the bank is unable to discuss specific deposits because all deposits are confidential under the bank secrecy law.

“The law gives the bank an absolute obligation unless there are exceptions, apart from the knowing voluntary and written consent of the depositor, banks may actually be required to divulge information in certain instances like impeachment, bribery, dereliction of duty of public officials, there are specific cases,” she said.

Estavillo added that the bank did not have the power to freeze the million-dollar deposits nor did it need to raise the matter to the bank's top officials.

"If we have ample notice, the only rights that are given to us would be to file an [STR] suspicious transaction report...we can only hold it for a period. Under the law, we have not been given any right to retain the funds," she said.

To which Osmeña responded, "I’m afraid many bankers will disagree with you."

The senator said he has talked to several bankers and the consensus he received was that "they would exercise discretion and stop [the transaction]."

Estavillo said, however, that the law applies to all banks and “that’s why it would be good to amend the laws to give more teeth to the banks because even the regulators do not have that authority."

"I wish that it would be the case because it would make our jobs easier," she said.

'IT AND HUMAN FAILURE'
RCBC president and chief executive (on leave) Lorenzo Tan, meanwhile, believes the anomalous transaction pushed through due to both human and computer failure.

He said the bank's threshold of suspicious transactions is at P1 billion (about $20 million), but it still depends on the "instincts" of bank employees in determining what transactions to report.

“Thresholds can only give you protection at a certain point because people will find out what your threshold is and they will remit below that,” Tan told the senators at the hearing.

“What will really catch dirty money is having intelligent systems in your bank, like what you have in global banks today. Even if you have modern software, you still need instincts to kick in—your compliance people, your operations people, your sales people, they all have to use their judgment,” he added.

Tan again apologized that its staff have been linked to the scandal, but said it "can happen again" unless stricter measures and a more advanced computer system are put in place.

“We have the IT controls and the human controls, and unfortunately, it failed in the end in the execution,” Tan said.

"This experience, we have made changes to our present system to prevent this from happening again. If you ask my opinion, it can happen again. Philippine banks have to upgrade to cognitive systems. We have to look at our employee behavior, what time do they go in and what time they go out, what they do outside.
We have to look at transaction behavior. Only computers can do that. If you have a bank and envision 20-40 million customers times x number of transactions per second, there is no way you can have human intervention along the way."

The bank earlier issued an apology to the public after its employees were linked to the $81-million money laundering heist.

It added that it is conducting its own inquiry to identify and address any weaknesses in its controls and operations, and it will take appropriate actions against any bank officer or staff found guilty of negligence.

source: www.abs-cbnnews.com

Kim Wong tags 2 foreigners in $81-M heist

MANILA - Casino junket operator Kim Wong on Tuesday washed his hands of the $81-million laundering heist and instead blamed dismissed Rizal Commercial Banking Corp. (RCBC) branch manager Maia Santos-Deguito and two foreigners.

Speaking before the Senate, Wong said one of the two foreigners was a junket operator and a "high-roller" in the casino industry.

“Dalawang foreigners ang nagpasok ng $81 million. Isa sa kanila ay matagal ng labas-pasok sa Pilipinas at kilalang junket agent at isang high roller,” he said.

Wong said he had prepared for the Senate a sealed envelope containing copies of the passports of the two foreigners.

Senators prodded him to open the envelope and disclose the names of the two foreigners. Wong later identified the two as Gao Shuhua from Beijing and Ding Zhize from Macau, China.

Wong said Gao had been his "junket agent" since 2007. He also said Gao once lost P450 million during a week of gambling in Solaire.

He also claimed that Deguito alone approved the documents for the RCBC dollar accounts opened in May 2015, which received the stolen funds from the Bangladesh Bank in February 2016.

Wong added that he only referred one foreigner - Gao - to Deguito, contrary to her earlier claim that she met the owners of the four dollar accounts at Solaire casino through Wong's referral.

Wong said he met Deguito and Gao at his office in Solaire in 2015 to open the dollar account.

During their meeting, Wong claimed that Deguito suggested a corporate account and that she needed the names of 5 people to open the account. He also claimed that Deguito asked for $2,500 to open the accounts, which Gao approved.

DAY OF HEIST

In his testimony, Wong claimed that he received a message from Gao on February 4, 2016 about his plan to invest in the Philippines.

He said Gao wanted to close his souring casino business in Macau and invest instead in casino junkets in Manila.

The next day, Wong said he received instructions from Gao and Ding that they would be getting a huge amount of money in the dollar accounts in Deguito's branch. When Wong initially checked with Deguito, however, the money had not come in.

Deguito then called several times to say that several dollar deposits - $6 million, $25 million, $30 million and $20 million - had come in.

This jibes with the account of Sen. Teofisto Guingona III that a total of 35 payment instructions came out allowing the transfer of funds from the Bangladesh Bank account in the New York Federal Reserve. Only five payment instructions, however, were allowed before the transactions were stopped.

$850-M could have entered RCBC: Senate

Wong said of the $81 million stolen funds, an estimated $63 million went to Solaire while an estimated $17 million went to Philrem.

Wong said at least 80 million pesos in cash were then delivered by Philrem's Concon Bautista and another 20 million pesos in cash by Deguito on the same day, February 5.

Philrem president Salud Bautista, however, said she personally delivered 80 million pesos, and not 90 million pesos, to Solaire. She said the money was received by Weikang Xu, who has been described as a "registered" junket agent in the gaming business.

WONG PICKED UP MONEY AT BAUTISTA'S HOUSE

During the hearing, Wong showed a photo of Deguito's car being serviced by the valet at Solaire at 7:57 p.m. on February 5.

He also showed a photo of the 100 million pesos being deposited at Solaire at 8:07 p.m. Wong said he took the photo himself.

After the transaction, Wong claimed he had dinner with Deguito and Concon Bautista at a Korean restaurant inside Solaire.

He said he also picked up a total of 300 million pesos and $5 million in cash from Bautista's house on February 9, February 10, and February 14.

The 300 million pesos went to a junket agent in Solaire, Wong said.

He said Gao and Ding wanted the $5 million to themselves, which he said was not part of the deal.

"Ang gentlemen's agreement, walang kukuning cash. Wala sa rules eh. So kaya natira ang $4.63 million dahil nag-aaway na kami. Ang kinuha nila $370,000. Nagagalit na ako kasi wala sa usapan na kukuha ng cash. Kasi itong negosyo namin usapan lang eh, tiwala lang. Sabi ko, 'Niloloko niyo na ako,'" he said.

Wong claimed the $4.63 million was still in safekeeping at Solaire and that he is willing to return the money to the Bangladesh Bank.

source: www.abs-cbnnews.com

Bangladesh asks NY Fed, PH to help retrieve stolen money

DHAKA -- The new governor of Bangladesh's central bank has sent formal letters to the New York Fed, as well as central bank and money laundering chiefs in the Philippines, asking them to help recover its stolen $81 million, a senior central bank official said on Sunday.

The news came as Finance Minister Abul Maal Abdul Muhith said the government was waiting to hear the recommendations of an investigation committee to decide whether the central bank should file a suit against the Fed after one of the biggest cyber heists in history.

Unknown hackers breached the computer systems of Bangladesh Bank in early February and attempted to steal $951 million from its account at the Federal Reserve Bank of New York, which it uses for international settlements.

Some attempted transfers were blocked, but $81 million was transferred to accounts in the Philippines belonging to casino operators.

The central bank official told Reuters that Fazle Kabir, who became governor a week ago, had asked the NY Fed chief and the heads of the Philippines central bank and money laundering agency to assist Bangladesh in retrieving the funds.

Kabir asked the Fed to investigate if there had been any lapses or whether it had any involvement in the heist, the official said.

Kabir sent separate letters to the ambassador of Bangladesh at the U.N. headquarters, and its permanent representative, urging them to pursue the NY Fed.

The previous central bank governor, Atiur Rahman, resigned earlier this month after details emerged in the Philippines that $30 million of the money was delivered in cash to a casino junket operator in Manila, while the rest went to two casinos.

"In his letters the new governor sought all kind of help from them to retrieve the stolen money as we are following multiple efforts for the sake of the country," the official said.

Last week Bangladesh also formally sought assistance from the U.S. Federal Bureau of Investigation to track down the cyber crooks.

Bangladesh has appointed law firms to weigh its options vis-à-vis the NY Fed.

"We will wait till the recommendations of the government- formed investigation committee," Finance Minister Abul Maal Abdul Muhith told Reuters on Sunday, referring to a three-member committee headed by Mohammad Farash Uddin, a former central bank governor.

"We will act as per its recommendations."

Earlier this month Muhith said Dhaka might resort to suing the Fed to recover the money: "The Fed must take responsibility," he said.

source: www.abs-cbnnews.com

Bangladesh seeks FBI's help in investigating central bank heist

DHAKA - Bangladesh has formally sought assistance from the U.S. Federal Bureau of Investigation to track down the cyber crooks who stole $81 million from its central bank's U.S. account, the interior minister said on Saturday.

Unknown hackers breached the computer systems of Bangladesh Bank in early February and attempted to steal $951 million from its account at the Federal Reserve Bank of New York, which it uses for international settlements.

Some attempted transfers were blocked, but $81 million was transferred to accounts in the Philippines in one of the largest cyber heists in history.

The central bank governor resigned on Tuesday, as details emerged in the Philippines that $30 million of the money was delivered in cash to a casino junket operator in Manila, while the rest went to two casinos.

"We sought the FBI's assistance when a group of FBI met with me for investigating the central bank heist last month," Interior Minister Asaduzzaman Khan told Reuters.

An U.S. embassy official in Dhaka told Reuters Washington stood ready to assist the government of Bangladesh in its investigation.

A senior police official involved in the investigation said that an FBI team was expected to visit the Criminal Investigation Department (CID) of police in Dhaka on Sunday. The CID was also coordinating with Interpol to track down the perpetrators.

"We are trying to find out what type of security there was, what safety measures were taken, and how the thieves penetrated the fire wall," he said.

The chief of the main opposition Bangladesh Nationalist Party said on Saturday that if elected her party would ensure real autonomy for the central bank.

"There will be no interference or influence from the political party," Begum Khaleda Zia said at a party conference.

A central bank official said two engineers from secure network operator SWIFT (the Society for Worldwide Interbank Financial Telecommunication) had started tests on Saturday.

He said the system would be upgraded if needed.

"Bangladesh is a member of the SWIFT society, so we use its service for international transactions," the official added.

(Reporting by Serajul Quadir; Editing by Ros Russell and Catherine Evans)

source: www.abs-cbnnews.com

Faulty printer implicated in $81-M bank heist

DHAKA, Bangladesh - A printer fault at Bangladesh's central bank meant that overseas queries about suspicious transactions went unanswered, according to a report seen by AFP Wednesday on the $81 million cyber heist that sent shockwaves through the banking world.

The report, filed to police on Tuesday, recounts the events leading to the discovery of the dramatic theft from an overseas account of Bangladesh Bank.

It says that because of a printer and software problem, it took the Bangladesh central bank nearly four days to ask banks across the globe to halt payments to the hackers.

They tried to steal around $1 billion and got away with $81 million from the impoverished country's coffers.

How a hacker's typo helped stop a billion dollar bank heist

Central bank governor Atiur Rahman and two of the deputy governors have lost their jobs over the scandal, which has hugely embarrassed the government and raised alarm over the security of the country's foreign exchange reserves of over $27 billion.

On Wednesday the government, which has said it was kept in the dark about the losses for weeks, also removed its most senior banking official M. Aslam Alam from his position.

The hackers managed to transfer $81 million on February 5 -- a Friday, when Bangladesh Bank is closed -- from its account with the Federal Reserve Bank of New York, transferring the cash electronically to accounts in the Philippines.

In the report seen by AFP, the bank's joint director Zubair bin Huda said engineers were unable to fix the printers until February 6, a day after the New York bank sent queries about four separate transactions.

"Since such glitches happened before, we thought it was a common problem just like any other day," Huda said in the report.

Bangladesh Bank tried to contact New York on February 6 by email, fax and phone to ask that the transactions be suspended when it realized that the SWIFT interbank messaging system which it normally used was not working properly, Huda said.

"We realized that the SWIFT system being ineffective was an important issue, and therefore we sent an email to Federal Reserve Bank of New York at 1:30pm on February 6 to halt all types of payment processing," he said.

But they were unable to get through as the US bank was closed for the weekend.

It was not until Monday afternoon that the central bank's main server was again working properly and officials were able to send the formal requests to stop the payments to six banks across the globe.

But by that time $81 million had been transferred from Bangladesh Bank's New York account to a bank in the Philippines.

PHILIPPINES ACCOUNT

The money was later transferred to an account belonging to ethnic Chinese businessman William So Go, a Philippine Senate committee heard this week.

The money was then transferred to Philippine casinos, Julia Bacay-Abad from the Philippines' anti-money laundering council told the hearing on Tuesday.

Go's lawyer said the businessman's signatures for his now-frozen RCBC account, which were used to transfer the money, had been forged.

'Money trail in laundering scam ends with casinos'

Casino junket operator got $30-M in cash

Another transfer of $20 million was halted by a bank in Sri Lanka at Bangladesh Bank's request.

As details of the scandal emerged last week, Bangladesh Finance Minister A.M.A. Muhith threatened to sue the New York Fed.

The US-based bank said in a statement on its website that the payment instructions "were fully authenticated by the SWIFT messaging system in accordance with standard authentication protocols".

LACK OF TRANSPARENCY

Meanwhile, the $81 million heist has also put a spotlight on the Philippines' strict bank secrecy law. Finance Secretary Cesar Purisima earlier said the Philippines along with Lebanon are some of the only countries in the world left with a bank secrecy law.

Even Switzeland, which is known for its strict banking system, has been open to relax the law.

PH one of few countries with bank secrecy law

According to a law enacted in 1955, all bank deposits in the Philippines are absolutely confidential and may not be examined "except upon written permission of the depositor, or in cases of impeachment, or upon order of a competent court in cases of bribery or dereliction of duty of public officials, or in cases where the money deposited or invested is the subject matter of the litigation."

Last year, Internal Revenue Commissioner Kim Henares said the government is preparing a draft bill that would lift or ease the bank secrecy law to strengthen government's tax collection efforts. Congress, however, thumbed it down.

Makati Business Club chairman Ramon del Rosario said he found it "uncomfortable" that the bank secrecy law was invoked during the Senate investigation on the $81 million heist.

Senator Sergio Osmena III said the international financial community has already taken notice of loopholes in Philippine laws.

"As far as I am concerned, sunlight is the best medicine. Transparency in a democratic setting is the best safeguard against corruption and against bad public officials," he said.

“Despite all the warnings from the FATF (Financial Action Task Force), we still don’t have the political will to plug those loopholes. I hope that this will teach us a lesson because the international financial community has just taken notice of how big our loopholes are and it’s become an international incident because [81 million] dollars was hacked from the account of Bangladesh Central Bank and laundered through the Philippine financial system." With Agence France-Presse

Osmena: Political will needed to plug laundering loopholes

source: www.abs-cbnnews.com