The 1994 bank heist done from a computer in St. Petersburg

The story

In 1994, Vladimir Levin, a computer programmer in St. Petersburg, Russia, accessed the accounts of several large corporate customers of Citibank. He used the bank’s dial-up service that let business customers send wire transfers.

Money was moved to accounts set up by accomplices in Finland, the United States, the Netherlands, Germany and Israel. Citibank noticed, and accomplices were arrested when they tried to withdraw the money. Their questioning led to Levin.

Russia did not extradite its citizens, so he was arrested in March 1995 while changing planes at Stansted Airport near London. He was sent to the United States, pleaded guilty and went to prison. Most of the money was recovered.

Years later, members of a St. Petersburg hacking group claimed they had found the way into the bank first and sold the access details to Levin.

Why it mattered

It showed that letting customers move money from afar also let anyone holding their sign-in details do the same. Citibank responded by adding a physical sign-in device for those customers, an early version of the second sign-in step that banks now expect everywhere.

The lesson today

Nobody defeated a vault. Someone had the right sign-in details, and that was enough. That is still how most fraud against businesses works today: stolen passwords, used on systems that send money. A second check at sign-in, and a second person approving payments, stops most of it.