The bank heist stopped by a spelling mistake

The story

Bangladesh Bank, the country’s central bank, kept money in an account at the Federal Reserve Bank of New York. Payments from it were sent through SWIFT, the system banks use to send each other instructions.

Attackers broke into Bangladesh Bank’s network and watched how staff made payments. They got the credentials needed to send instructions. On February 4 and 5, 2016, while the bank was closed for the weekend, they sent 35 payment orders, worth close to a billion US dollars, to accounts in the Philippines and Sri Lanka.

They also tampered with the printer that produced the bank’s paper record of payments, so staff would not see what had been sent.

The Federal Reserve blocked most of the orders. One payment was stopped partly because the name of the receiving organization was misspelled, which caught a bank’s attention. Five went through. Some of the money was recovered; much of what went to the Philippines disappeared through casinos.

Why it mattered

It showed that attackers could use a bank’s own trusted messaging system to move money between central banks. The US later charged a North Korean programmer over the attack. SWIFT, the network involved, set up a security program for the banks that connect to it, and banks everywhere took a harder look at how payment instructions are checked.

The lesson today

The attackers used real credentials on a real system, timed for when nobody was watching. Smaller businesses face the same pattern: a compromised email or banking account used on a Friday afternoon. Payment approvals by a second person and alerts for unusual activity close that gap.