Bangladesh Bank: fake orders leave from a real central bank

In February 2016, orders were issued to transfer nearly $1 billion from Bangladesh’s central bank account in New York. Most of them do not succeed. But $81 million goes to accounts in the Philippines and enters a money laundering circuit.

The U.S. investigation describes a compromise of the bank’s network from targeted emails. Attackers reach the stations used to communicate with SWIFT, the messaging system for international payments. They produce fraudulent orders from an environment that actually belongs to the victim.

This is not to say that the entire SWIFT network has been broken. The problem is with an authorized end of this network: if the intruders can impersonate the bank there, the messages look like the ones a bank would normally send.

Malware scans also describe functions intended to hide or alter local traces of operations. Detection and cross-location checks end up revealing fraud, but time zones, schedules, and bleaching steps make it difficult to respond.

US authorities link the operation to a conspiracy of North Korean hackers associated with the Lazarus group. Prosecutions and recovery attempts followed in several countries. Amount requested, money actually transferred and are then recovered are three different balance sheets.

The case has become an example of fraud made possible by a hijacked institutional identity. The message did not need to come from a fake bank: it could leave the real one, after an intruder had taken its place in front of the right tools.