Lawsuit Against Wells Fargo Claims Lapses in Another Global Banking Hack

The February cyberheist involving Bangladesh Bank has elevated concerns about the security of the global finance system in the face of persistent cyberattacks. Details of another bank being victimized more than a year earlier is likely to increase those concerns, especially since overseers of the international payment system said that they were unaware of the attack.

A third attack from December 2015 at a commercial bank in Vietnam was detailed last week by the Society for Worldwide Interbank Financial Telecommunication, or Swift. That bank detected the fraudulent requests and stopped the movement of funds, the central bank in Vietnam said.

In the January 2015 Ecuador hack, as with the February 2016 Bangladesh case, hackers managed to get the bank's codes for using Swift, the global bank messaging service, to procure funds from another bank, according to court papers.

A spokeswoman for Swift said Thursday that the network was never told of the earlier hack. "We were not aware,'' said Natasha de Teran, the spokeswoman. "We need to be informed by customers of such frauds if they relate to our products and services, so that we can inform and support the wider community. We have been in touch with the bank concerned to get more information, and are reminding customers of their obligations to share such information with us.''

The Ecuadorean bank, Banco del Austro, filed a lawsuit in New York federal court earlier this year, accusing Wells Fargo Bank of failing to notice "red flags'' in a dozen January 2015 transactions and to stop them before the thieves transferred about $12 million, most of it to banks in Hong Kong.

...

It is unclear whether there is a connection between the hacking heists carried out against the Ecuadorean bank and those in Bangladesh and Vietnam. There are similarities in method, including thieves accessing the bank's system to log on to the Swift bank messaging network, and doing so after banker's hours, apparently to reduce the likelihood that someone would ask questions about specific transactions.