Hackers have carried out a series of successful raids on banks via the Swift global payments network, the organisation has warned its members this week as it pushes them to tighten their cyber security.
In a letter seen by the Financial Times, Swift told its 11,000 members that “a good number” of the attacks had been repelled after being spotted by its own security programme or by other banks, but some of the hackers had made off with an unspecified amount of cash.
The non-profit co-operative, which is owned by the banks, has faced concerns about its vulnerability after cyber criminals made off with $81m from the Bangladeshi central bank in February. Several similar cases, some of which were successful, have since emerged at banks in Vietnam, the Philippines and Ecuador.
Swift — the Society for Worldwide Interbank Financial Telecommunication — warned its members that while there had been fewer publicly reported cases of banks being attacked, hackers were still on the hunt for weaknesses in their security systems.
“We have seen new cases of input fraud since we last wrote to update you on these issues,” Swift said in its letter. “The attackers have followed a broadly similar modus operandi, but have specifically tailored every attack to each individual target.”
How cyber criminals targeted almost $1bn in Bangladesh Bank heist
Theft sends tremors around the world among banks and large corporations that keep big balances
The letter added: “The customers that have been targeted have varied in size and geography; used diverse connectivity methods and a range of interfaces from different vendors. The targeted customers have, however, shared one thing in common; they have all had particular weaknesses in their local security.”
Swift declined to comment on the letter or to say which banks had been victims of the new attacks. Its letter said: “Fortunately a good number of these attacks have ultimately been thwarted.”
In some cases, the correspondent banks that received the fraudulent payment messages spotted something suspicious and blocked the transfers, Swift’s letter said. In other cases, a new package of security measures that it has put in place recently helped to thwart the attempted robberies.
Regulators across the world have been alarmed by banks’ vulnerability to being hacked and having money stolen over the Swift network.
The US Federal Reserve in June called on banks to review their defences against fraudulent money transfers. The Fed was itself caught out in February, when hackers gained access to the Swift codes of Bangladesh’s central bank and tried to transfer $951m from its accounts at the Fed, before making off with $81m.
To help banks fight the hackers, Swift recently established a “customer security intelligence team” that combines its own cyber security experts with specialists from consultants BAE Systems and Fox-IT.
This team both investigates cases of security breaches at Swift members and provides them with details of earlier cyber heists on other banks, while advising them on how to protect themselves from similar attacks.