Bangladesh’s missing millions

Failure to publish a report stokes a bank-heist scandal

The government claims releasing the report would undermine efforts to retrieve the money

 

Sep 23rd 2016 | DHAKA | THE ECONOMIST
THIS week Bangladesh’s government was scheduled to make public the findings of a probe into one of the most spectacular robberies in modern times: the attempted theft in February of nearly $1 billion from accounts of Bangladesh Bank, the central bank, that were held at the Federal Reserve Bank of New York. In the end, the government chose to keep the report under wraps. On September 21st, a day before the planned release, A.M.A. Muhith, the finance minister, postponed its publication. Mr Muhith said making it public now would undermine efforts to retrieve the $81m that is still missing. Much of the money the thieves managed to prise from Bangladesh Bank ended up in the Philippines. The government is seeking to get it back through negotiation or legal action.

On September 19th a regional court in the Philippines ordered the country’s central bank, which had received a portion of the stolen money, to return $15m. The money is yet to make it to Dhaka; the Bangladeshi government is keen to retrieve the rest from the financial underbelly of the Philippines (much of it flowed through casinos in Manila). The country’s president, Rodrigo Duterte, has promised to help.

The word in Dhaka is that the report was kicked into the long grass because it hinted at a link between Bangladesh Bank employees and the hackers. This is indeed what the report, submitted to Mr Muhith’s ministry in May, had suggested. Yet the finance ministry has consistently blamed outsiders: hackers, the New York Fed and SWIFT, the messaging network for cross-border payments on which the transactions took place.

Since the heist became public knowledge through media reports in the Philippines, nearly a month after it happened, two theories have been suggested to explain how the thieves managed to send the New York Fed 35 properly authenticated SWIFT transfer orders. (The Fed executed five, leading to a transfer out of Bangladesh Bank accounts of $101m to the Philippines and Sri Lanka; officials have been able to claw back $20m from the latter.)

The first holds that it was possible to hack into the SWIFT systems at Bangladesh Bank and issue transfer orders without the physical presence of a person inside the central bank. Few find this credible. If it turns out to be possible, it would be worrying for the global payments system: SWIFT covers half of all big cross-border transfers. To issue transfer orders via SWIFT, tight security protocols must be followed, including possession of a physical key (a so-called dongle) to authorise transfer orders, long passwords and biometric access control.

The other view—not favoured by the finance ministry or Bangladesh Bank—holds that physical presence at the SWIFT terminals within Bangladesh Bank was required to issue the transfer orders and that the heist must therefore have been at least partly an inside job: a collaboration of hackers and central-bank employees or other individuals who had access to the central bank’s terminals.

This is the line of inquiry that Bangladesh’s sleuths are pursuing while the politicians stonewall. Bangladesh police’s Criminal Investigation Department (CID) reckons SWIFT staff or consultants who installed the central bank’s systems had a hand in the theft (or were at least negligent); SWIFT denies this. The CID’s attempts to arrange a tête-à-tête in Dhaka with these individuals—Indian and Sri Lankan nationals—have been unsuccessful. The search for the elusive robbers continues.