Beyond cheap routers and rickety firewalls

The world's worst-ever cyber heist at Bangladesh Bank (BB) keeps hitting international headlines due to this crime's extreme nature. BB, the victim, gets disproportionate global media coverage. The Bangladeshi officials' poor communication skills, especially on a crisis of such magnitude, feed the hungry media. There is, however, hardly any word from other crime scenes in New York.

Bangladesh Bank is a client of the Federal Reserve Bank of New York (NY Fed). While settling foreign debts, BB instructs NY Fed to disburse specific amounts to designated beneficiaries' bank accounts. Such instructions are exchanged through a secured global banking messaging system called SWIFT (Society for Worldwide Interbank Financial Telecommunication). This cooperative entity is supervised by 20 of the world's largest central banks. SWIFT connects about 11,000 financial institutions globally that use it to order transactions.

On February 4 and 5, the NY Fed received 35 separate payment orders, totaling US$951 million, from its client in Bangladesh. Authenticating the payments by BB before processing the transaction is part of standard operating procedure for the NY Fed. Since February 4 and 5 was a weekend in Bangladesh, the BB could not authenticate the payment orders.

Yet the NY Fed went ahead with releasing $81 million to the Philippines and $20 million to Sri Lanka through five payment orders. As these payments progressed, the computerized scanner of NY Fed had detected a spelling error in the Sri Lanka-bound $20 million payment order. Right away, alarm bells began to ring. The NY Fed put a stop to the processing of the remaining 30 payment orders of the $850 million. This is how 89 per cent of the hacked amount was saved from falling into the robbers' hands.

Later BB could recover $20 million from Sri Lanka while the $81 million has disappeared into the Philippines' murky banking systems. The world and especially its financial systems remain shaken against the background of this banking heist by hackers. However, a few important questions have remained unanswered by the NY Fed. Additionally, significant facts have remained undisclosed by U.S. investigators.

Why did the NY Fed process the five payments without authenticating them with BB? Why was the Sri Lanka-bound payment processed after the detection of a typo in the beneficiary's name? Why did the NY Fed not alert BB via all possible communications channels about the heist? And finally, why did the NY Fed not ask the central banks of Sri Lanka and the Philippines to freeze the amounts it had already pumped?

These measures have nothing to do with technological excellence or bureaucratic supremacy. It is all about commonsense. The NY Fed holds trillion dollars of funds belonging to some 250 foreign central banks, including BB, and various governments. Every day it deals with about $80 billion of payments to and from the clients' accounts through 2,000 transactions. This is a commercial service the NY Fed offers  its clients. Therefore, it cannot deny its responsibility in releasing $101 million from BB's account to the Philippines and Sri Lanka.

The hackers' $951 million worth 35 payment orders correspond to four per cent of the national reserve of Bangladesh. Presumably there were also genuine payment orders of unknown amounts from BB before that specific weekend of February 4 and 5.

If all the payment orders are blended, the NY Fed clearly ended up receiving more than a billion dollars disbursement requests from its Bangladesh client on that given day. It is unclear how frequently BB asks NY Fed to move more than one billion dollars in a day.

Banking is not merely crunching the numbers or using sophisticated technologies. Human intelligence still remains central to global financial systems. The NY Fed should clarify the extent of human skills it applies while processing billions of dollars of payments every day. The "fat tail risk" of SWIFT or cheap router and weak firewall at Bangladesh Bank will certainly be investigated with due importance.

But the NY Fed, as custodian of the fund, must clarify why it had processed the first five payment orders without the orders being authenticated by Bangladesh Bank in the first place. US Congresswoman Carolyn Maloney has also demanded similar explanations in a strongly-worded letter to the New York Fed.

The Fed must answer.