Once upon a time there was an advertising campaign for Michelob beer that said “Weekends were made for Michelob.” I thought about that iconic phrase when reading about the initial investigations around the fraudulent transfer of money from the bank account of the Central Bank of Bangladesh, out of the Federal Reserve Bank of New York, in a recent piece in the Wall Street Journal. 

The theft occurred in early February, but here is where it gets very interesting. The money was wired out from the Fed on a Friday. In Bangladesh, the weekend is Friday and Saturday. It turned out that the Fed had sent out 35 separate requests for confirmation that the requests were legitimate and requesting the Bangladesh central bank to reconfirm the initial requests to transfer the money. However, “The computer terminal that connected Bangladesh’s central-bank computers to the secure interbank messaging system knows as Swift was  ‘unresponsive’ on Feb. 6, the morning after the theft, a senior official working at the bank’s secure server room said in the police report seen by The Wall Street Journal.” Moreover, “According to the report, Zubair Bin Huda, the senior official in charge of the glass-walled server room—known as the “Dealing Room”—was concerned when a printer connected to the terminal couldn’t print out the interbank messages received during the night.”

It was not until the Bangladesh workweek began on Sunday that Bangladesh central bank employees hooked up a backup server and printed out all the 35 messages from the New York Fed. They were able to stop the fraudulent transfers at that point, thus averting another set of transfers for $950 million, but $101 million had already been transferred out. The Bangladesh Central Bank then sent out urgent messages to the Philippines Central Bank requesting that it freeze four accounts where the money had been sent, but by then it was too late.

This was clearly a very sophisticated crime, with many moving parts. However, the basic timing is something that companies need to consider as a risk going forward. Have you thought about getting a request to make a payment late Friday suspicious? Now how about a payment that is going to a country where the weekend starts on a day other than Saturday? Maybe weekends should be considered for fraud, instead of a cold beer.

Topics