Sri Lankan teller helps bust world’s biggest bank fraud

Sri Lankan authorities have launched a massive probe into a dubious NGO here that tried to sneak in millions of US dollars stolen by Chinese hackers from the Bangladesh Central Bank, government officials here said, adding that this is part of a global crackdown on a money laundering scam.

They said the scam, which hit media headlines across the world, was thwarted two weeks ago by an alert teller at the Colombo branch of a foreign bank when an inward remittance of about $25 million appeared to be suspicious.

The officials, who declined to be named, said a major probe was underway by the CB to ascertain the background of the intended receiver of the funds. “We found that the recipient NGO Shalika Foundation had been registered here by some outside parties who have now gone back. We are also probing whether there were any other funds that came from the source (hack-in) and had slipped through the radar here.”

Several NGO heads and activists said they had never heard of the Shalika Foundation. “Never heard of it,” said Dr. Vinya Ariyaratne from Sarvodaya.  News of the theft, however, broke only this week, several days after the Sri Lankan teller’s query tipped off the US Federal Reserve, Bangladeshi authorities and the local Central Bank (CB),

exposing a near US$1 billion theft through hacking, the biggest ever hack-in of bank funds in world history.
CB Governor Arjuna Mahendran yesterday confirmed to the Sunday Times that “it was the Sri Lankan teller that alerted the US, Bangladesh and us (and the world) over a suspicious transaction”.

Worldwide media reported this week how Chinese hackers broke into the systems of the Bangladesh Central Bank titled the Bangladesh Bank, stole credentials for payment transfers and then sent, pretending to come from a Bangladeshi official, three dozen requests to the Federal Reserve Bank of New York to move money from the Bangladesh CB account to entities in the Philippines and Sri Lanka.

The money was said to have been transferred to casinos in the Philippines and Sri Lanka.

The suspicion of the local teller was alerted when the recipient’s name was misspelt as Shalika “fandation (instead of ‘foundation’)”. This led to a query under international money laundering rules governing banks which requires strict compliance by banks to ensure transfers are not linked to terrorism, criminal activity or corrupt sources.

The Sri Lankan teller’s prompt discovery and alerting global and local authorities may have also been as a result of lessons learnt from a recent fiasco over Finance Minister Ravi Karunanayake’s invitation to remit foreign funds to Sri Lanka under a ‘no questions asked’ policy.Some weeks ago, a flustered minister, joined by a CB official at a hurriedly-held media briefing, vehemently denied that the CB had issued a new gazette bringing in fresh restrictions on inward remittances, the contents of which had been reported in the Sunday Times. A week after the paper published more details of the gazette, the CB admitted that it had erred in issuing this notification.

At the same time, bankers, as reported by the Business Times, refused to abide by the ‘no questions asked” policy, saying they must adhere to strict international banking rules that govern incoming and outgoing transactions. Subsequently, bankers told the minister at a meeting — also reported by the Business Times — that it was not possible to accede to his request to allow upto $1 million without too many questions and apply the usual scrutiny for anything above this amount.

While initially US$100 million was planned to be transferred in the global hacking drama, the hackers were only able to spirit away about US$80 million because the Sri Lankan transaction was suspended.

Mr. Mahendran said while the amount being transferred to Sri Lanka was around $25 million, the entire hacking episode appears to be in the region of $800 million.

He said the transfers were being made every Friday which is a holiday in Bangladesh to escape detection.Central banks of many countries, including Sri Lanka, have billions of funds with the US Federal Reserve (the US Central Bank), through investments in US bonds and other instruments. It was these funds that the hackers got access to and planned to wipe out a total of $1 billion after breaking into the Bangladesh CB’s credentials and payments codes and instructing the US Fed to pay various sources in other countries using codes and credentials which the US Fed would recognise and not ask too many questions.

(Source: The Sunday Times – By Feizal Samath)