New York Fed moved $81 mn after rejecting cyber-heist transfers

The New York arm of the US central bank initially denied the transfer requests because they lacked proper formatting for the SWIFT system

Hours before the Federal Reserve Bank of New York approved four fraudulent requests to send $81 million from a Bangladesh Bank account to cyber thieves, the Fed branch blocked those same requests because they lacked information required to transfer money, according to two people with direct knowledge of the matter.

On the day of the theft in February, the New York Fed initially rejected 35 requests to transfer funds to various overseas accounts, a New York Fed official and a senior Bangladesh Bank official told Reuters. The Fed's decision to later fulfil a handful of resubmitted requests raises questions about whether it missed red flags.

The New York arm of the US central bank initially denied the transfer requests because they lacked proper formatting for the SWIFT messaging system, the network banks use for international financial transfers, the two officials said.

The Bangladesh Bank official said they lacked the names of correspondent banks, which typically receive wired funds. The Fed rejected the requests, which came from hackers who had broken into the SWIFT network through Bangladesh Bank systems.

Later in the day, however, the cyber thieves resubmitted those 35 requests. On the second try, the messages had the proper formatting, the official said. The requests had been authenticated by SWIFT, the first line of defence against fraudulent wire transfers.

Despite the technical compliance, the New York Fed rejected 30 of the requests a second time. But the Fed did approve five requests - for a total of $101 million. Later, one of those five transfers - a $20 million request - was reversed because of a misspelling.

The New York Fed has said it blocked the 30 resubmitted requests because they were flagged for review. Only afterward were they deemed potentially fraudulent.

The Bangladesh Bank official and another source close to the bank said the New York Fed should have rejected all the requests on both the first and second attempts.

The source close to the bank, who also had direct knowledge of the matter, said anomalies in the four transfers that ultimately went through should have raised questions at the New York Fed. They were paid to individual recipients, a rarity for Bangladesh's central bank, and the false names on the four approved withdrawals also appeared on some of the 30 resubmitted requests rejected by the bank, said the source close to the Bangladesh Bank.

"Of course, we asked the Fed why the repetition of the names did not create red flags," the source said.

'They are saying they rejected 35 badly submitted ones," the source said. But when the requests were re-submitted, they "paid 5 of them and stopped 30. Why? They can give no answer." Bangladesh Bank and SWIFT declined to comment.

The cyber theft from Bangladesh's central bank - and recent disclosures of other similar fraud attempts - have brought scrutiny on the SWIFT messaging system.