Swift regroups after bank heists
The secure messaging service that underpins international banking, run by the Society for Worldwide Interbank Financial Telecommunications (Swift), says it plans to launch a new security programme as it fights to rebuild its reputation in the wake of the Bangladesh Bank heist.
Swift's chief executive, Gottfried Leibbrandt, will tell a financial services conference in Brussels that Swift will launch a five-point plan later this week.
Banks send payment instructions to one another via SWIFT messages. In February, thieves hacked into the SWIFT system of the Bangladesh central bank, sending messages to the Federal Reserve Bank of New York, allowing them to steal $81 million.
The attack follows a similar but little noticed theft from Banco del Austro in Ecuador last year that netted thieves over $12 million, and a previously undisclosed attack on Vietnam's Tien Phong Bank that was not successful.
The crimes have dented the banking industry's faith in Swift, a Belgium-based co-operative owned by its users.
The Bangladesh Bank hack was a "watershed event for the banking industry", Leibbrandt will say.
"There will be a before and an after Bangladesh. The Bangladesh fraud is not an isolated incident... this is a big deal. And it gets to the heart of banking."
Swift wants banks to "drastically" improve information sharing, toughen up security procedures around Swift and increase their use of software that could spot fraudulent payments.
The society will also provide tighter guidelines that auditors and regulators can use to assess whether banks' Swift security procedures are good enough.
Leibbrandt will again defend Swift's role, saying the hacks happened primarily because of failures at users. However, some finance industry executives say Swift has not been as active as it should be in improving security.
Users frequently do not inform the society of breaches of their Swift systems and even now, the co-operative has not proposed any sanctions for clients who fail to pass on information, which Swift says is key to stopping future attacks.
Some critics say Swift should also be more active in auditing clients, and be ready to cut off members whose security is not up to scratch.
But the messaging service says other authorities also have a role.
"SWIFT is not all-powerful, we are not a regulator and we are not a policeman," Leibbrandt will say.
Former Swift CEO Leonard Schrank said it appeared Swift's security efforts had not kept pace with the criminals' increased sophistication, and the co-operative needed to work hard to restore its reputation.
"They really have to earn that credibility back," he told Reuters.