Hackers Steal Millions From Mexican Banks Via Fake Transfers

Cyber-thieves have made off with hundreds of millions of pesos from Mexican banks using the country’s domestic electronic transfer system.

The attack is similar to earlier ones that have used the international SWIFT network, prompting the Belgium-based organisation to bring in new security measures.

Like the SWIFT attacks, those using Mexico’s SPEI interbank transfer system did not compromise the core network itself, instead manipulating the systems banks use to interact with it.

Criminals created counterfeit orders that transferred amounts ranging from tens of thousands to hundreds of thousands of pesos (the equivalent of hundreds to thousands of pounds) to fake accounts in other banks.

Millions stolen

They they emptied those accounts in cash withdrawals in dozens of branch offices, Reuters reported, citing two sources close to a government investigation.

Reports of the total amount thieves had stolen ranged from 300 million pesos (£11.3m) to 400m pesos.

Lorenza Martinez, head of operations for Mexico’s central bank, said five institutions saw “unauthorised transfers”.

She said the criminals may have had help from within bank branches to conceal the series of unusually large transfers.

”In terms of the security of the bank’s offices, I think that is part of the analysis that each bank is doing,” Martinez told Reuters.

The banks are working with Mexico’s attorney general to investigate whether organised criminals were responsible for the hack, Bloomberg reported.

At the end of April the monetary authority asked some banks to switch to backup technology for connecting to SPEI due to a suspected cyber-attack that disrupted some transfers. But Martinez said at least one bank experienced an incident as recently as last week.

Martinez declined to name the banks, but Reuters said one of those affected was the country’s second-largest lender, Banorte.

SWIFT targeted

In the most famous SWIFT hack, thieves made off with more than $100m (£73m) from the Bank of Bangladesh using falsified transfers that were sent by hacking the bank’s internal systems.

Other countries have also been attacked via SWIFT, with hackers in January attempting to steal money from Mexico’s Bancomext, a government-owned export bank. That attack caused the bank to temporarily suspend operating its international payments platform.

SWIFT handles transfers worth more than $5 trillion per day.

Do you know all about security? Try our quiz!