5 ms·
I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without
by saaaaaam 3y ago
I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.
I have clients where anything over even quite a low set limit (say €10k) requires multi-party authorisation - and it's very common for the person entering payments to be unable to authorise payments. That's just good practice.
A payment should not be able to be queued without a PO number. If the payee is new, the bank details need to be verified by phone. Once approved as a destination account, that payee is set up in banking, and authorised by a finance clerk and someone more senior. At the point a payment is requested the PO and other details should be double checked against what is in the system. If there's a match, then the payment can be queued for authorisation. The person entering payments and the people approving payments should be entirely different - and it should be people, not a single person. When payments are entered, the payments should be reviewed by first authorisation - a finance manager, for example - and once that authorisation is conducted, depending on payment limits, another authorisation or authorisations will be carried out.
- BrandoElFollito 3y agoExactly. There are programatical barriers you cannot bypass alone. I can imagine a scan where the fake CEO gets a phone or laptop outside of the process "because CEO". This however will still be limited to generic, low value stuff handled by single people in a company. There is no way that a reasonably organized company can leak 40 MM USD.
- fallingknife 3y agoCitigroup leaked almost a billion, and it wasn't even fraud. https://www.npr.org/transcripts/1019909860 https://www.npr.org/transcripts/1019909860
- BrandoElFollito 3y agoYes, but this is due to three people trying willingly to bypass the system, and probably a shitty UI. They knew what they were doing, they just did it badly.
- doubloon 3y agoCiti is one of the major foundations of the entire industry, how much of a "yes but" is involved before its standard practice. shitty UI is extremely common inside financial companies because fixing it would cost money.
- BobaFloutist 3y ago> And Citibank software is really jenky (ph), so basically the only way to > complete the wonky transaction is to sort of momentarily trick the software into > thinking that Revlon has repaid the entire loan. Think I found your problem, boss.
- lightedman 3y ago"There is no way that a reasonably organized company can leak 40 MM USD. " Oh, please, HP lost some 40 million in inventory while contracted to Solectron Global for repairs, because their inventory systems are utter garbage compared to Dell or Toshiba.
- Log_out_ 3y agoCooperate processes are not laws, cooperations are not states, they are thiefdoms and of course the baron gets todo as he wish. Why whenever that illusion of order crumbles away, have this sort of public meltdown just because one is powerless and exposed to be trampled at any moment by random forces? This is just life and this is just part of a medieval peasants existence, towards which all of HN helped culturally steer this ship. Get over it, get on with it..
- ecf 3y ago> I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions. After having worked IT for various startups I cannot understate just how much executives and other higher ups detest policies that make them verify who they are. It short circuits something with their ego.
- ricardobayes 3y agoTrue, I was closing a real estate deal once with a rich guy and he called his private banker for something. He had a near-meltdown that they asked some kind of verification question from him.
- noobermin 3y agoSomething a bit poetic to have such people be stolen from. It might be good for their overall mental health.
- doubloon 3y agoevery process has exceptions. and there is no process stronger than the manager firing an employee for disobeying an order.
- cj 3y ago> every process has exceptions Except these sort of transfers almost always happen with, at a minimum, dual approval where exceptions cannot be made because it's software defining the rule. 1 employee submits the transaction for review, and a 2nd (and sometimes a 3rd, 4th) person must approve it before the payment initiates. There isn't typically a bypass function. Also, CFOs are typically responsible for setting up and enforcing these controls. A big part of a CFO's job is to manage risk. If you work under a CFO, you would be more likely to be rewarded for following the process than be punished. Obviously there are exceptions to this, but by and large no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud.
- MichaelZuo 3y agoNot if the CFO and the other most senior executives all order you to do so on a video call… hence the article.
- doubloon 3y ago"no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud." CFO are often involved in fraud. it is part of finance industry training to be wary of dealing with other financial institutions. https://tax.thomsonreuters.com/news/enron-former-cfo-i-am-one-of-the-poster-boys-for-fraud/ https://tax.thomsonreuters.com/news/enron-former-cfo-i-am-on... https://www.accountancydaily.co/ex-countrywide-cfo-charged-fraud https://www.accountancydaily.co/ex-countrywide-cfo-charged-f... https://www.businessinsider.com/bed-bath-and-beyond-cfo-found-dead-insider-trading-lawsuit-2022-9?op=1 https://www.businessinsider.com/bed-bath-and-beyond-cfo-foun... https://www.nytimes.com/2024/02/01/nyregion/weisselberg-perjury-trump-fraud.html https://www.nytimes.com/2024/02/01/nyregion/weisselberg-perj... https://www.justice.gov/usao-ndtx/pr/cfo-controller-corporate-officers-charged-53-million-fraud-scheme-involving-pandemic https://www.justice.gov/usao-ndtx/pr/cfo-controller-corporat... https://www.fraud-magazine.com/article.aspx?id=4294976271 https://www.fraud-magazine.com/article.aspx?id=4294976271 https://core.ac.uk/reader/231825040 https://core.ac.uk/reader/231825040 https://www.nydailynews.com/2023/10/05/former-ftx-co-founder-admits-to-carrying-out-fraud-with-fallen-crypto-king-sam-bankman-fried/ https://www.nydailynews.com/2023/10/05/former-ftx-co-founder... https://www.justice.gov/usao-wdwa/pr/former-company-chief-financial-officer-indicted-using-35-million-company-cash-invest https://www.justice.gov/usao-wdwa/pr/former-company-chief-fi... https://www.nydailynews.com/2023/10/05/former-ftx-co-founder-admits-to-carrying-out-fraud-with-fallen-crypto-king-sam-bankman-fried/ https://www.nydailynews.com/2023/10/05/former-ftx-co-founder... https://www.investopedia.com/terms/w/worldcom.asp https://www.investopedia.com/terms/w/worldcom.asp whistleblowers get punished all the time. https://www.pbs.org/wgbh/pages/frontline/warning/interviews/born.html https://www.pbs.org/wgbh/pages/frontline/warning/interviews/... https://www.institutionalinvestor.com/article/2btg8yx4pcckb0msut8u8/portfolio/what-ever-happened-to-lehman-brothers-whistle-blower-matthew-lee https://www.institutionalinvestor.com/article/2btg8yx4pcckb0... https://www.marketswiki.com/wiki/Madelyn_Antoncic https://www.marketswiki.com/wiki/Madelyn_Antoncic https://www.wsj.com/articles/wells-fargo-fined-22-million-for-alleged-whistleblower-retaliation-11662148588 https://www.wsj.com/articles/wells-fargo-fined-22-million-fo... https://www.npr.org/2016/11/04/500728907/senators-investigate-reports-wells-fargo-punished-workers https://www.npr.org/2016/11/04/500728907/senators-investigat... etc etc
- wjnc 3y agoAt the end of the day even in large firms you only need to fool three or four eyes. Those eyes might get a lot of transactions to process and a certain sense of complacency might occur. The hope is that automatic controls will aid those humans with all kinds of checks, but even billion dollar transactions at the end of the day are human transactions.
- wslh 3y agoI have been witness of spreadsheets passed through email, whatsapp, etc from one sector to another to initiate payments. It's all about trust perception. That is one of the weak links.
- Solvency 3y agoI don't get it. I work for a biggish company. Every time a user wants to join my Miro team I have to use a maze of ancient purchase order systems like Sage with multiple levels of approvals from our finance team. It's almost outrageously draconian but... not a penny goes by unpinched. This is astounding levels of incompetence.
- nvr219 3y agoThe reality is these processes, while on paper "applicable to all users", can be bypassed the higher up you go. Culture issue.
- thaumasiotes 3y agoThat's not a culture issue. The alternative is that no one in the company has the power to do anything. If processes can't be bypassed, then as soon as you implement a detrimental process, your company dies.
- lenkite 3y agoIn other words, detrimental processes are only for the worker bees.
- yfbx 3y agoYup and large corp/banker corruption and bribery happens only in netflix movies /s
- blibble 3y agoin financial services everything you can possibly doing for your regular job has an approval chain (often consisting of at least 3 people) install notepad++ from pre-packaged store? approval needed change to mailing list you own? approval needed 1 line config change to production alerting system? 8 approvals needed I can easily imagine people just clicking Approve sometimes without reading
- Aurornis 3y agoI feel like I’m missing something from your post. Are you being asked to approve several large financial transactions per hour in your job as a software engineer? Regardless, approvals for multi-million transfers require a higher level of process and approval.
- blibble 3y agoI think you underestimate the scale here, a "multi-million" dollar transaction is something that happens tens of thousands of times a day > Regardless, approvals for multi-million transfers require a higher level of process and approval. if you say so
- cjalmeida 3y agoMaybe, but those multi-million transfers are usually going to known trusted counterparties (other brokers, bank treasuries), not random vendor accounts.
- ponector 3y agoAnd then you hear stories like that one about french trader Jérôme Kerviel who did unauthorized trades with 5 billion losses. And many more stories like that. But yes, for small fish there is an approval process for everything, even to but a paper clip.
- blibble 3y agocontrols applied to traders are very different a common thread in these modern rogue trader scandals are that the perp worked on the controls or monitoring system in a role prior to becoming a trader so they knew how to structure their trades in such a way to evade detection
- seagulls 3y ago> In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions. Oh, my sweet summer child. The larger the organization, the more dysfunctional it becomes. See How this scammer used phishing emails to steal over $100 million from Google and Facebook https://www.cnbc.com/2019/03/27/phishing-email-scam-stole-100-million-from-facebook-and-google.html https://www.cnbc.com/2019/03/27/phishing-email-scam-stole-10...
- samstave 3y agoThe deep-fakers were likely, at least at one point, an internal employee of this firm so that they knew how to pull this off.
- RecycledEle 3y agoHaving 2 people authorize a $25M USD transaction does seem like a prudent precaution.
- micromacrofoot 3y agobillionaires do it all the time with 1 person
- r00fus 3y agoMaybe they’re ok getting scammed for $25M now and then I guess.
- stavros 3y agoI like the juxtaposition of this comment and the one before it, saying "if we had to authorize every transaction of a few million, we wouldn't get any other work done".
- cesaref 3y agoI worked at an investment bank which made daily FX transactions to cover trading in world markets to their nostro accounts, and these could easily be in the 10-100 million range on a given day. Transactions like these are not particularly surprising in that context, so processes will be in place to reduce the workload on operations staff, so that they only need to validate exceptional transactions. If you have 10 business units trading 50 world currencies, checking 500 transactions for FX every day is a total chore hence it would get automated, and only unusually large transactions would be flagged. Rules like <10m goes through automatically would be tuned over time so that the workload on operations team members would add actual value without being onerous on their time. So, depending on the business we are talking about, a 25m transaction could basically be lost in the noise. Given the mention of the CFO being london based and the operations team being in HK, it sounds like a typical investment bank setup to me.
- vincnetas 3y agobut i assume these daily transactions are going to same validates target accounts, that are nnot changing daily. in this case i assume this was a transaction to a random account.
- cesaref 3y agoYes, that's a good point. The nostro accounts don't change often, but they do change as new business lines come and go, but I don't remember the validator having any rules based on the target accounts in the system I was involved with. However I may be wrong, and that was 10 years ago, so things have probably moved on.
- rwmj 3y agoIt depends what the multi-party authorisation is trying to protect against. Normally you're trying to protect against insiders stealing money by authorizing a payment on their own. In this case it's quite possible that multiple people inside the company signed off on the transfer and it all happened "by the book".
- hinkley 3y agoSocial engineering is substantially about appealing to someone who can do all the steps you cannot perform from outside. From what I understand of the literature, it’s often several interactions to gather enough information from several employees to learn to sound like you belong there, then using it all against someone with “keys” who escorts you the rest of the way.
- hinkley 3y agoBut does that fix the problem or just slow it down a bit? If you can deepfake one guy with the checkbook, can’t you deepfake the guy with the checkbook and the guy who enters the POs into the system? Lower odds, but far from zero.
- anon84873628 3y agoJust like the locks on your door or safe. Doesn't "fix" the problem of theft, but slows them down quite a bit.
- IanCal 3y agoThis was a case where someone pretended to be other people at the company over video calls. It's not a huge leap for that to happen to multiple employees - if it didn't happen here having multiple people doesn't eliminate this attack.
- saiya-jin 3y agoYou don't understand current banking as its happening right now, simple as that. Also, you probably didn't read article since it clearly states it was a 'secret' transaction, most probably meaning bypassing all controls put in place. I mean we still right now live in the world where just a very rough match for signature on a piece of crappy paper is enough to move millions if needed.
- saaaaaam 3y agoYeah, I do. And yeah, I did. Maybe it’s because I’m in the EU. Banking here is very different to the US.
- Havoc 3y ago>it should be actually impossible Couple years ago I thought that too... All the checks you describe - multiple approvers, standing data, callbacks etc - the guys going after big payments like this know these checks are in place, how they work and have a game plan for it.