Bangladesh sues Philippine bank to recover USD 81 mn loss during 2016 cyber attack

Bangladesh's central bank has filed a lawsuit in the US against a Philippine bank to recoup losses it suffered when unidentified hackers stole USD 81 million from its account with the Federal Reserve Bank of New York in 2016. The Bangladesh Bank has sought to get back USD 81 million along with the damages and the legal cost.

"We filed in Bangladesh time this morning a lawsuit with Southern Court in New York seeking to recover the entire amount heisted," Abu Hena Mohd Razee Hassan, Bangladesh Bank's Financial Intelligence Unit (BFIU) chief told reporters in Dhaka on Thursday. Hassan has accused Manila-based Rizal Commercial Banking Corp (RCBC) and dozen others including bank officials of involvement in the "massive" and "intricately planned" conspiracy to steal the money.

The hacking took place on the night of February 4, 2016, using information stolen through malware, which sent a total of 35 transfer orders to the NY Federal Reserve Bank where Bangladesh's central bank has an account. According to the complaints, hackers from North Korea used fraudulent orders on the SWIFT payments system to steal the money while the amount was funnelled through RCBC accounts in New York City.

The stolen money that was sent to the Philippines, where much of it disappeared in the country's casino industry. The complaint, however, said the investigators eventually could not exactly track down the destination of the amount.

No RCBC comment was available immediately but the bank earlier said they would welcome this complaint, as it is an opportunity for RCBC to "put on record again that it was a victim of what was started in Bangladesh by still-unnamed persons". The hackers actually stole a total USD 101 million from Bangladesh's account with the New York Fed in February 2016 and of the amount, USD 81 million was transferred to four RCBC accounts in Manila and another USD 20 million to a bank in Sri Lanka.

Sri Lanka, however, immediately stopped the delivery of the amount that entered their banking system and returned the money immediately, complying with a Bangladesh Bank request. The development came nearly a month after a Philippine court found RCBC's Makati City branch manager Maia Deguito guilty of eight counts of money laundering tied to the heist and sentenced her to a 32- to the 56-year prison term and a USD 109 million fine.

The heist forced the then Bangladesh Bank governor Atiur Rahman to resign weeks after the central bank revealed that the huge amount was stolen from its account. On the same day, the government sacked two of the central bank’s four deputy governors while the secretary of fiancé ministry’s banking division was stripped off his responsibility.

The Bangladesh Bank officials earlier said the hackers tried to steal a further USD 850 million, but the bank's security systems and typing errors in some requests thwarted the full theft. The Federal Reserve Bank, which manages the Bangladesh Bank reserve account, denied its own systems were breached.

Bangladesh Bank Governor Fazle Kabir, earlier said the New York Fed had signed an agreement to help with the case. However, New York Fed spokesperson declined to discuss what support her office might offer, according to media reports.

(With inputs from agencies.)