Cyber attack on SBM, loss limited to ₹19 crore
MUMBAI: In what seems to be the biggest cyber-banking fraud in the city this year, foreign-based cyber criminals on October 2 allegedly hacked into the server of the State Bank of Mauritius (SBM) Ltd and into the Society for Worldwide Interbank Financial Telecommunication (SWIFT) System. They attempted to siphon ₹147 crore to various bank accounts in London, New York, Paris and Tokyo. However, timely actions taken by two foreign banks — in whose account the funds were transferred — ensured that the loss was limited to ₹19 crore.
Rakesh Prakash Narayan, head of operations in SBM corporate office in Raheja Centre, Nariman Point, on October 5, registered an FIR with the economic offences wing (EOW) of the Mumbai crime branch. Superintendent of state cyber police, Balsingh Rajput said, “This attack is also like the ones made on City Union bank, Cosmos Bank (Pune) and UBI. In all three, compromising of the SWIFT network is common.”
The fraud came to light when Citi Bank NA, New York, noticed some suspicious transactions linked to the nostro account of SBM Bank, and alerted the branch in Mumbai. Dyannesh Mahajan, senior official at the SBM Treasury Back office in Mumbai was verifying the transactions when the bank received another call from JP Morgan bank, informing them about some suspicious transactions. On
checking, all these transactions turned out to be fraudulent, EOW officials said. The bank then informed the foreign banks to freeze the transactions. However, JP Morgan informed Mahajan that they had received two e-mails from him — one stating that the transactions did not pertain to SBM (which the bank rightfully sent), and another stating that the transactions with one
Kenya Bank are valid. Mahajan was shocked to find that even his official email account was hacked. An SBM spokesperson said, “SBM India has been victim of a cyber attack. As of today, the lost amount is limited to ₹19 crore.”
“A case under sections 415, 419, 420 of IPC and 43, 66, 66c and 66d of IT Act was registered,” a senior EOW official said.