SWIFT: A Bangladesh Printer Hack, NSA Spying and Russia's Disconnection

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

SWIFT, the Society for Worldwide Interbank Financial Telecommunication, holds no money and settles no payments: it is a secure messaging network that tells banks where funds should move. It grew out of the Nixon shock of 1971, when floating exchange rates made slow, manually typed Telex messages costly, and out of fears that First National Citibank's proprietary system would become the default. In 1973, 239 banks from 15 countries formed a cooperative based in Belgium, and Prince Albert of Belgium sent the first ceremonial message in 1977. Its ISO 9362 codes identify the bank, country, city and branch, and by 2015 the network carried 32 million messages a day for more than 11,000 institutions in over 200 countries.

After the September 11 attacks, the CIA and the U.S. Treasury tapped SWIFT data through the Terrorist Finance Tracking Program, and the 2013 Snowden leaks showed the NSA reading bank printer traffic. SWIFT split its data storage into European and transatlantic zones in 2009, and the European Parliament rejected a U.S. data sharing agreement in 2010. On EU orders it disconnected sanctioned Iranian banks in 2012, refused 2014 demands to cut off Israeli banks and Russia, and in 2022 removed select Russian and Belarusian banks. Those cutoffs spurred rival systems, including China's CIPS, Russia's SPFS, India's SFMS, Brazil's Pix and the planned BRICS Pay.

• In 2016 hackers took $81 million from Bangladesh's central bank and used malware to alter Alliance Access print logs so paper reports showed normal balances.
• In Ecuador, Banco del Austro sued Wells Fargo over $12 million stolen by thieves using an employee's legitimate SWIFT login.
• Slow international wires come from hops through correspondent banks, each running its own compliance checks and legacy software.
• Aleph Bank in Tajikistan had to upgrade its entire core banking system before it could adopt SWIFT Go.
• INSTEX, the EU vehicle built to keep trading with Iran despite U.S. sanctions, was liquidated in 2023.