Fraudulent cross-border payment messages leave through your own gateway
The prompt — read this to the room
Friday, 18:20. A correspondent bank calls your payments operations desk about three outbound cross-border transfers sent in the last two hours: $4.2 million, $6.8 million and $9.5 million, to beneficiaries in three countries you rarely deal with. The messages were authenticated through your own payment messaging gateway using two valid operator accounts, one belonging to someone on leave. The daily reconciliation that would have caught them runs at 22:00, and today's printed confirmation report shows nothing unusual. Some of the funds may already have been credited. Who calls whom first, and what do you switch off?
Who to involve
Most important first.
- CISO / Head of security
- Incident response lead
- CFO / Finance
- IT operations
- Legal counsel
- CEO / Managing director
- SOC analyst
What it tests
- Start fund recall with correspondent and beneficiary banks inside the first hour
- Contain the payment environment (gateway, operator accounts, jump hosts) without destroying evidence
- Establish whether reconciliation and confirmation controls were tampered with
- Coordinate law-enforcement, regulator, board and messaging-network notifications
Outline of activities
- 1The correspondent bank's call
- 2Stop, recall, preserve
- 3How they got in, and what else they touched
- 4Notifications: law enforcement, regulator, messaging network, board
- 5Restart decision: when payments resume, and under what controls
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…