Aseries of high-profile security breaches have led to concerns around SWIFT'sability to combat modern cyber attacks, threatening its dominant position inthe international payment space.
Bankcustomers use SWIFT, or the Society for Worldwide Interbank FinancialTelecommunication, to request and approve money transfers. Transactions worthtrillions of dollars are processed through the network each day, and hackershave recently shown greater interest in, and aptitude for, misappropriatingsome of these funds.
Banksin Ecuador, Vietnam and other countries have been victims of cyberattacksthrough the system. In the most high-profile case, news of which emerged inMarch, $81 million was stolen from the Bangladesh central bank's account at the U.S. FederalReserve. Thieves impersonating Bangladeshi officials, whose SWIFT credentialsthey compromised, initially attempted to withdraw about $1 billion.
Todate, the perpetrators have not been identified nor the money recovered, withthe bank and SWIFT blaming each other for security failures.
Opportunity for change
Whileregulators have so far not publicly told SWIFT to reform, there may be thingsthe payments giant could do to better fight the scourge of internet crime. Forinstance, SWIFT does not monitor for anomalies happening inside its network,although the technology needed for this kind of surveillance is widely available,one expert told S&P Global Market Intelligence.
"Theycan improve centralized data analytics inside the network; this is anopportunity for SWIFT," said Andrew Davies, a cybersecurity expert andvice president in the financial crime risk management department of Fiserv, abanking software company. "They need to develop centralized monitoring ofunusual activity in the core system, because there are too many vulnerabilitiesat the member banks," he said.
Unusualactivity on a computer network can be a sign of security breaches. Newalgorithm-based data analytics programs can parse all transactions in real timeand sniff out those that do not fit normal patterns.An automated suspiciousactivity surveillance system at SWIFT might have prevented the Bangladeshiheist and others, Davies suggested.
Bankersare worried. Deutsche Bank's head of cybersecurity, Hinrich Voelcker, said inSeptember that SWIFT needs to be reformed. "If trust in this system breaksdown, we all have a problem," he told Reuters.
Anotherindustry executive, who asked not to be named, concurred, telling S&PGlobal Market Intelligence there are increasing doubts regarding the integrityof the network.
SWIFTitself is putting pressure on its member banks to set new that it says willhelp prevent future attacks.
Natashade Teran, SWIFT's head of corporate affairs, said in an interview that theorganization is preparing a new "security audit framework" that willsee banks reveal their protections to each other and to regulators, thusopening the possibility of being shunned from partnerships if found wanting.This procedure, which is based on 16 specific controls such as better identitychecks for employees with direct access to the service, will be enforced fromJan. 1, 2018.
She conceded that SWIFT is not actively looking out forabnormal activity inside its network, but also insisted that the organizationcannot be faulted for the hacks.
"Wehave no evidence the network or core messaging services have beencompromised," she said. "In all the cases customers' localinfrastructure has been compromised, which is why we have launched the customersecurity program. The threat level has increased."
Old technology, new entrants
Establishedin Brussels in 1973, SWIFT still relies on old technology that is difficult toreplace.
"There'svested interest to keep it the way it is as long as possible," theanonymous executive said in an interview, pointing to the high costs of changingthe infrastructure and the current, extremely profitable model. The price of atypical transfer is between $15 and $25.
Buthe said it is facing a significant threat from competitors, and predicted thatits monopoly over global payments "won't last much longer."
Whileno other player has anywhere near SWIFT's reach, with more than 11,000 memberbanks around the world, newcomers are nevertheless targeting its market. One ofthese is payments company iGTB, which recently completed an experimental internationalmoney transfer using the San Francisco-based Ripple platform, a SWIFT rivalbased on blockchain technology. Blockchain, also known as distributed ledger,allows each transaction to be recorded simultaneously everywhere on thenetwork, potentially offering big security benefits.
used iGTB's product to transfer $10 to Canada's andto Israel's Bank Leumi le-IsraelB.M. Highlighting the potential the new technology has to bypassSWIFT, NAB Executive General Manager Jonathan Davey said it can offer real-timeinternational payments, as well as improved security and efficiency compared tothe bank's current system.
Inan interview, Michel Jacobs, an executive vice president at iGTB, said SWIFT is"like the old phones, the GSMs — and new technologies are the smartphones."
Corporates,like consumers, expect their suppliers to innovate, he said.
"Theyask themselves, 'Why do I have to wait two days to get paid when it can be donein seconds?,'" he said. "Ripple is putting pressure on SWIFT to dothat. Their payments system is as fast as an email. All the banks are lookinginto it."