Exactly. There are programatical barriers you cannot bypass alone.

I can imagine a scan where the fake CEO gets a phone or laptop outside of the process "because CEO". This however will still be limited to generic, low value stuff handled by single people in a company.

There is no way that a reasonably organized company can leak 40 MM USD.

Citigroup leaked almost a billion, and it wasn't even fraud. https://www.npr.org/transcripts/1019909860

Yes, but this is due to three people trying willingly to bypass the system, and probably a shitty UI. They knew what they were doing, they just did it badly.

Citi is one of the major foundations of the entire industry, how much of a "yes but" is involved before its standard practice. shitty UI is extremely common inside financial companies because fixing it would cost money.

> And Citibank software is really jenky (ph), so basically the only way to > complete the wonky transaction is to sort of momentarily trick the software into > thinking that Revlon has repaid the entire loan.

Think I found your problem, boss.

"There is no way that a reasonably organized company can leak 40 MM USD. "

Oh, please, HP lost some 40 million in inventory while contracted to Solectron Global for repairs, because their inventory systems are utter garbage compared to Dell or Toshiba.

Cooperate processes are not laws, cooperations are not states, they are thiefdoms and of course the baron gets todo as he wish. Why whenever that illusion of order crumbles away, have this sort of public meltdown just because one is powerless and exposed to be trampled at any moment by random forces? This is just life and this is just part of a medieval peasants existence, towards which all of HN helped culturally steer this ship. Get over it, get on with it..

Do you… need a hug?

I do, after reading that

Hugs are just an illusion of order and will crumble away. Get over it!

Thanks, I needed that.

I definitely err on the side of cynicism but jeez, this is pretty out there.

Yeah people here acting illogically like denying covid for eg

> I have no idea how something like this can even happen. In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.

After having worked IT for various startups I cannot understate just how much executives and other higher ups detest policies that make them verify who they are. It short circuits something with their ego.

True, I was closing a real estate deal once with a rich guy and he called his private banker for something. He had a near-meltdown that they asked some kind of verification question from him.

Something a bit poetic to have such people be stolen from. It might be good for their overall mental health.

every process has exceptions. and there is no process stronger than the manager firing an employee for disobeying an order.

> every process has exceptions

Except these sort of transfers almost always happen with, at a minimum, dual approval where exceptions cannot be made because it's software defining the rule.

1 employee submits the transaction for review, and a 2nd (and sometimes a 3rd, 4th) person must approve it before the payment initiates. There isn't typically a bypass function.

Also, CFOs are typically responsible for setting up and enforcing these controls. A big part of a CFO's job is to manage risk. If you work under a CFO, you would be more likely to be rewarded for following the process than be punished.

Obviously there are exceptions to this, but by and large no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud.

Not if the CFO and the other most senior executives all order you to do so on a video call… hence the article.

"no CFO would punish a finance person for disobeying an order to bypass a process intended to prevent financial fraud."

CFO are often involved in fraud. it is part of finance industry training to be wary of dealing with other financial institutions.

https://tax.thomsonreuters.com/news/enron-former-cfo-i-am-on...

https://www.accountancydaily.co/ex-countrywide-cfo-charged-f...

https://www.businessinsider.com/bed-bath-and-beyond-cfo-foun...

https://www.nytimes.com/2024/02/01/nyregion/weisselberg-perj...

https://www.justice.gov/usao-ndtx/pr/cfo-controller-corporat...

https://www.fraud-magazine.com/article.aspx?id=4294976271

https://core.ac.uk/reader/231825040

https://www.nydailynews.com/2023/10/05/former-ftx-co-founder...

https://www.justice.gov/usao-wdwa/pr/former-company-chief-fi...

https://www.nydailynews.com/2023/10/05/former-ftx-co-founder...

https://www.investopedia.com/terms/w/worldcom.asp

whistleblowers get punished all the time.

https://www.pbs.org/wgbh/pages/frontline/warning/interviews/...

https://www.institutionalinvestor.com/article/2btg8yx4pcckb0...

https://www.marketswiki.com/wiki/Madelyn_Antoncic

https://www.wsj.com/articles/wells-fargo-fined-22-million-fo...

https://www.npr.org/2016/11/04/500728907/senators-investigat...

etc etc

When I say “no CFO” would punish someone doing things that mitigate fraud… it’s the same as saying “no software engineer intentionally introduces bugs on purpose”.

Obviously the statement isn’t literally accurate. Hopefully it’s 99% accurate (otherwise none of us would have jobs if all we did all day was sabotage our employers). Likewise, not every CFO is to be trusted, nor are all software engineers… but most can be.

I think there's a lot of people here making the wrong assumption about how their CFO would react to being told no.

These people aren't stupid. I'd expect them to understand risk better than your average senior software engineer and if you tell them "Sorry boss, too risky to do that right now. I can't be 100% sure this message is genuine. Let's sync on this after your meeting", your chances of promotion at this company would likely rise, not fall.

Chalk that up as another reason why employers shouldn't be able to fire people too easily.

At the end of the day even in large firms you only need to fool three or four eyes. Those eyes might get a lot of transactions to process and a certain sense of complacency might occur. The hope is that automatic controls will aid those humans with all kinds of checks, but even billion dollar transactions at the end of the day are human transactions.

I have been witness of spreadsheets passed through email, whatsapp, etc from one sector to another to initiate payments. It's all about trust perception. That is one of the weak links.

I don't get it. I work for a biggish company. Every time a user wants to join my Miro team I have to use a maze of ancient purchase order systems like Sage with multiple levels of approvals from our finance team. It's almost outrageously draconian but... not a penny goes by unpinched.

This is astounding levels of incompetence.

I’ll give you good odds that if you ever talk to the CFO about the transactions they personally sign off on, it’s a lot of emails and spreadsheets passed around. Processes are there for the little people, the big ones are chefsache. I also know what the biggest risk are. Not the automated stuff, not the very big M&A stuff, it’s the not yet automated routine combined payment order that is boring but rests on a few insiders to keep working. Insiders are very much in demand for these cons. The voice of the CEO is nothing, you need the proper tone, the proper pomp and circumstance.

The reality is these processes, while on paper "applicable to all users", can be bypassed the higher up you go. Culture issue.

That's not a culture issue. The alternative is that no one in the company has the power to do anything.

If processes can't be bypassed, then as soon as you implement a detrimental process, your company dies.

In other words, detrimental processes are only for the worker bees.

You don't want them anywhere. The fact that people exist who can bypass detrimental processes that apply to low-level workers is what nvr219 was complaining about.

You are a low level grunt. Directors and executives are not using sage for a lot of things.

Yup and large corp/banker corruption and bribery happens only in netflix movies /s

in financial services everything you can possibly doing for your regular job has an approval chain (often consisting of at least 3 people)

install notepad++ from pre-packaged store? approval needed

change to mailing list you own? approval needed

1 line config change to production alerting system? 8 approvals needed

I can easily imagine people just clicking Approve sometimes without reading

And then you hear stories like that one about french trader Jérôme Kerviel who did unauthorized trades with 5 billion losses.

And many more stories like that.

But yes, for small fish there is an approval process for everything, even to but a paper clip.

controls applied to traders are very different

a common thread in these modern rogue trader scandals are that the perp worked on the controls or monitoring system in a role prior to becoming a trader

so they knew how to structure their trades in such a way to evade detection

I feel like I’m missing something from your post. Are you being asked to approve several large financial transactions per hour in your job as a software engineer?

Regardless, approvals for multi-million transfers require a higher level of process and approval.

I think you underestimate the scale here, a "multi-million" dollar transaction is something that happens tens of thousands of times a day

> Regardless, approvals for multi-million transfers require a higher level of process and approval.

if you say so

Maybe, but those multi-million transfers are usually going to known trusted counterparties (other brokers, bank treasuries), not random vendor accounts.

> In a company of that size it should be actually impossible for a transaction like this to occur without clearly documented processes to ingest, review, authorise and pay transactions.

Oh, my sweet summer child. The larger the organization, the more dysfunctional it becomes.

See How this scammer used phishing emails to steal over $100 million from Google and Facebook

https://www.cnbc.com/2019/03/27/phishing-email-scam-stole-10...

The deep-fakers were likely, at least at one point, an internal employee of this firm so that they knew how to pull this off.

Having 2 people authorize a $25M USD transaction does seem like a prudent precaution.

I like the juxtaposition of this comment and the one before it, saying "if we had to authorize every transaction of a few million, we wouldn't get any other work done".

billionaires do it all the time with 1 person

Maybe they’re ok getting scammed for $25M now and then I guess.

I worked at an investment bank which made daily FX transactions to cover trading in world markets to their nostro accounts, and these could easily be in the 10-100 million range on a given day. Transactions like these are not particularly surprising in that context, so processes will be in place to reduce the workload on operations staff, so that they only need to validate exceptional transactions.

If you have 10 business units trading 50 world currencies, checking 500 transactions for FX every day is a total chore hence it would get automated, and only unusually large transactions would be flagged. Rules like <10m goes through automatically would be tuned over time so that the workload on operations team members would add actual value without being onerous on their time.

So, depending on the business we are talking about, a 25m transaction could basically be lost in the noise. Given the mention of the CFO being london based and the operations team being in HK, it sounds like a typical investment bank setup to me.

but i assume these daily transactions are going to same validates target accounts, that are nnot changing daily. in this case i assume this was a transaction to a random account.

Yes, that's a good point. The nostro accounts don't change often, but they do change as new business lines come and go, but I don't remember the validator having any rules based on the target accounts in the system I was involved with. However I may be wrong, and that was 10 years ago, so things have probably moved on.

It depends what the multi-party authorisation is trying to protect against. Normally you're trying to protect against insiders stealing money by authorizing a payment on their own. In this case it's quite possible that multiple people inside the company signed off on the transfer and it all happened "by the book".

Social engineering is substantially about appealing to someone who can do all the steps you cannot perform from outside.

From what I understand of the literature, it’s often several interactions to gather enough information from several employees to learn to sound like you belong there, then using it all against someone with “keys” who escorts you the rest of the way.

But does that fix the problem or just slow it down a bit?

If you can deepfake one guy with the checkbook, can’t you deepfake the guy with the checkbook and the guy who enters the POs into the system? Lower odds, but far from zero.

Just like the locks on your door or safe. Doesn't "fix" the problem of theft, but slows them down quite a bit.

This was a case where someone pretended to be other people at the company over video calls. It's not a huge leap for that to happen to multiple employees - if it didn't happen here having multiple people doesn't eliminate this attack.

You don't understand current banking as its happening right now, simple as that. Also, you probably didn't read article since it clearly states it was a 'secret' transaction, most probably meaning bypassing all controls put in place.

I mean we still right now live in the world where just a very rough match for signature on a piece of crappy paper is enough to move millions if needed.

Yeah, I do. And yeah, I did.

Maybe it’s because I’m in the EU. Banking here is very different to the US.

>it should be actually impossible

Couple years ago I thought that too...

All the checks you describe - multiple approvers, standing data, callbacks etc - the guys going after big payments like this know these checks are in place, how they work and have a game plan for it.