The National Payments Corporation of India (NPCI), an umbrella organisation for operating retail payments and settlement systems in India, said here on Wednesday that that the Cosmos Cooperative Bank ltd's "own IT environment" led to the unprecedented Rs 94.42 crore cyber heist from the Pune-headquartered bank.
A day after Cosmos Bank reported Rs 94.42 crore cyber fraud which hackers launch a malware attack on its ATM Debit payment server and create proxy switch server that passed on fraudulent payment approvals, the NPCI held the bank’s “IT environment” responsible for the theft.
In a statement issued here, NPCI’s Head Risk Management Bharat Panchal said: “One of our network-member has confirmed about a malware based attack on their system which has caused a fraud loss of over Rs 90 crore. We wish to reiterate that our systems are fully secure and this particular issue has occurred within the Bank’s own IT environment”.
In an elaboration, Panchal said: “This has happened due to malware based attack on bank’s IT system which has caused a fraud. Under the attack, maximum transactions have been reported from outside India. We wish to reiterate that our systems are fully secure and we are monitoring the situation continuously. We are there to support Bank in identifying the cause of this fraud.”
NPCI is an initiative of Reserve Bank of India (RBI) and Indian Banks’ Association (IBA) under the provisions of the Payment and Settlement Systems Act, 2007, for creating a robust Payment and Settlement Infrastructure in India.
The initial stock-taking by the Cosmos Bank had revealed that “approximately Rs 78 crore was withdrawn through various ATMs located in 28 countries through 12,000 VISA transactions" through multiple swipes using cloned ATM card details in 28 countries across the world and “another Rs 2.5 crore was withdrawn through 2,800 debit card transactions at various locations in India”.
In its complaint lodged with Pune’s Chatshrungi police station, the Cosmos bank had stated on Tuesday that Rs 80.5 crore was initially transferred to a foreign bank in 14,849 transactions of the debit card, and another Rs 13.92 crore transferred in a SWIFT transaction.
After the first malware attack on the bank’s server on August 11, the hackers left a deposit trail in Hong Kong where an amount of Rs 78 crore was transferred, while another transaction of Rs 2.5 crore was also done in India through NPCI and VISA.
Cosmos Bank Chairman Milind Kale had among other things said on Tuesday: “As it is a malware attack on the switch which is operative for the payment gateway of VISA/Rupay Debit card system and not on the core banking system of the bank, the customers’ accounts and the balances are not at all affected. .... The savings, term deposits and recurring accounts of the depositors are totally safe. I appeal to our customers to remain calm, not to panic and to continue to have faith and trust on the 112-year-old bank,” Kale said.
Kale had also assured his bank’s customers that “money lost by way of fraudulent transactions has not been debited to any of the customer’s account and will not be debited in future”.
“As soon suspicious transactions were reported (on August 11), we shut our VISA and Rupay Debit card payment system. The core Banking System (CBS) receives debit card payment requests via switching system. ... We observed that approximately Rs 78 crore was withdrawn through various ATMs located in 28 countries involving 12,000 VISA transactions while another Rs 2.5 crore was withdrawn through 2,800 debit card transactions at various locations in India,” Kale had said.