Police foil international racket planning to steal money from Nepali banks

Just weeks after the biggest ATM heist by Chinese nationals, more than Rs 15 million has been stolen from the Agricultural Development Bank Ltd (ADBL). But the Police arrested a dozen youth for their alleged involvement in masterminding this huge financial racket.
Metropolitan Police Crime Division (MPCD) Teku today revealed that a foreign national residing in India had been planning – for a considerable time – to steal over Rs 5 billion from various banks and financial institutions of Nepal via hacking, and using Nepalis. According to the Police, Peter – also known as Kale –currently residing in Mumbai of India has been involved in masterminding the huge financial racket with the help of Nepali nationals. “We have arrested some twelve persons for their alleged involvement in the case,” the Police said, adding that a special investigation team from MPCD arrested them from various areas within and outside Kathmandu Valley. “They were involved in stealing the money through the process of ‘credential hacking’ from various banks and financial institutions, including Agricultural Development Bank and Panas Remit,” the Police confirmed, identifying the arrestees as Lawang Tamang (43) of Meghang Rural Municipality-4 of Nuwakot district; Sanjay Ghale of Kavresthali, Tarkeshwar Municipality-2 in Kathmandu; Laxmi Lama Tamang (40), Nirmala Tamang (20), Nima Tamang (18), all from Naukunda Rural Municipality-5 of Rasuwa; Pushparaj Khadka (42) of Hariban Municipality-2 in Sarlahi; Bidyasagar Lamichhane (23) of Dordi Rural Municipality-3 in Lamjung; Shravan Kumar Shrestha (38) of Bhanu Municipality-9 in Tanahun; Sunita Shrestha (32) of Thimi Municipality-4 in Bhaktapur; Shubankar Panja (30), permanent resident of Kolkata in India, currently residing in Tebahal, Kathmandu; Bijay Sah (22), and Chandara Bahadur Budha (45), both from Bhajani Municipality in Kailali district.
According to the Police, the preliminary investigation indicates that a sum of Rs 47,396,000 was hacked from Agricultural Development Bank Ltd (ADBL). Likewise, a sum of Rs 1,200,000 was stolen from Panas Remit in New Baneshwar.
Spokesperson at the ADBL head office in Kathmandu Him Lal Poudel, however, claimed that the incident occurred due to misuse of password. He suspected that it was not a case of hacking. “The amount stolen by the perpetrators ranged between Rs 15 million and Rs 20 million,” he said adding that the bank has started an internal investigation into the incident alongside police.
“Further investigation is going on to determine the total amount hacked,” the Police also informed, disclosing that Peter used to contact the Nepalis, call them to India for meetings, and then asked them to carry out the fraud offering commission ranging from 15 per cent to 35 per cent. “Peter then made them send the remaining sum to India via hundi.”
Suspecting the illegal transactions on September 22, staffers of Panas Remit asked the Police to investigate, which led to the arrest of 12 Nepalis.
Some Rs 6 million has been collected by different people in a day from the financial institution. The remittance sender was shown to be the same person, an employee of the company, which has raised suspicion that someone has hacked the employee’s account to send the same sum of money multiple times. “The Police started a full-fledged investigation after the staffers from the Panas Remit complained of the suspicious transactions,” the Police said, adding that the same mastermind also manipulated user-id and IP address of Agricultural Development Bank Ltd (ADBL) to transfer the money into the accounts of 11 different persons. “Further investigation into the case is going on.”

Central bank mulls stricter security policy

The central bank is mulling to introduce stricter cybersecurity policy as the Saturday’s hacking on various ATMs in Kathmandu have exposed significant security vulnerabilities in the Nepali banking system.
The central bank is amending its cyber security directive making banks and financial institutions (BFIs) adopt sophisticated technology to prevent the sporadic cyber and malware attacks in the banking system. Some Chinese nationals stole millions from ATMs of different banks few days ago also due to poor IT security among BFIs to cope with cyber and malware attacks, which is not the first time in Nepal.
The central bank will introduce a few provisions for BFIs related to cyber security as soon as the investigation on Saturday’s banking heist concludes, the central bank said, adding that the BFIs should be aware of such cyber attacks and adopt sophisticated technologies.
The central bank has also formed a probe committee led by head of Department of Payment System at the Nepal Rastra Bank (NRB) Bam Bahadur Mishra to investigate the ATM Freud. “The committee will prepare its preliminary report by midnight today and submit it to the central bank by tomorrow,” he said, adding that the Chinese hackers have withdrawn substantial amount of money from those ATM boths. The central bank has, however, earlier said that the the BFIs have notified the regulator that the hackers have withdrawn Rs 16.87 million in Nepali currency from ATM cards of different banks and Rs 10.5 million Indian Currency (IC) from ATM booths in India through the use of Nepali ATM cards.
The Nepali ATM cards are used in India also.
The Police claimed that it has recovered around Rs 12.63 million from the five Chinese nationals and suspected rest of the cash looted from Nepal have been carried away by absconders.
“But the details of the heist and the amount withdrawn by hackers will be available only after the digital forensic test, which will take more than a week,” Mishra added.
The hackers, according to Police, used electronic cards of at least six banks – NIC Asia, Siddhartha, Janata, Global IME, Prabhu and Sunrise – and used them at ATMs of three banks – Nabil, Nepal Investment and Nepal SBI – to illegally withdraw the money frpm ATM booths as the BFIs failed to conduct periodic security audits, comply with the latest technology and invest adequately in digital security.
Police has arrested a Chinese citizen Zhu Lianang on Saturday night from a Nabil Bank ATM booth in Durbar Marg, while attempting to withdraw cash. Zhu named four other Chinese nationals, who were involved in stealing cash from ATMs by using cloned debit cards to breach processing systems.
Although the central bank has made it mandatory for banks to conduct information security audits, many banks have not been allocating an adequate budget for a proper audit.
Despite banks making record profits year after year, the BFIs are blamed for not investment in digital security. In the last fiscal year, commercial banks made a net profit of over Rs 60 billion, with almost all of them posting net profits of more than Rs 1 billion each, according to the central bank.
Although most banks have transitioned to debit and credit cards with microchips, there are still a few banks that still use magnetic strips in their cards, which poses a vulnerability. Banks fail to follow security protocols for Swift and governance risk compliance systems for the Nepal Electronic Payment Systems (NEPS) – a local interface that allows transactions of money deposited in one bank using cards issued by other member banks – which should also have management oversight and an independent audit system.
Nepali BFIs currently use different types of software including Finacle, Temenos T24 and different editions of Pumori Plus.