A $10 million computer fraud against Citibank appeared to be the first successful penetration by a hacker into the systems that transfer trillions of dollars a day around the world's banks, bank security experts said yesterday.
New details of the case were disclosed as a Federal complaint was unsealed in Manhattan. A 34-year-old Russian and his accomplices were accused of tapping into Citibank's computer system and transferring $10 million to various bank accounts around the world.
The hackers were accused of breaking into Citibank's cash management system, a network that allows its corporate customers to transfer money to any bank account in the world. Amy Dates, a Citibank spokeswoman, said that all but $400,000 of the $10 million illegally transferred had been recovered by Citibank. Ms. Dates said this was the only successful attack of this kind suffered by the bank, a subsidiary of Citicorp.
"We move half a trillion dollars a day through the payment system," she said. "Compare that to the $400,000 they were able to withdraw. We think we have the right level of security." Citibank said that none of its depositors lost any money in the fraud.
But banking experts said similar break-ins were bound to occur with more banking business being done electronically at a time when more powerful personal computers are available.
"I'm worried that there are more people with computers and more savvy people trying to break in," said the head of technology at a large New York bank who insisted on anonymity. "We have to keep raising the bar of our security."
Until more details emerge, it is difficult to assess the the potential threat of this kind of break-in. Court documents say the transfers were made from the Citibank accounts of three banks -- Invest Capital and Banco del Sud of Argentina and Bank Artha Graha of Indonesia -- and done with identification numbers and passwords that would have been available to employees of those banks. Experts said they could not recall a similar fraud involving transfer systems.
"In the many years I have been involved in funds transfer, this is the first time I can recall someone using a personal computer to perpetrate a crime," said John Mohr, executive vice president of the New York Clearing House, which runs the Chips interbank wire-transfer system.
Banks protect cash-management systems that corporate customers use to move millions of dollars with the best security methods available. Typically, several people, each with separate passwords, must authorize transfers, and they must also have other information. There are further protections, like computer programs that generate special security codes.
Since the break-in, which occurred last year, Citibank has required customers to use an electronic device that creates a new password for every transfer, Ms. Dates of Citibank said.
Banking experts said that the degree of penetration into Citibank's systems would typically require the cooperation of someone with inside knowledge. Ms. Dates said there was no evidence of involvement by a current or former Citibank employee, but she noted the investigation was continuing.
The complaint, filed in February, was released yesterday by the United States Attorney's office in Manhattan against Vladimir Leonidovich Levin, a computer expert who works for AO Saturn, a trading company based in St. Petersburg, Russia.
Mr. Levin was arrested in London three months ago, and Federal officials have filed to extradite him to the United States.
According to court documents, charges have been filed in the Federal courts against at least three other people in the case.
Vladimir Voronin had pleaded guilty to charges of bank fraud and awaits sentencing. Yekaterina Korolkova has been indicted. And her husband, Yevgeny Korolkov, was also indicted but has not been arrested.
In addition, two people related to the case have been arrested in the Netherlands and one has been arrested in Israel, Ms. Dates said. Their names were not released.
Various court documents contend that from June to October of 1994, Mr. Levin tapped into Citibank's central computer at 111 Wall Street and made 40 transfers from the accounts of several Citibank customers into accounts opened by accomplices at banks in California and in Israel.
The bank noticed the activity after several of the customers complained about unauthorized transfers from their accounts.
In early August of last year, $522,000 in funds was transferred to the Bank of America into two accounts controlled by Yevgeny and Yekaterina Korolkova. After Citibank notified Bank of America of the suspected fraud, the accounts were frozen.
On Aug. 17 and 18, Mrs. Korolkova opened checking accounts at five banks in San Francisco, and a total of $199,000 was transferred into them from the account of a Citibank customer in Buenos Aires. On Aug. 26, she was arrested by the F.B.I. and found to be in possession of a one-way ticket to Russia.
Court documents quote Mr. Korolkova's landlord as saying that Mr. Korolkova left the United States to go to Russia.
In October 1994, telephone company employees in Russia, working with Citibank, identified the source of the transfers as AO Saturn, the company where Mr. Levin was identified as the "head systems operator." It is unclear how Mr. Levin was located for his arrest in London. A hearing on his extradition is scheduled for Sept. 15.