Low-tech hack was behind $7.2bn SocGen fraud
FSA warns City on risks
The French software developer turned rogue trader who cost French bank Société Générale an estimated €4.9bn ($7.2bn) used co-workers' access codes to set up fraudulent transactions.
Jerome Kerviel used his colleagues' access codes and sent fraudulent email in order to create fictitious accounts to take risky positions in the derivatives market, resulting in huge losses as stock markets across Europe fell. He used his five years' experience in helping to develop the bank's trading systems to remove limits on his personal trading positions, and faked customer accounts to balance the books.
He also used hacking techniques to turn off warning systems that could have alerted his bank about anomalous trading patterns, The Daily Telegraph reports. This sounds complicated, but could have been as simple as manipulating the production of Excel spreadsheets that are used to provide trading updates to bosses, according to City experts.
A copy of Kerviel's CV found circulating on the net - which lists Microsoft Office and Microsoft Visual Basic as his only IT-related skills - supports the theory that the rogue trader carried out a low-tech hack, Information Week adds.
The alarming SocGen debacle ought to galvanise the UK's investment banks, spurring efforts to tighten up trading controls, according to City regulator the Financial Services Authority.
The watchdog warns that the scandal has emerged at a time when the global credit crunch is putting pressure on dealers, thereby creating an environment where some are more likely to be tempted into cutting corners while firms are tempted to divert resources away from security controls. The scenario was one of five key threats to the financial system detailed in the regulator's annual Financial Risk Outlook report.
Specifically, it warned that "tighter economic conditions could increase the incidence or discovery of some types of financial crime or lead to firms’ resources being diverted away from tackling financial crime".
Another key risk identified in the report is that "increased financial pressures may lead to financial firms shifting their efforts away from focusing on conduct-of-business requirements and from maintaining and strengthening business-as-usual processes, such as stress testing and credit derivative trade confirmations".
The report goes on to talk about the strain imposed on back-office systems by the rapid expansion of the credit derivatives markets.
"If firms are not able to keep up with this growth, they could face operational and legal risks. In general, credit derivative trade confirmation backlogs have been reduced while deal volume has grown rapidly but despite improvements back-office operations were unable to manage the increases in volumes during periods of heightened market volatility."
If anything, reporting problems are worse in the equity derivatives market, the scene of the SocGen meltdown. The FSA's analysis of IT-related risks in the market bears repeating in full:
The equity derivatives market faces a different set of challenges compared with the credit derivatives market. These include a lack of standardised master confirmations, a more diverse client base with far fewer interbank trades and multiple electronic confirmation platform providers (which have been under utilised).
The industry has made some progress in addressing these issues, but there is still much progress to be made before equity derivative confirmation processes may be considered fully scalable. Currently less than 20 per cent of equity derivative trades are electronically confirmed compared with 90 per cent of credit derivatives.
Lack of (rapid) electronic confirmation may have been a factor exploited by Kerviel to hide his transactions, or rack up a huge debt before he was discovered. Until a full investigation is carried out, it's hard to know. City regulators are sure to take a close look at the results of the Société Générale investigation, which is been led by the French authorities.
"This [the SocGen rogue trader scandal] has been a wake-up call for our firms," said the FSA's head of risk Lyndon Nelson, The Daily Telegraph reports. "We have obviously been liaising with our French colleagues and other authorities here in the UK, and we are looking for lessons to learn." ®
citations and evidence please ..
Dear John, do you have citations or any evidence for the following:
01. Jérome Kerviel was a software developer
02. used co-workers' access codes to set up fraudulent transactions
03. sent fraudulent email
04. helped to develop the bank's trading systems
05. disabled warning system
Since when did a certificate in Visual Basic make you a software developer .. :)
"could have been as simple as manipulating the production of Excel spreadsheets that are used to provide trading updates to bosses, according to City experts.
What was the name of these 'experts'. How does allegidly faking data in a spreadsheet translate into hacking, using access codes and sending fraudulent email. Do you have any samples of these emails?
"A copy of Kerviel's CV found circulating on the net"
EDUCATION MASTERS in Finance .. Bachelor Degree in Finance
University of Nantes, 1996 1999
SKILLS Microsoft Office Packge - Visual Basic
"The photos of you and the girl will be recycled for proletarian use", 1984
ID KEY system will deter all fraud crimes.
Fraud crimes will continue to grow until the government and banks exploit ID KEY system described on website www.xwave.co.uk which will make both signature and PIN systems reliable and foolproof.
Current signature and PIN systems are the root cause of the problem because fake documents have made signature system unreliable while skimmers and pin-hole cameras have made PIN system unreliable.
It is obvious that it is virtually impossible to stop fraudsters from obtaining our personal details and hence the need to deter fraudsters from misusing these stolen details via use of ID KEY system is a must to deter fraud crimes.
Proposed ID KEY can be treated as a reliable international ID card because it will personalise signature and PIN number to only the right individuals.
Lone hacker... oh really
The story in yesterday's Independent is more believable - it suggested that his bosses knew what he was doing but because he was making shedloads of money they turned a blind eye.